xworm | f5883a24e7944446c96fd756ff7903fb82d7af8eb3d67d4d45e05a9d6481d78b

Analysis

max time kernel
126s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20231222-en
resource tags

arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
submitted
12-02-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

botkiller_v2.exe
Size

2.4MB
MD5

393f1a65423bed5cd9fe07f0961c57fd
SHA1

24e44d12f7b480cbde26416ed0c0d5d6de16d173
SHA256

f5883a24e7944446c96fd756ff7903fb82d7af8eb3d67d4d45e05a9d6481d78b
SHA512

98722a4bfc30ba4ca2804fd18a2bec26c8cf4c55aaae29992067e7e212fb9b3756c3e67ad97623410dff780ae6b5e325427df51d4ccbc3b709c9291fe280dff7
SSDEEP

49152:N4G1qYbwVg9/146wPdppKF2gZKudi5HezLE06+3QXYfjbV+e:N5wSh146UBKPPdiBOE0QIfjb1

Score

10^/10

xworm discovery persistence rat trojan

Malware Config

Extracted

Family

xworm

147.185.221.16:40745

Attributes

Install_directory
%AppData%
install_file
Wurst Client.exe

Signatures

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Streetfighter 2verses.exe	family_xworm
behavioral1/memory/1976-22-0x00000000001A0000-0x00000000001BA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Drops startup file 2 IoCs

Processes:

Streetfighter 2verses.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wurst Client.lnk	Streetfighter 2verses.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wurst Client.lnk	Streetfighter 2verses.exe

Executes dropped EXE 6 IoCs

Processes:

Streetfighter 2verses.exestreet-fighter-ii-plus-en-win.exeis-3PRLT.tmpFusion.exeWurst Client.exeWurst Client.exe

pid process

1976 Streetfighter 2verses.exe
1988 street-fighter-ii-plus-en-win.exe
3204 is-3PRLT.tmp
1676 Fusion.exe
1012 Wurst Client.exe
1284 Wurst Client.exe
Loads dropped DLL 1 IoCs

Processes:

Fusion.exe

pid process

1676 Fusion.exe

pid	process
1976	Streetfighter 2verses.exe
1988	street-fighter-ii-plus-en-win.exe
3204	is-3PRLT.tmp
1676	Fusion.exe
1012	Wurst Client.exe
1284	Wurst Client.exe

pid	process
1676	Fusion.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Streetfighter 2verses.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1184116928-951304463-2249875399-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wurst Client = "C:\\Users\\Admin\\AppData\\Roaming\\Wurst Client.exe"	Streetfighter 2verses.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Fusion.exe

description	ioc	process
File opened (read-only)	\??\R:	Fusion.exe
File opened (read-only)	\??\W:	Fusion.exe
File opened (read-only)	\??\X:	Fusion.exe
File opened (read-only)	\??\O:	Fusion.exe
File opened (read-only)	\??\P:	Fusion.exe
File opened (read-only)	\??\M:	Fusion.exe
File opened (read-only)	\??\N:	Fusion.exe
File opened (read-only)	\??\Q:	Fusion.exe
File opened (read-only)	\??\H:	Fusion.exe
File opened (read-only)	\??\J:	Fusion.exe
File opened (read-only)	\??\L:	Fusion.exe
File opened (read-only)	\??\V:	Fusion.exe
File opened (read-only)	\??\Z:	Fusion.exe
File opened (read-only)	\??\G:	Fusion.exe
File opened (read-only)	\??\I:	Fusion.exe
File opened (read-only)	\??\S:	Fusion.exe
File opened (read-only)	\??\T:	Fusion.exe
File opened (read-only)	\??\U:	Fusion.exe
File opened (read-only)	\??\Y:	Fusion.exe
File opened (read-only)	\??\E:	Fusion.exe
File opened (read-only)	\??\K:	Fusion.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com

flow	ioc
1	ip-api.com

Drops file in Program Files directory 8 IoCs

Processes:

is-3PRLT.tmp

description	ioc	process
File created	C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\unins000.dat	is-3PRLT.tmp
File created	C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\is-C7N9I.tmp	is-3PRLT.tmp
File created	C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\is-CSJL9.tmp	is-3PRLT.tmp
File created	C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\is-CIIE2.tmp	is-3PRLT.tmp
File created	C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\is-CA91A.tmp	is-3PRLT.tmp
File created	C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\is-PHHLN.tmp	is-3PRLT.tmp
File opened for modification	C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\Fusion.url	is-3PRLT.tmp
File opened for modification	C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\unins000.dat	is-3PRLT.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3468 schtasks.exe

pid	process
3468	schtasks.exe

Modifies registry class 1 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1184116928-951304463-2249875399-1000\{4B9CF0E1-0822-4C64-B3B0-511E913CF137}	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeStreetfighter 2verses.exe

pid	process
3216	powershell.exe
3216	powershell.exe
3236	powershell.exe
3236	powershell.exe
2632	powershell.exe
2632	powershell.exe
3232	powershell.exe
3232	powershell.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe
1976	Streetfighter 2verses.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

