nanocore | 21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

Analysis

max time kernel
151s
max time network
172s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 14:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe
Size

1.2MB
MD5

677f95c0008638e651565531ae57bf20
SHA1

c228408d6fc7abb69aead81461ec5c42a8fbf94a
SHA256

21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9
SHA512

46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e
SSDEEP

24576:9jvKABunTHw1zJisz4xtYuabqStzDTStrZwEctK//:9jvP8nMrisz4cuutPu1iEv

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

steamserver285.ddns.net:1337

127.0.0.1:1337

Mutex

291335a3-aac7-44d7-98ce-d2e9e600616d

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2015-06-04T14:46:47.365938736Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
1337
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
291335a3-aac7-44d7-98ce-d2e9e600616d
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
steamserver285.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Executes dropped EXE 6 IoCs

Processes:

Steam.exeSteam.exeSteam.exeSteam.exeSteam.exeSteam.exe

pid process

1532 Steam.exe
628 Steam.exe
844 Steam.exe
1400 Steam.exe
1616 Steam.exe
1844 Steam.exe

Drops startup file 1 IoCs

Processes:

21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk	21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe

Loads dropped DLL 2 IoCs

Processes:

21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe

pid	process
860	21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe
860	21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Steam.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe"	Steam.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Steam.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Steam.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Steam.exe

Suspicious use of SetThreadContext 12 IoCs

Processes:

Steam.exe

description	pid	process	target process
PID 1532 set thread context of 628	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 628	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 628	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 844	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 844	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 844	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 1616	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 1616	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 1616	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 1844	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 1844	1532	Steam.exe	Steam.exe
PID 1532 set thread context of 1844	1532	Steam.exe	Steam.exe

Drops file in Program Files directory 2 IoCs

Processes:

Steam.exe

description	ioc	process
File created	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	Steam.exe
File opened for modification	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	Steam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1832 schtasks.exe
928 schtasks.exe

pid	process
1832	schtasks.exe
928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

Steam.exeSteam.exe

pid	process
1532	Steam.exe
1532	Steam.exe
1532	Steam.exe
1532	Steam.exe
1532	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe
1844	Steam.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Steam.exe

pid process

1844 Steam.exe

pid	process
1844	Steam.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exeSteam.exeSteam.exe

description	pid	process
Token: SeDebugPrivilege	860	21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe
Token: SeDebugPrivilege	1532	Steam.exe
Token: SeDebugPrivilege	1844	Steam.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exeSteam.exeSteam.exe

description	pid	process	target process
PID 860 wrote to memory of 1532	860	21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe	Steam.exe
PID 860 wrote to memory of 1532	860	21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe	Steam.exe
PID 860 wrote to memory of 1532	860	21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe	Steam.exe
PID 860 wrote to memory of 1532	860	21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe	Steam.exe
PID 1532 wrote to memory of 628	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 628	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 628	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 628	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 628	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 628	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 628	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 628	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1400	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1400	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1400	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1400	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1400	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1616	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1616	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1616	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1616	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1616	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1616	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1616	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1616	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1844	1532	Steam.exe	Steam.exe
PID 1532 wrote to memory of 1844	1532	Steam.exe	Steam.exe
PID 1844 wrote to memory of 1832	1844	Steam.exe	schtasks.exe
PID 1844 wrote to memory of 1832	1844	Steam.exe	schtasks.exe
PID 1844 wrote to memory of 1832	1844	Steam.exe	schtasks.exe
PID 1844 wrote to memory of 1832	1844	Steam.exe	schtasks.exe
PID 1844 wrote to memory of 928	1844	Steam.exe	schtasks.exe
PID 1844 wrote to memory of 928	1844	Steam.exe	schtasks.exe
PID 1844 wrote to memory of 928	1844	Steam.exe	schtasks.exe
PID 1844 wrote to memory of 928	1844	Steam.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe
"C:\Users\Admin\AppData\Local\Temp\21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
"C:\Users\Admin\AppData\Roaming\Steam\Steam.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532

C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
3⤵
- Executes dropped EXE
PID:628

C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
3⤵
- Executes dropped EXE
PID:844

C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
3⤵
- Executes dropped EXE
PID:1400

C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
3⤵
- Executes dropped EXE
PID:1616

C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp2B46.tmp"
4⤵
- Creates scheduled task(s)
PID:1832

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp3333.tmp"
4⤵
- Creates scheduled task(s)
PID:928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
7cb2af69a83f9daf5dd2ccc97d6d2c80

SHA1
94d90c9ce5c218eb9e641a65b14df62742a72608

SHA256
871e5a4d1370fc2cd0b0657c49941a37b53531e379af4a52222ca6e428776ed3

SHA512
7a816be1e793b98fe1c168b262ef9cc1b6fa852777ef0ff22eb030078eef93372a1a58e38dadac29edbe6748e53e094048141dd261a5463e827ad9349b7bd619

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2B46.tmp
Filesize
1KB

MD5
63ad7f1946186db1a507e0473d104d76

SHA1
d01fb868dc8b3b218300036cc0acb6334e6b863b

SHA256
4055777ede1c6cd93ee2d281024e2ad740e4cd961ccd758f30a524537a519df7

SHA512
c6c121817cb06ca68da939c3128da8385c46e51728a9cd81ed8e91e084896312238749e49accb52e4d7a55d6ec1c54600b95f94370331ae35faa69b388fbec6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3333.tmp
Filesize
1KB

MD5
981e126601526eaa5b0ad45c496c4465

SHA1
d610d6a21a8420cc73fcd3e54ddae75a5897b28b

SHA256
11ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527

SHA512
a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk
Filesize
917B

MD5
4017b746559eac0a6741df5b3ab89f4f

SHA1
5ca1687aa2a5c1ba34f2f32c1b6203dc98a6805a

SHA256
3788cda30fda6309db91ea46459e37d98b7d2005641a0f7621bb0aed1df9ef66

SHA512
1ad2b213d984d422ad43e209cbc45de64bd93ec05509d6675a26779792dcb0aaadce50041d21a2259de453d697db74bfbf3cfb06dee58b4670412de89c6b87cf

Download Submit
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
C:\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
\Users\Admin\AppData\Roaming\Steam\Steam.exe
Filesize
1.2MB

MD5
677f95c0008638e651565531ae57bf20

SHA1
c228408d6fc7abb69aead81461ec5c42a8fbf94a

SHA256
21d9c4b4afce65e888e3332312f157078b7e2edcf50ca65be1d9e198d919bec9

SHA512
46a532cefcbaaa10d78b22ba2233070e488b806a575e613921db7a300876be87f93a71850ab284c3187528f7b25461e77566fbeea476722fc1d2e2fb1300891e

Download Submit
memory/628-67-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/628-71-0x000000000041E792-mapping.dmp

Download
memory/628-74-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/628-75-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/844-81-0x000000000041E792-mapping.dmp

Download
memory/860-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/860-63-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/860-56-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/860-55-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/928-120-0x0000000000000000-mapping.dmp

Download
memory/1532-59-0x0000000000000000-mapping.dmp

Download
memory/1532-64-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1532-122-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1616-92-0x000000000041E792-mapping.dmp

Download
memory/1832-118-0x0000000000000000-mapping.dmp

Download
memory/1844-102-0x000000000041E792-mapping.dmp

Download
memory/1844-116-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download
memory/1844-123-0x0000000073F70000-0x000000007451B000-memory.dmp

Filesize
5.7MB

Download