xworm | b86413527bbc9f5ba6240402aba7cd6d0413bc9ee7db1f02ec18426f18c60044

Analysis

max time kernel
260s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DAVIDxPANEL.exe
Size

351KB
MD5

bdf4babc0504339255ab25c4550e373a
SHA1

08f6c30ea97cff716acce362c8c3b2629ec7d08c
SHA256

b86413527bbc9f5ba6240402aba7cd6d0413bc9ee7db1f02ec18426f18c60044
SHA512

97c058c8873b2146c91a3f3a21b653e70b001277203222f5ead6f142134b66e2be4a79ee87c9adf57b2fad56e2c354ece62115d36dd0e7f3e17cf459751c4178
SSDEEP

6144:jNHtr2hylad/y/MOsuplJ/y//////E////z4///////K//////onnnnnnnnnnq+1:jZtXlad/6mulJ/y//////E////z4///Z

Score

10^/10

xworm defense_evasion discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

rates-sir.gl.at.ply.gg:9099

Attributes

Install_directory
%AppData%
install_file
Steam.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023b7d-4.dat	family_xworm
behavioral1/memory/2324-12-0x0000000000320000-0x000000000037C000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2524	powershell.exe
2032	powershell.exe
5024	powershell.exe
3988	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	DAVIDxPANEL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Steam.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk	Steam.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk	Steam.exe

Executes dropped EXE 6 IoCs

pid	Process
2324	Steam.exe
2276	Steam.exe
3084	Steam.exe
3032	Steam.exe
1748	Steam.exe
3164	Steam.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\Steam.exe"	Steam.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DAVIDxPANEL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2836	powershell.exe
2836	powershell.exe
2524	powershell.exe
2524	powershell.exe
2032	powershell.exe
2032	powershell.exe
5024	powershell.exe
5024	powershell.exe
3988	powershell.exe
3988	powershell.exe
2324	Steam.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2324	Steam.exe
2324	Steam.exe
2324	Steam.exe
2324	Steam.exe
2324	Steam.exe
2324	Steam.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	Steam.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2032	powershell.exe
Token: SeDebugPrivilege	5024	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe
Token: SeDebugPrivilege	2324	Steam.exe
Token: SeDebugPrivilege	2772	taskmgr.exe
Token: SeSystemProfilePrivilege	2772	taskmgr.exe
Token: SeCreateGlobalPrivilege	2772	taskmgr.exe
Token: SeDebugPrivilege	2276	Steam.exe
Token: 33	2772	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2772	taskmgr.exe
Token: SeDebugPrivilege	3084	Steam.exe
Token: SeDebugPrivilege	3032	Steam.exe
Token: SeDebugPrivilege	1748	Steam.exe
Token: SeDebugPrivilege	3164	Steam.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe
2772	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2324	Steam.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2836	3024	DAVIDxPANEL.exe	83
PID 3024 wrote to memory of 2836	3024	DAVIDxPANEL.exe	83
PID 3024 wrote to memory of 2836	3024	DAVIDxPANEL.exe	83
PID 3024 wrote to memory of 2324	3024	DAVIDxPANEL.exe	85
PID 3024 wrote to memory of 2324	3024	DAVIDxPANEL.exe	85
PID 2324 wrote to memory of 2524	2324	Steam.exe	87
PID 2324 wrote to memory of 2524	2324	Steam.exe	87
PID 2324 wrote to memory of 2032	2324	Steam.exe	89
PID 2324 wrote to memory of 2032	2324	Steam.exe	89
PID 2324 wrote to memory of 5024	2324	Steam.exe	91
PID 2324 wrote to memory of 5024	2324	Steam.exe	91
PID 2324 wrote to memory of 3988	2324	Steam.exe	93
PID 2324 wrote to memory of 3988	2324	Steam.exe	93
PID 2324 wrote to memory of 3472	2324	Steam.exe	95
PID 2324 wrote to memory of 3472	2324	Steam.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\DAVIDxPANEL.exe
"C:\Users\Admin\AppData\Local\Temp\DAVIDxPANEL.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAbABwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHYAegBtACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAbgBtACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHoAbgBnACMAPgA="
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2836
- C:\Users\Admin\AppData\Roaming\Steam.exe
  "C:\Users\Admin\AppData\Roaming\Steam.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Steam.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Steam.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Steam.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Steam.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Steam" /tr "C:\Users\Admin\AppData\Roaming\Steam.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3472

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2772

C:\Users\Admin\AppData\Roaming\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Users\Admin\AppData\Roaming\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3084

C:\Users\Admin\AppData\Roaming\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Users\Admin\AppData\Roaming\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Users\Admin\AppData\Roaming\Steam.exe
C:\Users\Admin\AppData\Roaming\Steam.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Steam.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
0718c5b12ef265f0ef07b4833741ebba

SHA1
b25dcf0fdbac2960eb15e13aa759afe69ccfbfd7

SHA256
d3bf93bea6ecbffdc0a57430189372999a280e384649ab7a15769737fb25f159

SHA512
a7211f94b0fa396c57cc6f6716c2875fc859f5df33720416c548b22ff9f73480f2b5859863efc2fcd189277394892fc5a2e4083c32ebe9deece4c549e36e5f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
340b40d863485995ea7eaab9c386dc21