Fusion.exeOpenWith.exe

pid process

1676 Fusion.exe
4584 OpenWith.exe

pid	process
1676	Fusion.exe
4584	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

Streetfighter 2verses.exepowershell.exepowershell.exepowershell.exepowershell.exeAUDIODG.EXEWurst Client.exeWurst Client.exe

description	pid	process
Token: SeDebugPrivilege	1976	Streetfighter 2verses.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	3232	powershell.exe
Token: SeDebugPrivilege	1976	Streetfighter 2verses.exe
Token: 33	4076	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4076	AUDIODG.EXE
Token: SeDebugPrivilege	1012	Wurst Client.exe
Token: SeDebugPrivilege	1284	Wurst Client.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

Streetfighter 2verses.exeFusion.exeOpenWith.exe

pid process

1976 Streetfighter 2verses.exe
1676 Fusion.exe
4584 OpenWith.exe
1676 Fusion.exe
1676 Fusion.exe
1676 Fusion.exe
1676 Fusion.exe

pid	process
1976	Streetfighter 2verses.exe
1676	Fusion.exe
4584	OpenWith.exe
1676	Fusion.exe
1676	Fusion.exe
1676	Fusion.exe
1676	Fusion.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

botkiller_v2.exestreet-fighter-ii-plus-en-win.exeStreetfighter 2verses.exeis-3PRLT.tmp

description	pid	process	target process
PID 72 wrote to memory of 1976	72	botkiller_v2.exe	Streetfighter 2verses.exe
PID 72 wrote to memory of 1976	72	botkiller_v2.exe	Streetfighter 2verses.exe
PID 72 wrote to memory of 1988	72	botkiller_v2.exe	street-fighter-ii-plus-en-win.exe
PID 72 wrote to memory of 1988	72	botkiller_v2.exe	street-fighter-ii-plus-en-win.exe
PID 72 wrote to memory of 1988	72	botkiller_v2.exe	street-fighter-ii-plus-en-win.exe
PID 1988 wrote to memory of 3204	1988	street-fighter-ii-plus-en-win.exe	is-3PRLT.tmp
PID 1988 wrote to memory of 3204	1988	street-fighter-ii-plus-en-win.exe	is-3PRLT.tmp
PID 1988 wrote to memory of 3204	1988	street-fighter-ii-plus-en-win.exe	is-3PRLT.tmp
PID 1976 wrote to memory of 3216	1976	Streetfighter 2verses.exe	powershell.exe
PID 1976 wrote to memory of 3216	1976	Streetfighter 2verses.exe	powershell.exe
PID 1976 wrote to memory of 3236	1976	Streetfighter 2verses.exe	powershell.exe
PID 1976 wrote to memory of 3236	1976	Streetfighter 2verses.exe	powershell.exe
PID 1976 wrote to memory of 2632	1976	Streetfighter 2verses.exe	powershell.exe
PID 1976 wrote to memory of 2632	1976	Streetfighter 2verses.exe	powershell.exe
PID 1976 wrote to memory of 3232	1976	Streetfighter 2verses.exe	powershell.exe
PID 1976 wrote to memory of 3232	1976	Streetfighter 2verses.exe	powershell.exe
PID 1976 wrote to memory of 3468	1976	Streetfighter 2verses.exe	schtasks.exe
PID 1976 wrote to memory of 3468	1976	Streetfighter 2verses.exe	schtasks.exe
PID 3204 wrote to memory of 1676	3204	is-3PRLT.tmp	Fusion.exe
PID 3204 wrote to memory of 1676	3204	is-3PRLT.tmp	Fusion.exe
PID 3204 wrote to memory of 1676	3204	is-3PRLT.tmp	Fusion.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\botkiller_v2.exe
"C:\Users\Admin\AppData\Local\Temp\botkiller_v2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:72

C:\Users\Admin\AppData\Local\Temp\Streetfighter 2verses.exe
"C:\Users\Admin\AppData\Local\Temp\Streetfighter 2verses.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Streetfighter 2verses.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Streetfighter 2verses.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Wurst Client.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Wurst Client.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Wurst Client" /tr "C:\Users\Admin\AppData\Roaming\Wurst Client.exe"
3⤵
- Creates scheduled task(s)
PID:3468

