xworm | f568aecb2053d8f96a1e9638a83308d9271088d793a8373955ae0915901afa33

Analysis

max time kernel
37s
max time network
34s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29-06-2024 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SCINSTALLER.exe
Size

15.8MB
MD5

9fef698c512d5661717f0bf5ad97c165
SHA1

8a04d3c0c42725efcb3895cfa6bb4e76065705ae
SHA256

f568aecb2053d8f96a1e9638a83308d9271088d793a8373955ae0915901afa33
SHA512

cf595ef7a2f0be6e45c41582189c632829839c09103c54c056c3628fc36de8fa50766711f37ac02af80e54acbe5aab4d62ef67a4d40c84ee0c69352eccdae799
SSDEEP

393216:EKjbZBCC8qxl0ARCxhApMeQaHsWWWlbjJtKhPM1JRh:EKnZtLl0ARCxK+4Hs+lihU73

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

hardware-bands.gl.at.ply.gg:63257

Mutex

GRHeRJRFnCzlkxGI

Attributes

Install_directory
%AppData%
install_file
DiscordAutoUpdate.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Updater.exe family_xworm
behavioral1/memory/4380-26-0x00000000000B0000-0x00000000000C4000-memory.dmp family_xworm
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4844 powershell.exe
4292 powershell.exe
4664 powershell.exe
1384 powershell.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Updater.exe	family_xworm
behavioral1/memory/4380-26-0x00000000000B0000-0x00000000000C4000-memory.dmp	family_xworm

Drops startup file 2 IoCs

Processes:

Updater.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordAutoUpdate.lnk	Updater.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DiscordAutoUpdate.lnk	Updater.exe

Executes dropped EXE 4 IoCs

Processes:

SCINSTALLER.exeUpdater.exeUpdater.exeDiscordAutoUpdate.exe

pid process

3772 SCINSTALLER.exe
3876 Updater.exe
4380 Updater.exe
4656 DiscordAutoUpdate.exe
Loads dropped DLL 6 IoCs

Processes:

MsiExec.exe

pid process

1660 MsiExec.exe
1660 MsiExec.exe
1660 MsiExec.exe
1660 MsiExec.exe
1660 MsiExec.exe
1660 MsiExec.exe

pid	process
3772	SCINSTALLER.exe
3876	Updater.exe
4380	Updater.exe
4656	DiscordAutoUpdate.exe

pid	process
1660	MsiExec.exe
1660	MsiExec.exe
1660	MsiExec.exe
1660	MsiExec.exe
1660	MsiExec.exe
1660	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Updater.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\DiscordAutoUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\DiscordAutoUpdate.exe"	Updater.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SCINSTALLER.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Y:	SCINSTALLER.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	SCINSTALLER.exe
File opened (read-only)	\??\W:	SCINSTALLER.exe
File opened (read-only)	\??\S:	SCINSTALLER.exe
File opened (read-only)	\??\Z:	SCINSTALLER.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	SCINSTALLER.exe
File opened (read-only)	\??\M:	SCINSTALLER.exe
File opened (read-only)	\??\P:	SCINSTALLER.exe
File opened (read-only)	\??\V:	SCINSTALLER.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	SCINSTALLER.exe
File opened (read-only)	\??\N:	SCINSTALLER.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	SCINSTALLER.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	SCINSTALLER.exe
File opened (read-only)	\??\O:	SCINSTALLER.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	SCINSTALLER.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	SCINSTALLER.exe
File opened (read-only)	\??\X:	SCINSTALLER.exe
File opened (read-only)	\??\L:	SCINSTALLER.exe
File opened (read-only)	\??\Q:	SCINSTALLER.exe
File opened (read-only)	\??\R:	SCINSTALLER.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\A:	SCINSTALLER.exe
File opened (read-only)	\??\G:	SCINSTALLER.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	SCINSTALLER.exe
File opened (read-only)	\??\L:	msiexec.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

