3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

Analysis

max time kernel
163s
max time network
167s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
11-02-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SteamSetup.exe
Size

2.2MB
MD5

70f3bc193dfa56b78f3e6e4f800f701f
SHA1

1e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA256

3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
SHA512

3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1
SSDEEP

49152:2DcHcEngZtNm1LQRHH4PTwZX6kg9hsf4lcszpyu7d/TC:rngZtNm1G4Pw6dJzZNTC

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_r5.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_color_outlined_button_x_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\locales\ru.pak_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\dualshock_4_danish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_l1_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_dpad_down.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\ssa_russian.htm_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\offline_tchinese.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\sounds\deck_ui_volume.wav_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\locales\sk.pak_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\friendsui.dll_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_lt_soft_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_button_view_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_l2_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_friendslist_over.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_button_y.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\GuestPassesDialog.res_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_color_outlined_button_x.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_button_b_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_l_left.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_r_swipe_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_lt_soft_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_color_button_y_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_070_setting_0020.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steam_working1.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_gyro_roll_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_dpad_up_md.png_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\cef_log.txt	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0030.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_color_outlined_button_y_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_mouse_scroll_down_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_dpad_up_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\layout\ingamefpsbanner.layout_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\rebroadcast.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0100.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_360_romanian.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_trackpad_l_touch.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_rt_soft.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_mouse_r_click_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_up_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_touchpad_swipe.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0360.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\Account.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_rstick_right_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_emoticon_hover.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdBottomLeft.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_finnish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_lt_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_r_left_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_button_view_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_r5_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0301.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_mouse_4.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\ssa\ssa_japanese_bigpicture.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\offline_sc_schinese.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_r_left.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\friends_icon.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_button_mute_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_ltrackpad_ring_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_color_outlined_button_b.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_button_home_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\api-ms-win-crt-private-l1-1-0.dll_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_md.png_	steam.exe

Executes dropped EXE 12 IoCs

pid	Process
2768	steamservice.exe
4772	steam.exe
5068	steam.exe
424	steamwebhelper.exe
4140	steamwebhelper.exe
4368	steamwebhelper.exe
840	steamwebhelper.exe
2900	gldriverquery64.exe
5028	gldriverquery.exe
4404	steamwebhelper.exe
2116	vulkandriverquery64.exe
4008	vulkandriverquery.exe

Loads dropped DLL 45 IoCs

pid	Process
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
4140	steamwebhelper.exe
4140	steamwebhelper.exe
4140	steamwebhelper.exe
5068	steam.exe
5068	steam.exe
4368	steamwebhelper.exe
4368	steamwebhelper.exe
4368	steamwebhelper.exe
4368	steamwebhelper.exe
4368	steamwebhelper.exe
4368	steamwebhelper.exe
840	steamwebhelper.exe
840	steamwebhelper.exe
840	steamwebhelper.exe
5068	steam.exe
4404	steamwebhelper.exe
4404	steamwebhelper.exe
4404	steamwebhelper.exe
4404	steamwebhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\	steamwebhelper.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink\Shell	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\	steamwebhelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1968775928-2924269989-3510977013-1000_Classes\steamlink\DefaultIcon	steamservice.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
2344	SteamSetup.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
840	steamwebhelper.exe
840	steamwebhelper.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe
5068	steam.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5068	steam.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2768	steamservice.exe
Token: SeSecurityPrivilege	2768	steamservice.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe
424	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5068	steam.exe
592	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2768	2344	SteamSetup.exe	72
PID 2344 wrote to memory of 2768	2344	SteamSetup.exe	72
PID 2344 wrote to memory of 2768	2344	SteamSetup.exe	72
PID 4772 wrote to memory of 5068	4772	steam.exe	79
PID 4772 wrote to memory of 5068	4772	steam.exe	79
PID 4772 wrote to memory of 5068	4772	steam.exe	79
PID 5068 wrote to memory of 424	5068	steam.exe	80
PID 5068 wrote to memory of 424	5068	steam.exe	80
PID 424 wrote to memory of 4140	424	steamwebhelper.exe	81
PID 424 wrote to memory of 4140	424	steamwebhelper.exe	81
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 4368	424	steamwebhelper.exe	82
PID 424 wrote to memory of 840	424	steamwebhelper.exe	83
PID 424 wrote to memory of 840	424	steamwebhelper.exe	83
PID 5068 wrote to memory of 2900	5068	steam.exe	86
PID 5068 wrote to memory of 2900	5068	steam.exe	86
PID 5068 wrote to memory of 5028	5068	steam.exe	87
PID 5068 wrote to memory of 5028	5068	steam.exe	87
PID 5068 wrote to memory of 5028	5068	steam.exe	87
PID 424 wrote to memory of 4404	424	steamwebhelper.exe	88
PID 424 wrote to memory of 4404	424	steamwebhelper.exe	88
PID 424 wrote to memory of 4404	424	steamwebhelper.exe	88
PID 424 wrote to memory of 4404	424	steamwebhelper.exe	88
PID 424 wrote to memory of 4404	424	steamwebhelper.exe	88
PID 424 wrote to memory of 4404	424	steamwebhelper.exe	88
PID 424 wrote to memory of 4404	424	steamwebhelper.exe	88

