xworm | 501811083cd4441914057188240e81b0c07ee52da841be5b48439b23dd1c78b7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
20-01-2025 00:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

steam.exe
Size

64KB
MD5

931304a01acc611b8e637e4056eacf1a
SHA1

621327eb10dc7a3b4ea5f4f8eacde198a1b83eda
SHA256

501811083cd4441914057188240e81b0c07ee52da841be5b48439b23dd1c78b7
SHA512

3aba4030c25a9b90e2d5ebaafed9efd42314d60e4c5dc374a14ebb10788777372301129ccb92484e0d0ee188637ba8aa892e200b7c9f73e77cb0d8916ebf8b94
SSDEEP

1536:HtGW7tT67jrizXqMRJtjYtfEWPrfPh4bZKtpe/:0WpmLi+MOPr+bZ2pe/

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

25.ip.gl.ply.gg:22709

Attributes

Install_directory
%AppData%
install_file
svhost.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001c00000002ab19-7.dat	family_xworm
behavioral1/memory/2660-17-0x0000000000F20000-0x0000000000F38000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4572	powershell.exe
3440	powershell.exe
2944	powershell.exe
4892	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	yougame.biz.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svhost.lnk	yougame.biz.exe

Executes dropped EXE 64 IoCs

pid	Process
2660	yougame.biz.exe
1504	yougame.biz.exe
2276	yougame.biz.exe
4356	yougame.biz.exe
1516	yougame.biz.exe
4844	yougame.biz.exe
2356	yougame.biz.exe
3588	yougame.biz.exe
3076	yougame.biz.exe
3804	yougame.biz.exe
3564	yougame.biz.exe
1568	yougame.biz.exe
660	yougame.biz.exe
916	yougame.biz.exe
4868	yougame.biz.exe
3292	yougame.biz.exe
3772	yougame.biz.exe
2748	yougame.biz.exe
2968	yougame.biz.exe
2144	yougame.biz.exe
1952	yougame.biz.exe
2052	yougame.biz.exe
1096	yougame.biz.exe
2000	yougame.biz.exe
4360	yougame.biz.exe
736	yougame.biz.exe
3560	yougame.biz.exe
3256	yougame.biz.exe
1280	yougame.biz.exe
1640	yougame.biz.exe
716	yougame.biz.exe
2036	yougame.biz.exe
2296	yougame.biz.exe
4052	yougame.biz.exe
4864	yougame.biz.exe
1700	yougame.biz.exe
4044	yougame.biz.exe
3924	yougame.biz.exe
1948	yougame.biz.exe
2984	yougame.biz.exe
3556	yougame.biz.exe
1124	yougame.biz.exe
1952	yougame.biz.exe
2052	yougame.biz.exe
2704	yougame.biz.exe
2400	yougame.biz.exe
4140	yougame.biz.exe
4760	yougame.biz.exe
680	yougame.biz.exe
3492	yougame.biz.exe
3732	yougame.biz.exe
4076	yougame.biz.exe
4368	yougame.biz.exe
3716	yougame.biz.exe
4664	yougame.biz.exe
3544	yougame.biz.exe
1868	yougame.biz.exe
4472	yougame.biz.exe
2696	yougame.biz.exe
968	yougame.biz.exe
344	yougame.biz.exe
3996	yougame.biz.exe
1592	yougame.biz.exe
1952	yougame.biz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000\Software\Microsoft\Windows\CurrentVersion\Run\svhost = "C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe"	yougame.biz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4892	powershell.exe
4892	powershell.exe
4572	powershell.exe
4572	powershell.exe
3440	powershell.exe
3440	powershell.exe
2944	powershell.exe
2944	powershell.exe
2660	yougame.biz.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	yougame.biz.exe