4072 schtasks.exe

flow	ioc
4	ip-api.com

pid	process
4072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeUpdater.exe

pid	process
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
4292	powershell.exe
4292	powershell.exe
4292	powershell.exe
4664	powershell.exe
4664	powershell.exe
4664	powershell.exe
1384	powershell.exe
1384	powershell.exe
1384	powershell.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe
4380	Updater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Updater.exemsiexec.exeSCINSTALLER.exe

description	pid	process
Token: SeDebugPrivilege	4380	Updater.exe
Token: SeSecurityPrivilege	4900	msiexec.exe
Token: SeCreateTokenPrivilege	3772	SCINSTALLER.exe
Token: SeAssignPrimaryTokenPrivilege	3772	SCINSTALLER.exe
Token: SeLockMemoryPrivilege	3772	SCINSTALLER.exe
Token: SeIncreaseQuotaPrivilege	3772	SCINSTALLER.exe
Token: SeMachineAccountPrivilege	3772	SCINSTALLER.exe
Token: SeTcbPrivilege	3772	SCINSTALLER.exe
Token: SeSecurityPrivilege	3772	SCINSTALLER.exe
Token: SeTakeOwnershipPrivilege	3772	SCINSTALLER.exe
Token: SeLoadDriverPrivilege	3772	SCINSTALLER.exe
Token: SeSystemProfilePrivilege	3772	SCINSTALLER.exe
Token: SeSystemtimePrivilege	3772	SCINSTALLER.exe
Token: SeProfSingleProcessPrivilege	3772	SCINSTALLER.exe
Token: SeIncBasePriorityPrivilege	3772	SCINSTALLER.exe
Token: SeCreatePagefilePrivilege	3772	SCINSTALLER.exe
Token: SeCreatePermanentPrivilege	3772	SCINSTALLER.exe
Token: SeBackupPrivilege	3772	SCINSTALLER.exe
Token: SeRestorePrivilege	3772	SCINSTALLER.exe
Token: SeShutdownPrivilege	3772	SCINSTALLER.exe
Token: SeDebugPrivilege	3772	SCINSTALLER.exe
Token: SeAuditPrivilege	3772	SCINSTALLER.exe
Token: SeSystemEnvironmentPrivilege	3772	SCINSTALLER.exe
Token: SeChangeNotifyPrivilege	3772	SCINSTALLER.exe
Token: SeRemoteShutdownPrivilege	3772	SCINSTALLER.exe
Token: SeUndockPrivilege	3772	SCINSTALLER.exe
Token: SeSyncAgentPrivilege	3772	SCINSTALLER.exe
Token: SeEnableDelegationPrivilege	3772	SCINSTALLER.exe
Token: SeManageVolumePrivilege	3772	SCINSTALLER.exe
Token: SeImpersonatePrivilege	3772	SCINSTALLER.exe
Token: SeCreateGlobalPrivilege	3772	SCINSTALLER.exe
Token: SeCreateTokenPrivilege	3772	SCINSTALLER.exe
Token: SeAssignPrimaryTokenPrivilege	3772	SCINSTALLER.exe
Token: SeLockMemoryPrivilege	3772	SCINSTALLER.exe
Token: SeIncreaseQuotaPrivilege	3772	SCINSTALLER.exe
Token: SeMachineAccountPrivilege	3772	SCINSTALLER.exe
Token: SeTcbPrivilege	3772	SCINSTALLER.exe
Token: SeSecurityPrivilege	3772	SCINSTALLER.exe
Token: SeTakeOwnershipPrivilege	3772	SCINSTALLER.exe
Token: SeLoadDriverPrivilege	3772	SCINSTALLER.exe
Token: SeSystemProfilePrivilege	3772	SCINSTALLER.exe
Token: SeSystemtimePrivilege	3772	SCINSTALLER.exe
Token: SeProfSingleProcessPrivilege	3772	SCINSTALLER.exe
Token: SeIncBasePriorityPrivilege	3772	SCINSTALLER.exe
Token: SeCreatePagefilePrivilege	3772	SCINSTALLER.exe
Token: SeCreatePermanentPrivilege	3772	SCINSTALLER.exe
Token: SeBackupPrivilege	3772	SCINSTALLER.exe
Token: SeRestorePrivilege	3772	SCINSTALLER.exe
Token: SeShutdownPrivilege	3772	SCINSTALLER.exe
Token: SeDebugPrivilege	3772	SCINSTALLER.exe
Token: SeAuditPrivilege	3772	SCINSTALLER.exe
Token: SeSystemEnvironmentPrivilege	3772	SCINSTALLER.exe
Token: SeChangeNotifyPrivilege	3772	SCINSTALLER.exe
Token: SeRemoteShutdownPrivilege	3772	SCINSTALLER.exe
Token: SeUndockPrivilege	3772	SCINSTALLER.exe
Token: SeSyncAgentPrivilege	3772	SCINSTALLER.exe
Token: SeEnableDelegationPrivilege	3772	SCINSTALLER.exe
Token: SeManageVolumePrivilege	3772	SCINSTALLER.exe
Token: SeImpersonatePrivilege	3772	SCINSTALLER.exe
Token: SeCreateGlobalPrivilege	3772	SCINSTALLER.exe
Token: SeCreateTokenPrivilege	3772	SCINSTALLER.exe
Token: SeAssignPrimaryTokenPrivilege	3772	SCINSTALLER.exe
Token: SeLockMemoryPrivilege	3772	SCINSTALLER.exe
Token: SeIncreaseQuotaPrivilege	3772	SCINSTALLER.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