C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"
1⤵
- Adds Run key to start application
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Steam\bin\steamservice.exe
  "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2768

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=5068" "-buildid=1705108172" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --enable-media-stream --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--disable-features=SameSiteByDefaultCookies" "--enable-blink-features=ResizeObserver,Worklet,AudioWorklet" "--disable-blink-features=Badging"
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:424
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1705108172 --initial-client-data=0x320,0x324,0x328,0x2fc,0x32c,0x7ffdd62df070,0x7ffdd62df080,0x7ffdd62df090
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4140
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1496,2450813921102341880,4862033679111879394,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=1705108172 --steamid=0 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1504 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4368
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,2450813921102341880,4862033679111879394,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=network --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=1705108172 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1696 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:840
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1496,2450813921102341880,4862033679111879394,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=en-US --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=1705108172 --steamid=0 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2272 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4404
- - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:2900
- - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    PID:5028
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:2116
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    PID:4008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x200
1⤵
PID:2032

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3af4855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.1MB

MD5
b4411620a3551834e4f699cc5a9b27e6

SHA1
5093960cc86613e310d13770b5adef00fe93f3eb

SHA256
3caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04

SHA512
47dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.7MB

MD5
2de3f7cf6020b3bb6bc4199459a63016

SHA1
8a30e5e333a353eb069ab961a4c1918fcbb44623

SHA256
f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e

SHA512
5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e

Download Submit
C:\Program Files (x86)\Steam\bin\audio.dll

Filesize
178KB

MD5
65a946210b9b62d36bbfc0eea49e7925

SHA1
7dbbee4062ef5dc987c53a529486b68da6ef7b54

SHA256
c7f60c6e0e54a57ae5b3da313dbf684ae8d0821c9e30947ab490ab44897a26d1

SHA512
45a3d7740f0256a401107dc871d09d0bc4ec3a89a18809dc3f42669890924be2f77869c99338e706b69dd5e088d27cf58fe3eac041db1c769b55cc9a4e7680c1

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-console-l1-1-0.dll

Filesize
23KB

MD5
5687e338a8b1864c970ee403619207a7

SHA1
8d1fc0db262b16f453aacd6f04e401b43f2e9a7f

SHA256
57b87f09e8b98647d897f865cf2924c661d25d5e833a1c32b9e131055e910635

SHA512
12a3afe2e38450635ba13b5c1f74a8a1daef1ac2dc56fd4c3e75cbd545c6739951c347f87756ee432788fc7e1e748177afd2ffe4821439b84ae52ce3246c8f8e

