Overview

overview

10

Static

static

3

d57b96e0fd...bd.exe

windows7-x64

10

d57b96e0fd...bd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 14:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe
  • Size 5.4MB
  • Sample240625-sbd9qswfph
  • SHA256 d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Signatures

  • Detect PurpleFox Rootkit 11 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 12 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 47 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe
    "C:\Users\Admin\AppData\Local\Temp\d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\\svchost.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:428
    • C:\Users\Admin\AppData\Local\Temp\svchos.exe
      C:\Users\Admin\AppData\Local\Temp\\svchos.exe
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      PID:5028
    • C:\Users\Admin\AppData\Local\Temp\HD_d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe
      C:\Users\Admin\AppData\Local\Temp\HD_d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:4984
      • C:\Users\Admin\AppData\Local\Temp\HD_d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe
        C:\Users\Admin\AppData\Local\Temp\HD_d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:11516
        • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
          C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=11516" "-buildid=1718904662" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-userdatadir=C:\Users\Admin\AppData\Local\Steam\cefdata" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\HD_d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:11768
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
            C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1718904662 --initial-client-data=0x364,0x368,0x36c,0x340,0x374,0x7fffe5deee38,0x7fffe5deee48,0x7fffe5deee58
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:11812
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1718904662 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1604 --field-trial-handle=1720,i,4628072361736736598,15554353160209973520,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:11948
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1718904662 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2076 --field-trial-handle=1720,i,4628072361736736598,15554353160209973520,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:12020
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1718904662 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2476 --field-trial-handle=1720,i,4628072361736736598,15554353160209973520,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:12472
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1718904662 --steamid=0 --first-renderer-process --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1720,i,4628072361736736598,15554353160209973520,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            PID:12552
          • C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
            "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1718904662 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1572 --field-trial-handle=1720,i,4628072361736736598,15554353160209973520,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:14692
        • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
          .\bin\gldriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:12404
        • C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
          .\bin\gldriverquery.exe
          4⤵
          • Executes dropped EXE
          PID:12812
        • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
          .\bin\vulkandriverquery64.exe
          4⤵
          • Executes dropped EXE
          PID:12928
        • C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
          .\bin\vulkandriverquery.exe
          4⤵
          • Executes dropped EXE
          PID:13008
  • C:\Windows\SysWOW64\TXPlatforn.exe
    C:\Windows\SysWOW64\TXPlatforn.exe -auto
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Windows\SysWOW64\TXPlatforn.exe
      C:\Windows\SysWOW64\TXPlatforn.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:5088
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
    1⤵
      PID:2904
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
        C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240648062.txt",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3840
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3404,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
      1⤵
        PID:4828
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x150 0x4fc
        1⤵
          PID:12364

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              LICENSE
              • Path C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping11768_1951414892\LICENSE
              • Size 473B
              • SHA256 afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59
              • MD5 SHA1 SHA512
              Submit Download

              manifest.json
              • Path C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping11768_1951414892\manifest.json
              • Size 1001B
              • SHA256 68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806
              • MD5 SHA1 SHA512
              Submit Download

              the-real-index
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index
              • Size 240B
              • SHA256 21de1c64463f7937c14711a1d7d5ba0cc5d8535f042e04b40bc6eed4e64b2a32
              • MD5 SHA1 SHA512
              Submit Download

              the-real-index~RFe58e0b6.TMP
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe58e0b6.TMP
              • Size 48B
              • SHA256 1f474169d38f98a6bb5dbea264f5d7a6ba4ac85e819322d674342b0bd225aa6b
              • MD5 SHA1 SHA512
              Submit Download

              MANIFEST-000001
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\MANIFEST-000001
              • Size 41B
              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
              • MD5 SHA1 SHA512
              Submit Download

              LocalPrefs.json
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json
              • Size 693B
              • SHA256 0f7564ba0ff6841dd81df894b8dbd676a9114071079975f4180918d710182d55
              • MD5 SHA1 SHA512
              Submit Download

              LocalPrefs.json
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json
              • Size 786B
              • SHA256 be36a7599a6f1e7839b52fcb4eec1330e28f58ef2681caed4e1d9b762d41f8ca
              • MD5 SHA1 SHA512
              Submit Download