C:\Users\Admin\AppData\Local\Temp\street-fighter-ii-plus-en-win.exe
"C:\Users\Admin\AppData\Local\Temp\street-fighter-ii-plus-en-win.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\is-8DN71.tmp\is-3PRLT.tmp
"C:\Users\Admin\AppData\Local\Temp\is-8DN71.tmp\is-3PRLT.tmp" /SL4 $50200 "C:\Users\Admin\AppData\Local\Temp\street-fighter-ii-plus-en-win.exe" 1950296 52224
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3204

C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\Fusion.exe
"C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\Fusion.exe" Street-Fighter-2-Plus-Champion-Edition-(J)-[!].zip
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2352

C:\Users\Admin\AppData\Roaming\Wurst Client.exe
"C:\Users\Admin\AppData\Roaming\Wurst Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Users\Admin\AppData\Roaming\Wurst Client.exe
"C:\Users\Admin\AppData\Roaming\Wurst Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\Fusion.exe

Filesize
2.4MB

MD5
e12e797a82c351b359a98d0573c4b5c3

SHA1
3dd7ff6d0a37a2d81582e510ce45c9728d5fc04f

SHA256
72ec96fc652d3276b2bc318fecee1bba3bdf80d8e9b593128aff0e9ce36a6c8e

SHA512
776275c7b9679287b70834b8240f38997415c55e9e0bcbafcccd5db825d6bacb3ebf8506080d3fab76274384b3acd1e8f3ddaf5bcd18bba59c5a9c084fac12f4

Download Submit
C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\Fusion.ini

Filesize
4KB

MD5
b66240fa278e78a47f0c7ead338258ef

SHA1
e523a370ef6f0f0e3aa12dba1c4df951e3f12b32

SHA256
3de784ef5a30ab0e654c5103c707e128d37d34af22e827acfb60e6d08c8dc087

SHA512
c94afcc132b34d6e844dedbea009ab44728c4728a994311fc5baf399618ef3f51c689a512bec1eefd94bdc0ef5d830c561e4d4614e788517ea8055a43b17ad30

Download Submit
C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\Street-Fighter-2-Plus-Champion-Edition-(J)-[!].zip

Filesize
1.5MB

MD5
c42fe2366d341905476a68dffa282959

SHA1
48217071a0dd0450c736352c3bf0d1d294169523

SHA256
3d16b5495c3b3019f831c95944526fb68c93f8d45d8f039bd7ce980da7910d8b

SHA512
d908a7101b50937bb7d35275981f64b5d6f0948226708092df5b7d3b1d2d09fbe5eab2298f4c849d5432e8e04d013679f8bc07ccb6d63a58e31c5ea05e541058

Download Submit
C:\Program Files (x86)\Street Fighter 2 Plus Champion Edition\hq4x.rpi

Filesize
632KB

MD5
398d101c484314bbbccf0857fc0f41da

SHA1
d04d88735ff66fb299f127c43396cc262ae3f3a5

SHA256
9b433b6cfd10bdcd6c9c18ceaf244280590961b5278737da7fb205725f5d04c4

SHA512
b55c9198d53963a031f569f7b166c63021e6acf14bbb81aef3507f49134d11c67e8641bd745e7a1f142517ab8cd9da9f5166ff30bdebbf05f66dbc559b98afce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Wurst Client.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4093e5ab3812960039eba1a814c2ffb0

SHA1
b5e4a98a80be72fccd3cc910e93113d2febef298

SHA256
c0794e2b7036ce5612446a8b15e0c8387773bbc921f63cf8849f8a1f4ef3878c

SHA512
f3555b45aa1a1dd5214716dc81a05905c4ecd5a3e1276d35e08c65623ab1d14d469b3b576a5d9638264c1222d73889d2cc1ee43fb579d9ca3fcddd9f557cac7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
39f275549f523222efba91bbfeedd021

SHA1
7e48c021b1e7b7c81b9a3b6b5cc1b220606e5731

SHA256
a0072f885bdd0063b2415b0aa78d2228348ead9a89b307032cbba01894d5f3cd

SHA512
3a0495982e447b14574f565c4756e4fe8a853543d5c791755f04de805f956f8a16109712a71b309d7ff4cd8385bffcbb40fceb054f59b7d742d7d9ed776d44f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
aa6b748cd8f3e3c0e41549529b919e21

SHA1
5a4b9721f9fb5042f6ef7afd698d5ac5216a88bb

SHA256
d7d665a42f940443efb28eb231dfe1c4062394e71fba145d6eea9ec075b0f0e8

SHA512
361c523f49428a7e430279099e669a1a8af8764653f42e83105c0da3f8e8dd3be6c1719ea8c158d8f2e8425d74457147a4683190eb4a67019b9d02be44c13534