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-console-l1-2-0.dll

Filesize
23KB

MD5
469fd67e2c9c04d0dc5a7851a6f79407

SHA1
e4556cad36804e4258b5822b87446ce7bc2d4c8c

SHA256
5a64723bf2b20c3b2115c15b3aa1cbc0aa2f83447ea222e7a19e9f988ccc3017

SHA512
458958b64bd9e52ae84628cfc9aa346994270ae75ee8307c33836a145594a278cde5626890576b03f3d5f384c966fed8f27dc07b117fbb43987e6e1544ba5a6e

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-datetime-l1-1-0.dll

Filesize
23KB

MD5
b290ff37e5b7066ebccd32c58ab251ba

SHA1
3d4cd4dfbec4ca7b8a10eac1a26248e4240df602

SHA256
1bb364ffe1f0bceee738da30816918a6f37f6aa70210816bbc2420dbdb006ff8

SHA512
0fb078fba9006f8673e9a69d5a8e6e868c7e593d36a2c4befb81043f35f0d179650f67b1e7988046c214ae163a39021790434ab8fb4ddc1a081a8a702d9f6908

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-debug-l1-1-0.dll

Filesize
23KB

MD5
8a7e67ad6ac149b8f2f91aa1169cb0dc

SHA1
d7d9675b811f4cf80b57d6c71172ca128d0ecb0b

SHA256
8234df20fef3fd0c2891c82c5ff3b54357a9caed98ac63eb9d3d3f52d66516a7

SHA512
840970d68772c4777ad29ff7b9a7869339903f085ef883ff02b0ac2abafd14f65a325b3e6f988c2fcee169e3712512d8718490d5c8f773a66020ed5d066cde8f

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
23KB

MD5
7b2911f10cb4c9339cbfe21b5a533c35

SHA1
032447649731371425bdb1d53b941c67e1288607

SHA256
1794cdf4fb1f7a455a2d19e8474d7e905107e19121c7e777f0e760f232f73b42

SHA512
8123deefc81fc5eb16573e18c9cab938f8fddd645aa7b8b5ac775d6e6b35ea833548b81f1b051464511dfeb8611c06d35ca6973d474e212d2394737629ade6f0

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-fibers-l1-1-0.dll

Filesize
23KB

MD5
c5ea95940f668bdb97a9400897c85169

SHA1
9bd7e47aa4f50205b3e3029125dc4d27d807c292

SHA256
9846d545885bb4f0f315d0fdfc1fa8c38f148bc09be621abd66055b6b3e6842d

SHA512
5fd023863e9102c230130f980fd8cfa761eb97bb75fc13e2b1736946c84ef875023b68e301e7a024218ecf7e01b3c94c1dd946b4a78a723969be5349241c2abe

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l1-1-0.dll

Filesize
27KB

MD5
0af9fe5f79904532caa1b26ed257d2da

SHA1
cb449909e738bf8a3e66d503828e0cb3337f6975

SHA256
e49686170536fb8ff392df5aad983c76ebe46a9d76d1a536855f78b37658571e

SHA512
788f9f29800f0a4c2c8a1b7bd2656cf39964b102ae3332d981545ab13be9d33cf8acf9fa58a0b10b643f48777a1d238bfe280525016b358fecaca8e1086bdc75

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l1-2-0.dll

Filesize
23KB

MD5
788457947fdceacfd6e7905777d989d2

SHA1
6a52a065a6aa905bf6dc8c10c7cebc6e616eb902

SHA256
ddc8356eed890bafe69e435bb63d4aae35a5792192a46ce9489c5da29c37d14f

SHA512
a91f7bd64bb2ffa4dc03921dee43b2d0a5cb69b508df17760cf787f667303e9267d6721670ade4d440a200e2a777963d7ad4377928d6aed1862bc44bea428d1b