              LocalPrefs.json~RFe599b5c.TMP
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe599b5c.TMP
              • Size 484B
              • SHA256 5d1ca9e4d472928f2ca8a9b1a08c444d20d29446f504a46947b13fc3e206ae86
              • MD5 SHA1 SHA512
              Submit Download

              Network Persistent State
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State
              • Size 300B
              • SHA256 54e245c26f1c2988fe32c18417d8d119956b73c7b14899c1b71d37dd5efce517
              • MD5 SHA1 SHA512
              Submit Download

              Network Persistent State~RFe59af61.TMP
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe59af61.TMP
              • Size 59B
              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
              • MD5 SHA1 SHA512
              Submit Download

              CURRENT
              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT
              • Size 16B
              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
              • MD5 SHA1 SHA512
              Submit Download

              HD_X.dat
              • Path C:\Users\Admin\AppData\Local\Temp\HD_X.dat
              • Size 1.2MB
              • SHA256 5c8138fc7fc8019b66b433d81a7ee318fa1bc298d4648b96d37dde2441274fd8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              HD_d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe
              • Path C:\Users\Admin\AppData\Local\Temp\HD_d57b96e0fdb7b41d27a0bba7e0db3d7e9b42b078b253894f20e8a61b2904dabd.exe
              • Size 4.2MB
              • SHA256 88eb0e145502e84cfb242b4733eeecbda53f78e33fe748f3c0e1fb14edbd7cd4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              RCXABF0.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RCXABF0.tmp
              • Size 1.2MB
              • SHA256 2beaf1b5b7728ed9ba73d4cd02a5830800a3419df490277db9ff7e5a3c089b63
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              X.ico
              • Path C:\Users\Admin\AppData\Local\Temp\X.ico
              • Size 69KB
              • SHA256 020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              aom.dll
              • Path C:\Users\Admin\AppData\Local\Temp\aom.dll
              • Size 7.1MB
              • SHA256 e78492de0ab575add50b925bfd44216d224d09904a9b14c17087a92fdcbc15cd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              avif-16.dll
              • Path C:\Users\Admin\AppData\Local\Temp\avif-16.dll
              • Size 226KB
              • SHA256 3d7ba6fedfdfd6e751693d718a21438304690b754d1c5d13c847a829b2423b8b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              audio.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\audio.dll
              • Size 177KB
              • SHA256 8683b6868f2fa1f29aa4d800a11b8cf628cda3b3651575c147b1e51e89a19309
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-console-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-console-l1-1-0.dll
              • Size 23KB
              • SHA256 32a70082cf3496745580c0e4b7d1bdbe925013300f0573ccef466e7a1915a51c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-console-l1-2-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-console-l1-2-0.dll
              • Size 23KB
              • SHA256 b4ff5467266a4f8e5d8998525a8948b8b86d51a23c2f4f7023c505c8db341802
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-datetime-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-datetime-l1-1-0.dll
              • Size 23KB
              • SHA256 5963b1cdb894ce297e52844741047f74f8d86fa7e97437e26d9bc8f0094e1003
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-debug-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-debug-l1-1-0.dll
              • Size 23KB
              • SHA256 ba17d3a66e3df85fbf8b82b500f1360f8598cd48a814fda3e552cdd995e6f449
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-errorhandling-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-errorhandling-l1-1-0.dll
              • Size 23KB
              • SHA256 b15dd0c332b261d62a0b37b8981980a15e47b4682e6985e26f155a85f19e1466
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-fibers-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-fibers-l1-1-0.dll
              • Size 23KB
              • SHA256 b9aefe9709a17fcaf8b85168c68f42e2b57f8214e7456a82c74495b815dc5bfe
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-file-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l1-1-0.dll
              • Size 27KB
              • SHA256 13266c9674e9c663252ff2dc1a014a86cbaa42801d210f408269bd1dff681440
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-file-l1-2-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l1-2-0.dll
              • Size 23KB
              • SHA256 b0919c80eb88d5d6aeb7a6eb42344f40ebf6bf0914a45045d9606e2469f15132
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-file-l2-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l2-1-0.dll
              • Size 23KB
              • SHA256 61365671b9fccbc10c06ccc0d4c8875dd98ca51e8d3eb77e91069b1bd11e4a96
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-handle-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-handle-l1-1-0.dll
              • Size 23KB
              • SHA256 b71658e60bfa69f0bbcafbc8df40b118e9fc5df747e2069db0ac18b66aaab818
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-heap-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-heap-l1-1-0.dll
              • Size 23KB
              • SHA256 60fa39cc05a21ce16a8651331445da1dd0e5e6c0194de819b4fa6a245f517396
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-interlocked-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-interlocked-l1-1-0.dll
              • Size 23KB
              • SHA256 f30dff7c389fc5143475a99945eaf9f2e36f2f50709e256c990b10459e32b8be
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-libraryloader-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-libraryloader-l1-1-0.dll
              • Size 23KB
              • SHA256 6d85722c07e91050b89692e647c8c9c6fec8c39a998286e0084a4a20619d956e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-localization-l1-2-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-localization-l1-2-0.dll
              • Size 23KB
              • SHA256 c7253d57e123911ca6a0cdc8c74f103fc048399224393e97bf5a2a993cc13fdc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-memory-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-memory-l1-1-0.dll
              • Size 23KB
              • SHA256 dfcea447a3436a3b36287becb215633e73760de7d1df88dd24ce0f998aadf597
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-namedpipe-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-namedpipe-l1-1-0.dll
              • Size 23KB