Token: SeDebugPrivilege	1504	yougame.biz.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	2276	yougame.biz.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2660	yougame.biz.exe
Token: SeDebugPrivilege	4356	yougame.biz.exe
Token: SeDebugPrivilege	1516	yougame.biz.exe
Token: SeDebugPrivilege	4844	yougame.biz.exe
Token: SeDebugPrivilege	2356	yougame.biz.exe
Token: SeDebugPrivilege	3588	yougame.biz.exe
Token: SeDebugPrivilege	3076	yougame.biz.exe
Token: SeDebugPrivilege	3804	yougame.biz.exe
Token: SeDebugPrivilege	3564	yougame.biz.exe
Token: SeDebugPrivilege	1568	yougame.biz.exe
Token: SeDebugPrivilege	660	yougame.biz.exe
Token: SeDebugPrivilege	916	yougame.biz.exe
Token: SeDebugPrivilege	4868	yougame.biz.exe
Token: SeDebugPrivilege	3292	yougame.biz.exe
Token: SeDebugPrivilege	3772	yougame.biz.exe
Token: SeDebugPrivilege	2748	yougame.biz.exe
Token: SeDebugPrivilege	2968	yougame.biz.exe
Token: SeDebugPrivilege	2144	yougame.biz.exe
Token: SeDebugPrivilege	1952	yougame.biz.exe
Token: SeDebugPrivilege	2052	yougame.biz.exe
Token: SeDebugPrivilege	1096	yougame.biz.exe
Token: SeDebugPrivilege	2000	yougame.biz.exe
Token: SeDebugPrivilege	4360	yougame.biz.exe
Token: SeDebugPrivilege	736	yougame.biz.exe
Token: SeDebugPrivilege	3560	yougame.biz.exe
Token: SeDebugPrivilege	3256	yougame.biz.exe
Token: SeDebugPrivilege	1280	yougame.biz.exe
Token: SeDebugPrivilege	1640	yougame.biz.exe
Token: SeDebugPrivilege	716	yougame.biz.exe
Token: SeDebugPrivilege	2036	yougame.biz.exe
Token: SeDebugPrivilege	2296	yougame.biz.exe
Token: SeDebugPrivilege	4052	yougame.biz.exe
Token: SeDebugPrivilege	4864	yougame.biz.exe
Token: SeDebugPrivilege	1700	yougame.biz.exe
Token: SeDebugPrivilege	4044	yougame.biz.exe
Token: SeDebugPrivilege	3924	yougame.biz.exe
Token: SeDebugPrivilege	1948	yougame.biz.exe
Token: SeDebugPrivilege	2984	yougame.biz.exe
Token: SeDebugPrivilege	3556	yougame.biz.exe
Token: SeDebugPrivilege	1124	yougame.biz.exe
Token: SeDebugPrivilege	1952	yougame.biz.exe
Token: SeDebugPrivilege	2052	yougame.biz.exe
Token: SeDebugPrivilege	2704	yougame.biz.exe
Token: SeDebugPrivilege	2400	yougame.biz.exe
Token: SeDebugPrivilege	4140	yougame.biz.exe
Token: SeDebugPrivilege	4760	yougame.biz.exe
Token: SeDebugPrivilege	680	yougame.biz.exe
Token: SeDebugPrivilege	3492	yougame.biz.exe
Token: SeDebugPrivilege	3732	yougame.biz.exe
Token: SeDebugPrivilege	4076	yougame.biz.exe
Token: SeDebugPrivilege	4368	yougame.biz.exe
Token: SeDebugPrivilege	3716	yougame.biz.exe
Token: SeDebugPrivilege	4664	yougame.biz.exe
Token: SeDebugPrivilege	3544	yougame.biz.exe
Token: SeDebugPrivilege	1868	yougame.biz.exe
Token: SeDebugPrivilege	4472	yougame.biz.exe
Token: SeDebugPrivilege	2696	yougame.biz.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2660	yougame.biz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 440	872	steam.exe	77
PID 872 wrote to memory of 440	872	steam.exe	77
PID 872 wrote to memory of 2660	872	steam.exe	78
PID 872 wrote to memory of 2660	872	steam.exe	78
PID 440 wrote to memory of 4128	440	steam.exe	79
PID 440 wrote to memory of 4128	440	steam.exe	79