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l2-1-0.dll

Filesize
23KB

MD5
21d6f2afc2f534006872b897e5b0a5af

SHA1
0b24bdb543722318550e092a098b57e621b6bae0

SHA256
e0dd6088f58e9661ece1363bfa58e8709383e928e41aebb62a29df52e4bf01a7

SHA512
356b1e8f42d5a184be4c88e83b20580bca6b2cec93c18b3a96117614c8884fdc4fd00e86298a2cb5efcbf9f519e99e7e406cb8444f941e4271a36cc5ee165c2e

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-handle-l1-1-0.dll

Filesize
23KB

MD5
f58a9a0453b933ef66dfdfc8bb1ac8dd

SHA1
fbe88e55f3857496b34565ce8b07eeb95d3cad4d

SHA256
765de83d4c9ff03035e1c615a2e2584bf5f04b548ded431d3a16bd2085c0d35a

SHA512
ad71d9515e11bd050b1ddbe3980ffa74b678d95fb48d57a3070d9a6586e82b246608b177789ee6be6e828813bdd38b07d8fe737195c9166a6a94fc3623ec66cd

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-heap-l1-1-0.dll

Filesize
23KB

MD5
cc56d814acadac29b6acbf43bbf5b0b1

SHA1
867ab3b44a2d1ef170dc4bf2c6d63bf0985f38e6

SHA256
95c8e86bd85e0ccb996982adcf7bec10f534cb422e19c9fb102ee37ff8b5aaf8

SHA512
1052aafc18ee23a66fdb6eb05e3b7121485885241ab5c11f5bd5c4932cf20b6199b5775888e13e7e6219dcc41782d63add30a269504678dd42418a6dfa2039f9

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
23KB

MD5
7c24052cda173924c0bc6a909e9a1ccf

SHA1
d87852afac74fe8dfd129182bc00378792bb555f

SHA256
26d64f4cf2102c87526dac189d02532d34d590129f5845a4b34242885266f6a5

SHA512
46a3c88d1eed9f20ec20c8c1bf885ef216f45388553a332a7f20b947ddfcb08f4b16d733eb6fffb5da9d95fb4dc86bb7221d4ec3feb47e05f55c11fdc7be09b9

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
23KB

MD5
0e0bb13cd88601fd0fb6ccd073d6a325

SHA1
7aa7f74d165be9b079b5577c4f24ce4bca5f0910

SHA256
3cc1e9ea6a9a8ec1f4ad333c68434d40e7d19f4ed67ecc14e6d8227daf2e8a51

SHA512
66bf9f1697b1859ce0d6e1c18a218da461a5d027261c78ed7978b4fff118b8260dafe116ea4367da1e0ffbc115fcc308e228c9c9fc5a3142efba251f9d1934fc

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-localization-l1-2-0.dll

Filesize
23KB

MD5
5898a86b94a00a97dad025bf1add6110

SHA1
67b8d4c91a2823cce50101bc058c74790344821b

SHA256
0e07b171857f69ef53035d3acc52630105b18b858a404e97801a7082dcaa5f1e

SHA512
92d81a091df877db3602328a8075a8734fd3201e898498107fb3c75515c511227e0c2b84e4c03dc65d939876608b61505392c086746f9b8591e30c7817c93758

Download Submit
C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

Filesize
8KB

MD5
eb135ce74e2671883d414e06fc4d5d42

SHA1
53eac131693f8a719af9e2251448a15088254522

SHA256
2559b06caf774b497902c4af0538669269ebae3309c183311c818d25c7c5e6d3

SHA512
aec58a4f30f3a8dde89e4b1d5be87b807245fc1ec0a0e8c0a51c3a0e3bd5ff26466769833c009524a2423a99a0047f14a3d39a200b115ed3f25898d16d8fb4ef

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_metrics.bin

Filesize
3KB

MD5
1113464b94931975c7c900ff3043ff4e

SHA1
357bc95b6519b5897a61d9d0b04a2861cb21c0fb

SHA256
4affe254c6d05a63a45ec525866492d5f8e07c933fc9d3c3936dde87319eb490

SHA512
2ea296e08ee3699e20a8da577e49587a857357ce0f5e0ceb3368bbf5da282842a6a4e50867a3638b0a4ace1721711d3b6f9953276e82bfdc44baa31fa5030f02