SCINSTALLER.exe

pid process

3772 SCINSTALLER.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Updater.exe

pid process

4380 Updater.exe

pid	process
3772	SCINSTALLER.exe

pid	process
4380	Updater.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

SCINSTALLER.execmd.exeUpdater.exemsiexec.exeUpdater.exe

description	pid	process	target process
PID 2580 wrote to memory of 4864	2580	SCINSTALLER.exe	cmd.exe
PID 2580 wrote to memory of 4864	2580	SCINSTALLER.exe	cmd.exe
PID 2580 wrote to memory of 3772	2580	SCINSTALLER.exe	SCINSTALLER.exe
PID 2580 wrote to memory of 3772	2580	SCINSTALLER.exe	SCINSTALLER.exe
PID 2580 wrote to memory of 3772	2580	SCINSTALLER.exe	SCINSTALLER.exe
PID 4864 wrote to memory of 3876	4864	cmd.exe	Updater.exe
PID 4864 wrote to memory of 3876	4864	cmd.exe	Updater.exe
PID 3876 wrote to memory of 4380	3876	Updater.exe	Updater.exe
PID 3876 wrote to memory of 4380	3876	Updater.exe	Updater.exe
PID 4900 wrote to memory of 1660	4900	msiexec.exe	MsiExec.exe
PID 4900 wrote to memory of 1660	4900	msiexec.exe	MsiExec.exe
PID 4900 wrote to memory of 1660	4900	msiexec.exe	MsiExec.exe
PID 4380 wrote to memory of 4844	4380	Updater.exe	powershell.exe
PID 4380 wrote to memory of 4844	4380	Updater.exe	powershell.exe
PID 4380 wrote to memory of 4292	4380	Updater.exe	powershell.exe
PID 4380 wrote to memory of 4292	4380	Updater.exe	powershell.exe
PID 4380 wrote to memory of 4664	4380	Updater.exe	powershell.exe
PID 4380 wrote to memory of 4664	4380	Updater.exe	powershell.exe
PID 4380 wrote to memory of 1384	4380	Updater.exe	powershell.exe
PID 4380 wrote to memory of 1384	4380	Updater.exe	powershell.exe
PID 4380 wrote to memory of 4072	4380	Updater.exe	schtasks.exe
PID 4380 wrote to memory of 4072	4380	Updater.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SCINSTALLER.exe
"C:\Users\Admin\AppData\Local\Temp\SCINSTALLER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Update.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4864

C:\Updater.exe
Updater.exe -p1 -dC:\
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Updater.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Updater.exe"
4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\RarSFX0\Updater.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Updater.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4292

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4664

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DiscordAutoUpdate.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1384

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "DiscordAutoUpdate" /tr "C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe"
5⤵
- Scheduled Task/Job: Scheduled Task
PID:4072

C:\SCINSTALLER.exe
"C:\SCINSTALLER.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3772

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 066B3E04D0FC4C7716E1CC03CB3E4156 C
2⤵
- Loads dropped DLL
PID:1660

C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe
C:\Users\Admin\AppData\Roaming\DiscordAutoUpdate.exe
1⤵
- Executes dropped EXE
PID:4656