PID 440 wrote to memory of 1504	440	steam.exe	80
PID 440 wrote to memory of 1504	440	steam.exe	80
PID 2660 wrote to memory of 4892	2660	yougame.biz.exe	81
PID 2660 wrote to memory of 4892	2660	yougame.biz.exe	81
PID 2660 wrote to memory of 4572	2660	yougame.biz.exe	83
PID 2660 wrote to memory of 4572	2660	yougame.biz.exe	83
PID 2660 wrote to memory of 3440	2660	yougame.biz.exe	85
PID 2660 wrote to memory of 3440	2660	yougame.biz.exe	85
PID 4128 wrote to memory of 4384	4128	steam.exe	87
PID 4128 wrote to memory of 4384	4128	steam.exe	87
PID 2660 wrote to memory of 2944	2660	yougame.biz.exe	88
PID 2660 wrote to memory of 2944	2660	yougame.biz.exe	88
PID 4128 wrote to memory of 2276	4128	steam.exe	89
PID 4128 wrote to memory of 2276	4128	steam.exe	89
PID 4384 wrote to memory of 5088	4384	steam.exe	91
PID 4384 wrote to memory of 5088	4384	steam.exe	91
PID 4384 wrote to memory of 4356	4384	steam.exe	92
PID 4384 wrote to memory of 4356	4384	steam.exe	92
PID 5088 wrote to memory of 3868	5088	steam.exe	93
PID 5088 wrote to memory of 3868	5088	steam.exe	93
PID 5088 wrote to memory of 1516	5088	steam.exe	94
PID 5088 wrote to memory of 1516	5088	steam.exe	94
PID 3868 wrote to memory of 5064	3868	steam.exe	95
PID 3868 wrote to memory of 5064	3868	steam.exe	95
PID 3868 wrote to memory of 4844	3868	steam.exe	96
PID 3868 wrote to memory of 4844	3868	steam.exe	96
PID 5064 wrote to memory of 4628	5064	steam.exe	97
PID 5064 wrote to memory of 4628	5064	steam.exe	97
PID 5064 wrote to memory of 2356	5064	steam.exe	98
PID 5064 wrote to memory of 2356	5064	steam.exe	98
PID 4628 wrote to memory of 1760	4628	steam.exe	99
PID 4628 wrote to memory of 1760	4628	steam.exe	99
PID 4628 wrote to memory of 3588	4628	steam.exe	100
PID 4628 wrote to memory of 3588	4628	steam.exe	100
PID 1760 wrote to memory of 4880	1760	steam.exe	101
PID 1760 wrote to memory of 4880	1760	steam.exe	101
PID 1760 wrote to memory of 3076	1760	steam.exe	102
PID 1760 wrote to memory of 3076	1760	steam.exe	102
PID 4880 wrote to memory of 2872	4880	steam.exe	103
PID 4880 wrote to memory of 2872	4880	steam.exe	103
PID 4880 wrote to memory of 3804	4880	steam.exe	104
PID 4880 wrote to memory of 3804	4880	steam.exe	104
PID 2872 wrote to memory of 1352	2872	steam.exe	105
PID 2872 wrote to memory of 1352	2872	steam.exe	105
PID 2872 wrote to memory of 3564	2872	steam.exe	106
PID 2872 wrote to memory of 3564	2872	steam.exe	106
PID 1352 wrote to memory of 3216	1352	steam.exe	107
PID 1352 wrote to memory of 3216	1352	steam.exe	107
PID 1352 wrote to memory of 1568	1352	steam.exe	108
PID 1352 wrote to memory of 1568	1352	steam.exe	108
PID 3216 wrote to memory of 2776	3216	steam.exe	109
PID 3216 wrote to memory of 2776	3216	steam.exe	109
PID 3216 wrote to memory of 660	3216	steam.exe	110
PID 3216 wrote to memory of 660	3216	steam.exe	110
PID 2776 wrote to memory of 3568	2776	steam.exe	111
PID 2776 wrote to memory of 3568	2776	steam.exe	111
PID 2776 wrote to memory of 916	2776	steam.exe	112
PID 2776 wrote to memory of 916	2776	steam.exe	112