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.installed

Filesize
460KB

MD5
a220260ebd5dab04760d23244a4e2d88

SHA1
3312bea740876704ab9a477701da9aa7630fd90a

SHA256
2a1a5310dc9881ca2f59892f1f27fafe5f2def281a209a33042cbebae79f8a38

SHA512
c34be9cd17ce444675c08b2b20b7b24900506240d53ecfc0357df7dbb1e12164b71f1d29aa9c98fb170a818a37d2f34403c9cca1d28ee6dc9a30c0578cef7d4a

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.manifest

Filesize
9KB

MD5
3f03cae38ef6847eccf56c954b1ae3eb

SHA1
04b0f891fd471e19d17a6ac3b93c8dc7419a6baa

SHA256
6778287775f2a7c8b9d5c505e53201a7e518000df65ffb45ce2d93ff99c8ed4c

SHA512
ab895e7a2a05272afba514e66a6030fc65391c11ac472f313aa18eb982a29f7a179c70f9834658171375848fafc72306d6051964922705d621f72a1c27b65c4f

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
8ebd46495dd3b4ab05431c5c771d5657

SHA1
e426214322a729faddb5bc80053af5750c76683b

SHA256
70c39d5d5b16640165de19cee80da4a391035108cbc5f5009372a86954f0fe92

SHA512
53afd923f583eda4db580935a8cdd62413af8e830c04f2c12d15c55e905c114ec11a5e4483660601504c27e9350e9e47c6432f8f699464e11c5050fe846d7dc4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
239c03a3dc1c27993da724736d086cef

SHA1
ff88246f8ea3502873dcbdc622378f006c58a2e6

SHA256
b387e2fb971297d3438acca130c53dfdd202ae2ca5b52d6503333734cda4fbfc

SHA512
656922e8f2dec46ef36efba5c85088c47b02e89f62b27559611fcbe6ef85c6cd8462a4532e2d2d7f4faa977ab24f0de6f5f72e3075f8889db9e6e60baa162a32

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
6def4d3cf1453d5fb69d22fca29892a4

SHA1
09fe62653e55668de75a9fc5b64949ea81eb4991

SHA256
60c29f3c57c44c58daf69be797bfede31967b1ddfc9bb68cb7ddaa0acda67c8c

SHA512
ee4f3f5dd8a8aadde9cff8f8aca8a45fa419c36fd8a4a7d3af9b71e1f7e5d9e1d01c329c70e6da53238822b536e35224e55004bf2e1af4ec17d5b56ccfc58549

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
2fe6613e267857982d7df4368c9827ec

SHA1
d520c7427b283e3ff167b850ab15352e46d328d3

SHA256
2eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0

SHA512
cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
594be5b10d9f551e551cf20eae0e6dfc

SHA1
191c20f5cb0c27ecc5a055fa2379694f5e27a610

SHA256
e350ca62e777da4da6d25885be96d48e7ce3acf021a74f2a4902354a1bf03fbb

SHA512
e27bf6593a177c22e16ddf5a44d82b34b02063645a7fd63943b936028d9c433c89628038768a300c296c2d3bcab2ef6b8532a19f7283952d041865c704f62b0b

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
da69785dfbf494002f108dd73020183d

SHA1
34bb6061cdf120e7dced0402e588c3f712cf2dc0

SHA256
8cce22e7f13486f2bc612dcc8fa31d81038e6084a350fa10299d40c3a7f878c8

SHA512
db773783b63ed1d66a59272e05304c174b69f85d2838ae8049dffed6b6b30c2011fd9042dd652f9a1733a2b6891870b426cf1985d41921e5360c9b1ae1330e20

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
395286db3e67a59868e2662c326c541a