Download Submit
C:\Users\Admin\AppData\Local\Temp\Streetfighter 2verses.exe

Filesize
76KB

MD5
3fe100d52f16ad437d735fe337e26045

SHA1
fc9dfa5c989063a4e01c3d390852d10585fa6f2f

SHA256
ec40152ef39685c68f9db62c6383c5fcb0096eeb91582c35dd1d4aa1ae5c5e65

SHA512
a75d105c507a900323cfe399d5b5b93341ae893763d9cf869c1cfe6bee082ff0d60dce357423aced3f8e71ef80fee8fda4757223f0070466eb5f968c40af2fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5qib3qjr.chf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8DN71.tmp\is-3PRLT.tmp

Filesize
647KB

MD5
b683339ce008e97a0243a0f83bca1e09

SHA1
a8a4c078225ec9d94912762bda3a745d83dbe8f4

SHA256
5c6b8a1ab73cd03140040a3093e0d8466c666cd3fe17e8660dbc1a30d0b6f925

SHA512
c39b2501f5887c363633c94b04d58396a0d285ff65963ed513e99ff2dd7f36da323904278c6a64b9f1f637aaeed17e3d9d40540baa9805369cc664a32c62c780

Download Submit
C:\Users\Admin\AppData\Local\Temp\street-fighter-ii-plus-en-win.exe

Filesize
2.1MB

MD5
b9fdeac0fe8bd7910bee03b87f58c40e

SHA1
4202338dd8cba126d35a06876559d7cefdff196d

SHA256
316691de2e852f677c55ab0530c4623d980b0bf08a007f353163c765a839cdb6

SHA512
f4914116a6d7b33a295b7791ce07c6a01c2d1035e5e3683bd2b6ca4ead54b2191954e49f351dd859abbd5dcb7236930c10b40abecae156d5eaececdcedaa47fe

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/72-3-0x00000000019B0000-0x00000000019C0000-memory.dmp

Filesize
64KB

Download
memory/72-0-0x0000000000E10000-0x0000000001076000-memory.dmp

Filesize
2.4MB

Download
memory/72-29-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/72-1-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/1012-164-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/1012-167-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/1284-196-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/1284-197-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/1976-41-0x0000000000B20000-0x0000000000B30000-memory.dmp

Filesize
64KB

Download
memory/1976-55-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/1976-165-0x0000000002430000-0x000000000243C000-memory.dmp

Filesize
48KB

Download
memory/1976-24-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/1976-22-0x00000000001A0000-0x00000000001BA000-memory.dmp

Filesize
104KB

Download
memory/1976-89-0x0000000000B20000-0x0000000000B30000-memory.dmp

Filesize
64KB

Download
memory/1988-28-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1988-144-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1988-73-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2632-85-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/2632-88-0x0000024C79650000-0x0000024C79660000-memory.dmp

Filesize
64KB

Download
memory/2632-87-0x0000024C79650000-0x0000024C79660000-memory.dmp

Filesize
64KB

Download
memory/2632-91-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/3204-76-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/3204-38-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/3204-112-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3204-142-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/3216-51-0x000002B5EA290000-0x000002B5EA2B2000-memory.dmp

Filesize
136KB

Download
memory/3216-42-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/3216-53-0x000002B5EA2C0000-0x000002B5EA2D0000-memory.dmp

Filesize
64KB

Download
memory/3216-52-0x000002B5EA2C0000-0x000002B5EA2D0000-memory.dmp

Filesize
64KB

Download
memory/3216-58-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/3216-54-0x000002B5EA2C0000-0x000002B5EA2D0000-memory.dmp

Filesize
64KB

Download
memory/3232-104-0x000001C5DBFE0000-0x000001C5DBFF0000-memory.dmp

Filesize
64KB

Download
memory/3232-106-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/3232-102-0x000001C5DBFE0000-0x000001C5DBFF0000-memory.dmp

Filesize
64KB

Download
memory/3232-98-0x000001C5DBFE0000-0x000001C5DBFF0000-memory.dmp

Filesize
64KB

Download
memory/3232-97-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/3236-75-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download
memory/3236-72-0x00000199FF930000-0x00000199FF940000-memory.dmp

Filesize
64KB

Download
memory/3236-71-0x00000199FF930000-0x00000199FF940000-memory.dmp

Filesize
64KB

Download
memory/3236-70-0x00000199FF930000-0x00000199FF940000-memory.dmp

Filesize
64KB

Download
memory/3236-68-0x00007FF9CD5D0000-0x00007FF9CE092000-memory.dmp

Filesize
10.8MB

Download