              • SHA256 2dcec9017298d32b92223c0b9125ecf15cf330973414b3e181a9dbbbd74145d4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-processenvironment-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-processenvironment-l1-1-0.dll
              • Size 23KB
              • SHA256 0986c9945e4db6c7e5bf42556f28ae54afafe5d991573590bffb9c494deaebdb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-processthreads-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-processthreads-l1-1-0.dll
              • Size 23KB
              • SHA256 7748f69d1f67fb4afa2ebb9712687d0b9235346d35909fee80dd5cb776ce7638
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-processthreads-l1-1-1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-processthreads-l1-1-1.dll
              • Size 23KB
              • SHA256 a074cc02be4cfa314ddd7223c288b1a71fe74143c3229c7cd30fb309419d7aa6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-profile-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-profile-l1-1-0.dll
              • Size 23KB
              • SHA256 074a6052a889456895d4eb8d592088b1d3858d3f6cecb884c528e74400710079
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-rtlsupport-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-rtlsupport-l1-1-0.dll
              • Size 23KB
              • SHA256 bb2576e861a0c507db9ab2a29577803d7258eff03e52dc5f36faa51249c892d2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-string-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-string-l1-1-0.dll
              • Size 23KB
              • SHA256 9f3a2d40be41b0c47fb03df21c4f7e4120cbb348553b642c5c80b92c64b3b357
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-synch-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-synch-l1-1-0.dll
              • Size 23KB
              • SHA256 902ae18339560e5142c87f97e9574864b518a0ca4572298b418acadecd8ac6ad
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-synch-l1-2-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-synch-l1-2-0.dll
              • Size 23KB
              • SHA256 ac30c50dc71795c7e0419389f15bf7676718e23f4b786da2ccd4103f24198656
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-sysinfo-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-sysinfo-l1-1-0.dll
              • Size 23KB
              • SHA256 329149e3a2360b9e4231ebae9fc3c467d3c560195fc3bc5d2fd31c6a5fd65da5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-timezone-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-timezone-l1-1-0.dll
              • Size 23KB
              • SHA256 e3d05dd8f99995cb289b3f86eaaadd99a0b1ca2e12f0a0db22feec335a938111
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-core-util-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-util-l1-1-0.dll
              • Size 23KB
              • SHA256 8b2197d96a4a01465e0062d5854a940232734123536ebd3c4f4116efae772688
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-conio-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-conio-l1-1-0.dll
              • Size 23KB
              • SHA256 56fb8c7b7d12814ab0f5fc2eb69dfe98c3e9d00dc554a5e00f2ffdf9fc8728d8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-convert-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-convert-l1-1-0.dll
              • Size 27KB
              • SHA256 d8f04afab237a0177bc3062c6508c57f884c23013985d3c48af26b7c25028949
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-environment-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-environment-l1-1-0.dll
              • Size 23KB
              • SHA256 f2d19e04a9fe1a382fe5c492501236a0cadc9f106036af8496a8f24457a3feb2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-filesystem-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-filesystem-l1-1-0.dll
              • Size 23KB
              • SHA256 9da16f7fb466e63a5ccc24eb7ee95a80ed4216e925545a59fd6fb5d7236211f3
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-heap-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-heap-l1-1-0.dll
              • Size 23KB
              • SHA256 516dc0852025a741cf5cfc6be3e4ad791d4a5aa692fa35498ba7b5f146d54a1e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-locale-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-locale-l1-1-0.dll
              • Size 23KB
              • SHA256 f55be8b606d5715e54cb795b822aa295c4e0e92170359fedf0f72c1fe07057f1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-math-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-math-l1-1-0.dll
              • Size 31KB
              • SHA256 f1d44a0a83fa84f5fc9a05008f57174930d42db834ddadb3e9df7650042961fc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-multibyte-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-multibyte-l1-1-0.dll
              • Size 31KB
              • SHA256 3b6f668eaa9efcdb8b36d57747666fe76aa4f3b7873ae83bece0099f105bc145
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-private-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-private-l1-1-0.dll
              • Size 75KB
              • SHA256 c9dd515e999f64af123f396d3deddc49012011060c843e5edb4223345143b0c5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-process-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-process-l1-1-0.dll
              • Size 23KB
              • SHA256 17394645fbccf060d02902c9aa9522626383437c1dd83554e3ac564e50f62716
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-runtime-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-runtime-l1-1-0.dll
              • Size 27KB
              • SHA256 b350748aa75d4f06e11c228161e1e94019b38aab9f5b59ca84db27acac00442d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              api-ms-win-crt-stdio-l1-1-0.dll
              • Path C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-stdio-l1-1-0.dll
              • Size 27KB
              • SHA256 509e51146b6a3e77b82cb786e17d4d52e398064446c469a45ad0c087ac5df270
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              crashhandler.dll
              • Path C:\Users\Admin\AppData\Local\Temp\crashhandler.dll
              • Size 361KB
              • SHA256 b0878682d846a4a3d8b953f237304a43961fda731f063b39c01c95bada04a091
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              bootstrap_log.txt
              • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
              • Size 9KB
              • SHA256 b86f22fbcd69d595e8bead249ec46faed76cc9b328ea2cb84ba0fb19a798d32f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              steam_client_metrics.bin
              • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
              • Size 2KB
              • SHA256 73b017338cc1a69104f5d664004f764445182372dbc588046201b77eee0ec919
              • MD5 SHA1 SHA512
              Submit Download