SHA1
716014d76622612a1bde2d4e1744d024f6d0b830

SHA256
02e48ee4e10354a2b2741d2e57ef565404753779f847906b5ae5c98ede06c01b

SHA512
64cdf1e6701ea57474051e338eee74859fc0ff4acd71ee0718a9b8cd698e94a9793c1901b6791fc0fc268c53fbc1e7e2f94ac1024f3f8765bf713954c194b0fe

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
b9e30df8cf272813b121133fcf259752

SHA1
16706f982f16d5feb9c808f94b8cfa50c23f5d80

SHA256
88919d7be26fb3e06401fc0254733d92fd743ecc56da4177b41613e1f094c3e8

SHA512
7beb65c0477b02742741a8ce23557f4f15e8cf1b1ef03a6bbadbf594bdf2cd686d7356d93719111d27b309a10ca75846765a13bb3eb4d0411785dfb13a675fc4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
d75580775d67a85353189736222a8878

SHA1
ccb2275c8f5d119640064fd533ca15f30d93f331

SHA256
10720923c1048502c5191d6d1d8580e35e707b24d457941dae94a87371af989a

SHA512
757dd94a1e3debb2520855a3d00e44e3a98b5764caf9c16c8d088fc1a1f1024eed742f1051635721f4bf2c00d1dac11fd975c09a7f5df78d1863de88f9bbf9fe

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
5462f47e56b978659ef56f196db013f4

SHA1
4749824d4e909369f59217d4980963ff17353f3f

SHA256
cbfbe91d4a4661df814ea447c03f4ca872ef3e27073a1eb746faccbfe75afc8a

SHA512
5a437968fc06619cf553ced32dba9c7c948f4364f02c8017986e9a4f09e9832b849c7e0567485ca1beba34a258d29b2612ea3ed6045c81777e9a5201139f81a3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
4KB

MD5
31bd3d4d8de5af4642b21d586d5ee54d

SHA1
552bebb93c71cd8acd72558db1810530909fb276

SHA256
52f256ded29ce22945b5bc0ef7a227189dfa91da69265ec13283a7067c239071

SHA512
cea49fc70b18a1294ec7e564ff7f4d1ff7efeb0db1cf1b088da6adcecc282569380f225e9a150d1666c5c1977ba4de0a5d9d667c72cfb8569a50546b978e9132

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
6KB

MD5
e04ad6c236b6c61fc53e2cb57ced87e8

SHA1
e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

SHA256
08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

SHA512
0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
4KB

MD5
56dcf7b68f70826262a6ffaffe6b1c49

SHA1
12e4272ba0e4eabc610670cdc6941f942da1eb6a

SHA256
948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

SHA512
c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
4KB

MD5
e9b8fccdb78bf9d275b79c75b2ff3e7b

SHA1
4b549411ed4db0f0a3699e76531353c226b06a76

SHA256
41ecfe0ffd6043a66a41bf9ea032712f2d1bbc19b434c6c666a107ee379f21e4

SHA512
4ce905a31f3a410712722271abd7e0a9a6c43646b61a321912b4a8e8f6fab68ab69add1d701c501bb069b8ecb65ecaf3bfa9be983933d0234a8c81c24bc6601f

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
4KB

MD5
b2248784049e1af0c690be2af13a4ef3

SHA1
aec7461fa46b7f6d00ff308aa9d19c39b934c595

SHA256
4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

SHA512
f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
4KB

MD5
5c7bc92e0d948e3bba3f26f64a22fe7e

SHA1
bd259397a312bee9b8262058c30e0e354eeea93a

SHA256
5e6b0978fe8e2d14905f46e089b06681d6dfe76dd0c1551c168171ac4de75969

SHA512
8a6e18ce3d38a9658172b1871255a9941c572114137e468f130956c73ff13f282a46074a1dda6404dbdbf317ecdaadf01324194b8f8c081f862037784f4946ba