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\SCINSTALLER.exe
Filesize
17.6MB

MD5
b0ea56470940e14501f3de3704ee3dfd

SHA1
344a32cd672ae105a3d4d154c58c7c10345746a7

SHA256
a08acf97b669ad3896c129066e8afaea4173ff8e6d49256475adb07491dc160b

SHA512
ff3d9f9d9102f72daee17b86d30e6b6bb52c3b8b8f7f36e41d5bf656d3f1f8dc678bc41d446cde4519761942578bd16676dfe47797c7459cda3cd4420113708f

Download Submit
C:\Update.bat
Filesize
21B

MD5
6fa1a261757943e122328d51dc992db7

SHA1
a4c5fe1d9fc86f3bf2beb6570ae91bbc23c90618

SHA256
1eacacd2168cb166e116195b481f2040475597bc7bf6f65b48e46cc9f980f52d

SHA512
431144790f5d34b1cc51d830032c3f013d261d2680b5ceb7261c55eff6714fd5e42b68697c297feb6aecdcba1c03651786fc1d745f13a5537eed1db0394f033f

Download Submit
C:\Updater.exe
Filesize
471KB

MD5
d4948d78b2f0090c8b648a01fbedbd09

SHA1
83d365b0740babd40d7e88e8a479e720a4369878

SHA256
d742be12a3f9cec578354e3f4aeb85f6b577f03f8a6fee887602e23ede55b1c0

SHA512
91eeeb7172a40409cef92e0e5d0ceb4e8f332e0aeabc9baa4666e4fe9c99842d5dd1b125ebf7a6e0f06639b8039c7fa45d7e652c066998fe4eae181854b3dfc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
8ea384b0c019a0950b69e907d088c60f

SHA1
3f9d524e7c990e95ccffd1472b00a7289bd5b266

SHA256
3d31424905e860b7ae9cc340bb9d13907c67afacd2a4a9d643ba606f30a8aae5

SHA512
7ce37a06f68089fba0adc3f2ceddaff27ea971a45bf459ee15fa39b6b3135c6f51fee6148e74a65fa9360e5fbaa4030812c4f07c0e0b09ed1dd3e0a511055d41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
dadcc9e35283dd99faec81f5f3e91b44

SHA1
79bf27b31d1c21a835debdf4548d69b34478c69a

SHA256
f215b47ef63a168472fc0762e4eee499fd6c0677be9fbdda82e466ffe4c4ab4c

SHA512
0c8215f9037104949445115524a61227bc1c235241bd5a9783b0e7769a454ba9572c68afbd1f3e0a53667451698f61875dc8e708a7b946bf6570be9aae739565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f4a6bbae46563e50af7113175eb11641

SHA1
d4785c965f2cedbeb7320908d15d0c2726d41883

SHA256
26533f03eee838fba5251416dd3037b898feb126d825861e539ae4ea2ab07d5a

SHA512
e678cda4bbc42b203749ff8fe3cca746930f61127cc168c9c046cc6eca3499384a56626f18a671bbb895c704d321e842249436cb68337e7183a0012fea1285db

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3772\aboutbtn
Filesize
1KB

MD5
b51b54b77e9cbfdb1063f7487c1c07ec

SHA1
8a8a7036cfbc86a537447bf71b9f6795923db8b9

SHA256
9d7243c688264329a8cb9e22da00b651e0a9407741d722e03dd67cc8b3ee1335

SHA512
04cef1aa3a530e7f03054369450eb42f36bf45c13c7445adf450ec4635a8601447c5bb6e978b3adabe9021019644681bf1609539eb548dd50ada973aac0c6555

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3772\background
Filesize
2KB

MD5
9e23da7c3cd3fb8113e698a12a3d3047

SHA1
6d021109495d77a53afe101f2b03a4da847e6d99

SHA256
b671008e5d4a15409051d7b3d2aa40f7c028e1dab5876c2882976793abb9356c

SHA512
65e885984681cee190764515f61bb8da3c29463b87f4371fff27ae4c4089af46c9b98910a847ec29d7368160d6aaf841fb93f1347c9abc47bce5cf997c8b4ef2

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3772\buttonimgs
Filesize
1KB