SHA1
47c7de08001050abece764110b8cc028e3c9cb8f

SHA256
5087735f420e1649e208017b143c45d25893b36fe32fd4fa7c97cebf5fe87f19

SHA512
1d007bfeca3aee0312cc64db448746db3153b4a7d77997d3d63b0bc7efe646dc6ebc1ba5fc1a0f62f48c18cdb07d8c0343d1433c13f7ecd62dc281d018d45eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_in1qbd4o.ix2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk

Filesize
759B

MD5
e13c7ecbfcfa003cf41bf944f2a5933b

SHA1
c2d13fdf75f6f83e88f511411f95326cb2680431

SHA256
b872dfa81b47f7c8635cf6de6e6a4525d66968741e236b5e4f939bc7b78d9b80

SHA512
70d8f0aec21ead8deedd75361a7210adfd07418fa0f707ba23470675069280ee37d4284014a7878cc77bd179b98cf8ce599267d6b72adc50a03caa3cbc3ee4b0

Download Submit
C:\Users\Admin\AppData\Roaming\Steam.exe

Filesize
345KB

MD5
c8764c93e9cabbfaaa906f24e7b28cc1

SHA1
85b7f5c6e024d3f200abbaeca6d0db8b4dd276a2

SHA256
4e62e196ae6de4b1044188055a007c3f78eb878e791f9ede759e2c118a508948

SHA512
cce91c62fbcf54e04e1945511f9e84c6df3412ec4592f525e93db774e4106930930eb12c83e24d6c4d8c37a317c4ac4e276e18599d3a7a456e76d2fc127e9070

Download Submit
memory/2324-61-0x0000000002300000-0x0000000002310000-memory.dmp

Filesize
64KB

Download
memory/2324-123-0x0000000002300000-0x0000000002310000-memory.dmp

Filesize
64KB

Download
memory/2324-127-0x00000000022F0000-0x00000000022FC000-memory.dmp

Filesize
48KB

Download
memory/2324-132-0x000000001D210000-0x000000001D21A000-memory.dmp

Filesize
40KB

Download
memory/2324-11-0x00007FFF48353000-0x00007FFF48355000-memory.dmp

Filesize
8KB

Download
memory/2324-12-0x0000000000320000-0x000000000037C000-memory.dmp

Filesize
368KB

Download
memory/2524-62-0x000001F3B5B60000-0x000001F3B5B82000-memory.dmp

Filesize
136KB

Download
memory/2772-120-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-112-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-111-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-110-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-116-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-122-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-121-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-119-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-118-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2772-117-0x0000015F7EA90000-0x0000015F7EA91000-memory.dmp

Filesize
4KB

Download
memory/2836-31-0x0000000005E40000-0x0000000005E5E000-memory.dmp

Filesize
120KB

Download
memory/2836-34-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/2836-55-0x00000000073A0000-0x00000000073B4000-memory.dmp

Filesize
80KB

Download
memory/2836-56-0x0000000007480000-0x000000000749A000-memory.dmp

Filesize
104KB

Download
memory/2836-57-0x00000000073D0000-0x00000000073D8000-memory.dmp

Filesize
32KB

Download
memory/2836-60-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/2836-53-0x0000000007350000-0x0000000007361000-memory.dmp

Filesize
68KB

Download
memory/2836-52-0x00000000073E0000-0x0000000007476000-memory.dmp

Filesize
600KB

Download
memory/2836-51-0x00000000071C0000-0x00000000071CA000-memory.dmp

Filesize
40KB

Download
memory/2836-49-0x0000000007790000-0x0000000007E0A000-memory.dmp

Filesize
6.5MB

Download
memory/2836-50-0x0000000007150000-0x000000000716A000-memory.dmp

Filesize
104KB

Download
memory/2836-48-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/2836-35-0x0000000074520000-0x000000007456C000-memory.dmp

Filesize
304KB

Download
memory/2836-54-0x0000000007390000-0x000000000739E000-memory.dmp

Filesize
56KB

Download
memory/2836-46-0x0000000007020000-0x00000000070C3000-memory.dmp

Filesize
652KB

Download
memory/2836-47-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/2836-45-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/2836-33-0x0000000006FE0000-0x0000000007012000-memory.dmp

Filesize
200KB

Download
memory/2836-32-0x0000000005E60000-0x0000000005EAC000-memory.dmp

Filesize
304KB

Download
memory/2836-30-0x0000000005930000-0x0000000005C84000-memory.dmp

Filesize
3.3MB

Download
memory/2836-18-0x0000000004E80000-0x0000000004EA2000-memory.dmp

Filesize
136KB

Download
memory/2836-20-0x00000000057C0000-0x0000000005826000-memory.dmp

Filesize
408KB

Download
memory/2836-19-0x0000000005750000-0x00000000057B6000-memory.dmp

Filesize
408KB

Download
memory/2836-17-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/2836-15-0x00000000748B0000-0x0000000075060000-memory.dmp

Filesize
7.7MB

Download
memory/2836-16-0x0000000004F70000-0x0000000005598000-memory.dmp

Filesize
6.2MB

Download
memory/2836-14-0x0000000004850000-0x0000000004886000-memory.dmp

Filesize
216KB

Download
memory/2836-13-0x00000000748BE000-0x00000000748BF000-memory.dmp

Filesize
4KB

Download