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
7KB

MD5
1a537a1d30fba1d3db449a9207b63835

SHA1
ab6903b4c8d6bd3571960b1218714b8d76b1880d

SHA256
49b6b664d50a1ae0c732bcfbbdd1db1812ddccf00bcf5f40200f0e7cff5542ee

SHA512
1215b0d017a6e3ea207edafe8edd500a91a7a971b2f989d8006fa65e475ae32ec00df3e8ec06b4077f64f5b789c536bfb9d8b9945ca0e0731d68e48876bd8459

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
4KB

MD5
29f9a5ab4adfae371bf980b82de2cb57

SHA1
6f7ef52a09b99868dd7230f513630ffe473eddf8

SHA256
711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

SHA512
543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Filesize
6KB

MD5
cadd7a2f359b22580bdd6281ea23744d

SHA1
e82e790a7561d0908aee8e3b1af97823e147f88b

SHA256
3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

SHA512
53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

Filesize
4KB

MD5
f8a86b74ce3b446e3111d1480b5feaf7

SHA1
af21c55fd6ac99e65db55af9b8f4ffe790c4382c

SHA256
8a049b6126e904dcb9ba5d8af21cc0ab25ca55221cf2cd48eea45504fe23083b

SHA512
70f8009f5940b10b77a6c152c8c73f3dd425fb9ac917014504e8116ef00032888de686271e0262cbe7a55c6e605e837dcfbeb54ece71e49646b1030195fa0845

Download Submit
C:\Program Files (x86)\Steam\steam.exe

Filesize
4.2MB

MD5
802c808569259798e06dcfd4a5e283ae

SHA1
7f8a3c552736f5a6d9eaf9b8d7c36853a80e1dc6

SHA256
617c39e8e5ea59aed52a614cfc71fbe619c2d270e225c303f4a2d70b07d495c3

SHA512
4e606e628da23259a3b5fc24c7519d9510c0a2df934cb6561a90642a593456d5aaa4a01c4a76767ce6625196b1b4c9222522ecaf25eb3b10da4f11dc28e5102c

Download Submit
C:\Program Files (x86)\Steam\steam.exe

Filesize
1.4MB

MD5
bee196de067d970bfc5f0993b6b6572c

SHA1
168c6aa105e5b44c84e0d8674893917621ad581d

SHA256
00124932f1faee7268c453a9cc75b54072bdcc9ef6826171cd1a84083a0e4ee6

SHA512
5347bf1039aa3787ea305190daa60fa025965e71c0bbb28c0e94b67ab3dab95367ea7fa43f529232be5dfa7541dcf687b9c82a5975baf52467068f09d8a18f32

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\data_1

Filesize
264KB

MD5
9cda72035e77a634b1d6750654d37c3e

SHA1
cac49c27270da8187313b020748462fe766fd1f3

SHA256
1275ac4e489ff6d97f98632e56c8bb004617e6fb2ab43795e07b3aa3e73c3255

SHA512
ffc7bcd9181deecb1a9aeeea5bdd92fe04f562648ee6290342b84e7dd0642e1c3bb2aa33b46acaebc9e152f332b543988289265cd089b8f4be7c4317f206b549

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
8c9c6fc16ddc271d5b3e3fb5a4a3ee22

SHA1
4832b216832d642fa7ffbfe15b08f180e87ea419

SHA256
5de66d7cd906345a4ee025b0027f545912d0ead7c34650dfe7175fb471317ded

SHA512
46022033303ea0c9ede6027ead3735eda313279f775f2735f8256cb3113857da9b84b10059d9f5ae1e99a081dbbe83fb536cf55e54f11d896598939393ea2079

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
160415e04c44d6c1b727f552d2bb194f

SHA1
b884695246c7a99d6637331615b8c38404172c74

SHA256
0b81898bbe239ccaf34801e6a45dcdc8ae861b5ffe6cf3c4d149017b96aa4319

SHA512
2d8f4dd5f17058864818086c3f6bee406476dce5189ff9d5758ccef0510c5dd0d2a80fc6708926f714848bb0e942b288d6d2cc34b0d09b2339c0fdc12b14ec16