C:\Users\Admin\AppData\Local\Temp\steam.exe
"C:\Users\Admin\AppData\Local\Temp\steam.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Users\Admin\AppData\Local\Temp\steam.exe
  "C:\Users\Admin\AppData\Local\Temp\steam.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Users\Admin\AppData\Local\Temp\steam.exe
    "C:\Users\Admin\AppData\Local\Temp\steam.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\steam.exe
      "C:\Users\Admin\AppData\Local\Temp\steam.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        13⤵
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        15⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        16⤵
        
        PID:2832
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        17⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        18⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        19⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        20⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        21⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        22⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        23⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        24⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        25⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        26⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        27⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        28⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        29⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        30⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        31⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        32⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        33⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        34⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        35⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        36⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        37⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        38⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        39⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        40⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        41⤵
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        42⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        43⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        44⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        45⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        46⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        47⤵
        
        PID:540
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        48⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        49⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        50⤵
        
        PID:384
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        51⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        52⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        53⤵
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        54⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        55⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        56⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        57⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        58⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        59⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        60⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        61⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        62⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        63⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        64⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        65⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        66⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        67⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        68⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\steam.exe
        
        "C:\Users\Admin\AppData\Local\Temp\steam.exe"
        69⤵
        
        PID:2576
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        69⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        68⤵
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        67⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        66⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        65⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        64⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        63⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        62⤵
        Executes dropped EXE
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        61⤵
        Executes dropped EXE
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        60⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        58⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        56⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        54⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        51⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        50⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        48⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        44⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        42⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        40⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        38⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        32⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:660
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
      "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2276
- - C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
    "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe
  "C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'yougame.biz.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\steam.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8cb7f4b4ab204cacd1af6b29c2a2042c

SHA1
244540c38e33eac05826d54282a0bfa60340d6a1

SHA256
4994013dabe4f131d401879278eee147add6349124ea6452358dca7e2344c7a6

SHA512
7651cb6863a425840db610253151e271d3e8da26a8c633ce484247266fa226792ecb84b9578df3ab17fef84a5dfcad417b63a7df59c9650a907e08d59b91dd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
df808b11175970c23f00e611a7b6d2cc

SHA1
0243f099e483fcafb6838c0055982e65634b6db6

SHA256
2d5eec6aeee0c568d08cc1777a67b529dce3133efc761ef4b4643d4b2003d43d

SHA512
c7c4e39be7cb6bfda48055cd2b0b05a6b6a71131a124730f62928600a5870303e06e3db54634c45f86310413126d2524f51002d5f36f7012e41b641992b5ac89

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5r2cm0n1.0f0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\yougame.biz.exe

Filesize
73KB

MD5
ee9a22a50485cfdc04d74d064d31c759

SHA1
7771a94716a3415b12e33a4733e76d7d0db92dac

SHA256
bfd2d7d903cca76b8600df3c3c4f3ebb5e5c04ec9608912373a402c7d0b9333e

SHA512
d8f2acb24b49735b40b14edc4259affd1cfa6201fc6574eaaadf748f33de21713fd0cffc3e15208688c975e31be2bad208d141b4f535ca51c6bf27e9383d4719

Download Submit
memory/440-15-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

Filesize
10.8MB

Download
memory/440-21-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

Filesize
10.8MB

Download
memory/872-16-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

Filesize
10.8MB

Download
memory/872-2-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

Filesize
10.8MB

Download
memory/872-0-0x00007FFD38193000-0x00007FFD38195000-memory.dmp

Filesize
8KB

Download
memory/872-1-0x00000000007F0000-0x0000000000804000-memory.dmp

Filesize
80KB

Download
memory/2660-18-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

Filesize
10.8MB

Download
memory/2660-17-0x0000000000F20000-0x0000000000F38000-memory.dmp

Filesize
96KB

Download
memory/2660-73-0x00007FFD38190000-0x00007FFD38C52000-memory.dmp

Filesize
10.8MB

Download
memory/4892-27-0x000002147CD10000-0x000002147CD32000-memory.dmp

Filesize
136KB

Download