MD5
6956ac5e9d5e47daeb7d147d67d9e526

SHA1
427449cf08f0c78f1bf3850565201991828e278c

SHA256
f8f4efdb34b00775638c95568761c93436812af56c8f41116f2f92a987ca9ae0

SHA512
a82f9d199e36dfcdad7393761d1cf541d67b0b70d4b31cf71ad38dab3e95b351143c1aff4adea3207d1fd1e9c3523e9b7e3cea37cb61f9f2845894c60327651c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3772\checkernewicon.png
Filesize
3KB

MD5
b1618ec6d5e7c1e293cb36ab87371615

SHA1
a9c47241b1378bca3b541abb07aeb4b1feb0ccf4

SHA256
76adccd20b35ba40b9be5ac4194941625826084f32a9c7c07090708946fc39c5

SHA512
a45e20225fe4d5989f6f8891274a8ed07f27c2b33545458f36bbb3356124fbf83c6d1523155b4830e6bb78a96e4fd282a7f43ec3d3ce77fe488f8640ff49da2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9898.tmp
Filesize
587KB

MD5
9e0aef52f6c03b2fea067342d9d4f22f

SHA1
d4431a858c8a7a79315829ec7aa82e838c2714f4

SHA256
42b8adafcb4e8496d9822a0c504f449e56456528a9251c153381d3f63d197e5b

SHA512
42858a6695d7906b3df4dc97f3b1fac737633a51ffb52e8ec8eddeb21f8cdb53c199bb698e54c4a931155eafd879de6fff114b84f298c84436b776e286ebeeb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9A9F.tmp
Filesize
1.1MB

MD5
c04ed00ddcb3518e8cf6db24db294a50

SHA1
cc98cc3ab9c4371f85ea227d9f761bab4aa76baa

SHA256
3c21e1f3bb3ebeb5f0ff68658db8abd18b62f8b195288c4bf87936fc51f8ae9e

SHA512
736946a3130f294878ea51145960017babcc1b8ac2c96afd8b9e2a4d120f173afb84bbd04b6f0113f286d4bc671befecd4e92c582f1de1a0d5bc8738c3cae9c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9D11.tmp
Filesize
709KB

MD5
eb7811666ac7be6477e23af68511424f

SHA1
1623579c5a3710dcc694a2fd49defa27d56d9175

SHA256
ad706739b04256b9215e80d2d030863a37f0d7fd0e4071d0a3a73d6704d8bd8f

SHA512
3055baa15c92f476513c66a423043dc4b8c5f83f47643ad77665d6a2f823f4655bf4ae241d8af4bc34d53630df1c35989f0b11b934a631960668fcc7a8c81a7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Updater.exe
Filesize
57KB

MD5
90a6868b7ce2020387d453aa38668584

SHA1
7bde411bb0d7b6aa7a020266a61ce0d61ef0b362

SHA256
d2b430a0c74ef2bd97c86d95c35fe964bd00ed17d2e6542be33cc7c99def9d5a

SHA512
243c6010cbee28f5181383565a00c22375828f8b5293d35d9512adb249a4fadfd04eab3fb7b9789d6e1bea39f1cf513439e0f7d72ecb69e00a16e8f6d7f0efcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdsco1bz.b2s.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\SandeLLo CHECKER\install\51B5780\SandeLLoCHECKER_Installer.msi
Filesize
4.7MB

MD5
69d9a69f84bc67feed975148b9e2ec7c

SHA1
b4cd30ae6c20a0a5297589a4739d9b5a3fc5154f

SHA256
2fc0bc7675b71742b759f44f00e23662f28ad3d04cc5e2956428e57cb61d55b7

SHA512
63b5c471d372611b3936f9f2dba302b95490719f228b7362c99957162f92fb4fb31d82dc5c6a55cf1f793dca9f321d601439c7f61aa94c11cc25302e365a428f

Download Submit
memory/4380-26-0x00000000000B0000-0x00000000000C4000-memory.dmp

Filesize
80KB

Download
memory/4844-133-0x000001D7F5760000-0x000001D7F57D6000-memory.dmp

Filesize
472KB

Download
memory/4844-130-0x000001D7F55B0000-0x000001D7F55D2000-memory.dmp

Filesize
136KB

Download