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network Persistent State~RFe59e891.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssA56A.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
\Program Files (x86)\Steam\crashhandler.dll

Filesize
367KB

MD5
141f3c56237020ac0745d57ffb0ac2cd

SHA1
6db84c6092ea3ef15a1f2191f5404b3160da3403

SHA256
4e8aaf591c17c25f0b92b9fd460659db5e5d72d76b02d9663a7a72b7c7ed6305

SHA512
0a0851858c39428cf1cd51ba5228674bbe4bddb34859c6c871357844b28d143552ed0158b79e7be7e4e8a9a3a89372838512ef12e03947bb151fe89c916e9345

Download Submit
\Users\Admin\AppData\Local\Temp\nssA56A.tmp\StdUtils.dll

Filesize
99KB

MD5
98a4efba4e4b566dc3d93d2d9bfcab58

SHA1
8c54ae9fcec30b2beea8b6af4ead0a76d634a536

SHA256
e2ad7736209d62909a356248fce8e554093339b18ef3e6a989a3c278f177ad48

SHA512
2dbc9a71e666ebf782607d3ca108fd47aa6bce1d0ac2a19183cc5187dd342307b64cb88906369784518922a54ac20f408d5a58f77c0ed410e2ccf98e4e9e39a0

Download Submit
\Users\Admin\AppData\Local\Temp\nssA56A.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
\Users\Admin\AppData\Local\Temp\nssA56A.tmp\nsDialogs.dll

Filesize
9KB

MD5
0d45588070cf728359055f776af16ec4

SHA1
c4375ceb2883dee74632e81addbfa4e8b0c6d84a

SHA256
067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

SHA512
751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

Download Submit
\Users\Admin\AppData\Local\Temp\nssA56A.tmp\nsExec.dll

Filesize
6KB

MD5
c5b9fe538654a5a259cf64c2455c5426

SHA1
db45505fa041af025de53a0580758f3694b9444a

SHA256
7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7

SHA512
f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa

Download Submit
\Users\Admin\AppData\Local\Temp\nssA56A.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
memory/4368-12139-0x00007FFDE1EE0000-0x00007FFDE1EE1000-memory.dmp

Filesize
4KB

Download
memory/4404-12155-0x00007FFDE2290000-0x00007FFDE2291000-memory.dmp

Filesize
4KB

Download
memory/4404-12229-0x000001CB2BDA0000-0x000001CB2BEC5000-memory.dmp

Filesize
1.1MB

Download
memory/4404-12212-0x000001CB2BDA0000-0x000001CB2BEC5000-memory.dmp

Filesize
1.1MB

Download
memory/4404-12213-0x000001CB2BED0000-0x000001CB2BF8F000-memory.dmp

Filesize
764KB

Download
memory/4404-12156-0x00007FFDDFF90000-0x00007FFDDFF91000-memory.dmp

Filesize
4KB

Download
memory/4404-12239-0x000001CB2BDA0000-0x000001CB2BEC5000-memory.dmp

Filesize
1.1MB

Download
memory/4772-12111-0x0000000000DC0000-0x0000000001236000-memory.dmp

Filesize
4.5MB

Download
memory/5068-12241-0x000000006F450000-0x0000000070747000-memory.dmp

Filesize
19.0MB

Download
memory/5068-12228-0x000000006F450000-0x0000000070747000-memory.dmp

Filesize
19.0MB

Download
memory/5068-12237-0x000000006F450000-0x0000000070747000-memory.dmp

Filesize
19.0MB

Download
memory/5068-12216-0x000000006F450000-0x0000000070747000-memory.dmp

Filesize
19.0MB

Download
memory/5068-12234-0x000000006F450000-0x0000000070747000-memory.dmp

Filesize
19.0MB

Download
memory/5068-12231-0x000000006F450000-0x0000000070747000-memory.dmp

Filesize
19.0MB

Download
memory/5068-12207-0x000000006F450000-0x0000000070747000-memory.dmp

Filesize
19.0MB

Download