              steam_client_win32.installed
              • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.installed
              • Size 465KB
              • SHA256 6ebb9c7979384493df39adc7360e623ddddc48fe4bd588a63db256b2e2884800
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              steam_client_win32.manifest
              • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.manifest
              • Size 9KB
              • SHA256 919e50219d0d8fcff77805d4029a77b8e71912ab05684dca287545de3835a288
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              [email protected]_
              • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
              • Size 15KB
              • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              icon_button_news_mousedown.tga_
              • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_
              • Size 20KB
              • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              filter_clean_bulgarian.txt.gz_
              • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_
              • Size 23B
              • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
              • MD5 SHA1 SHA512
              Submit Download

              steambootstrapper_english.txt
              • Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
              • Size 4KB
              • SHA256 ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              svchos.exe
              • Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
              • Size 93KB
              • SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              svchost.exe
              • Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
              • Size 377KB
              • SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              240648062.txt
              • Path C:\Windows\SysWOW64\240648062.txt
              • Size 50KB
              • SHA256 ea59dc5bb842ed5cb95f5466a3cfc170699558d4467b131f5b5ebcbf41caac64
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
              • Path C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
              • Size 60KB
              • SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/3808-10-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/3808-7-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/3808-4-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/3808-6-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5088-34-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5088-40-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5088-46-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5088-44-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5088-32-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5088-35-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5112-13-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5112-15-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5112-18-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/5112-16-0x0000000010000000-0x00000000101B6000-memory.dmp
              Download

              memory/11516-12414-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12378-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12434-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12438-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12411-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12385-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12560-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12431-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12475-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12543-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/11516-12531-0x000000006F560000-0x00000000708D9000-memory.dmp
              Download

              memory/12472-12303-0x00007FF804060000-0x00007FF804061000-memory.dmp
              Download

              memory/12472-12379-0x0000020042150000-0x000002004227A000-memory.dmp
              Download

              memory/12472-12304-0x00007FF802990000-0x00007FF802991000-memory.dmp
              Download

              memory/12552-12382-0x00000200147C0000-0x00000200148EA000-memory.dmp
              Download

              memory/14692-12499-0x000001DF231C0000-0x000001DF232EA000-memory.dmp
              Download