SteamSetup[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/ShellLink.dll
unpack002/$PLUGINSDIR/nsExec.dll

SteamSetup.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
MD5 70f3bc193dfa56b78f3e6e4f800f701f
SHA1 1e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA512 3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1
SSDEEP 49152:2DcHcEngZtNm1LQRHH4PTwZX6kg9hsf4lcszpyu7d/TC:rngZtNm1G4Pw6dJzZNTC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

96:57:dc:d4:14:11:af:df:a8:7a:9b:aa:cb:29:0a:a9:21:bf:0e:dc:e1:a7:66:d7:47:10:41:02:3a:4b:63:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Chains

Mar 22, 2022

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Serial Number

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2021 - Oct 9, 2024

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/StdUtils.dll

IMPHASH 84484e9fa52eef55faa40a17a55a27f6
SHA256 e2ad7736209d62909a356248fce8e554093339b18ef3e6a989a3c278f177ad48
MD5 98a4efba4e4b566dc3d93d2d9bfcab58
SHA1 8c54ae9fcec30b2beea8b6af4ead0a76d634a536
SHA512 2dbc9a71e666ebf782607d3ca108fd47aa6bce1d0ac2a19183cc5187dd342307b64cb88906369784518922a54ac20f408d5a58f77c0ed410e2ccf98e4e9e39a0
SSDEEP 1536:Lyy+HcFWrX52XWcS15c4DBVOw/bEQvWt6uouMw5m0mhdBu4NpBTvO7Fvo6mVS6oN:Oy+8ozImcSNd1YHbMbC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

69104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

iswspace _msize ??2@YAPAXI@Z iswalpha _snprintf swscanf iswcntrl abort _beginthreadex time srand rand iswalnum __wgetmainargs wcsncpy _wcsnicmp wcschr calloc free _wcsicmp ??3@YAXPAX@Z _snwprintf memset memcpy

shlwapi

ord176

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

GetVersion WideCharToMultiByte InterlockedExchange HeapValidate InterlockedDecrement InterlockedIncrement GetSystemTime OutputDebugStringA DeleteCriticalSection GetExitCodeProcess InitializeCriticalSection SystemTimeToFileTime TerminateThread WaitForSingleObject GetProcAddress GetCommandLineW GetFileAttributesW LoadLibraryW GetModuleHandleW FreeLibrary CloseHandle GetFileSizeEx CreateFileW ReadFile WriteFile SetFilePointerEx GlobalAlloc lstrcpynW GlobalFree LeaveCriticalSection EnterCriticalSection GetTickCount Sleep VerSetConditionMask GetVersionExW VerifyVersionInfoW GetLastError LocalAlloc LocalFree

user32

MessageBoxA RegisterClassW DispatchMessageW KillTimer AllowSetForegroundWindow SetTimer DestroyWindow wsprintfW GetWindowThreadProcessId LoadStringW MessageBoxW MsgWaitForMultipleObjects UnregisterClassW PeekMessageW CreateWindowExW

shell32

ShellExecuteExW SHFileOperationW ShellExecuteW

ole32

CoCreateInstance CoUninitialize CoInitialize

oleaut32

VariantClear SysFreeString VariantInit SysAllocString

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 d93b76d51bd2214fa6e999c1bf70b4aff5165a6542f9b9b2a92b5672601f4624
MD5 da3486d12bb4c8aec16bd9e0d363d23f
SHA1 863244a4845c9d5dea8dd36e1083f5639e1224e1
SHA512 8e40adb65a4ad46f3bc5920d7fd8294397268e754b1eb00d4f7b0883be6468448033d9a46cf3a00fccddb4a7c81e7f984cf5a25731532c1aeface69573dfe59f
SSDEEP 96:iAwofR7VVNRn5/7hY0buGRGGM/o3FYsIR:YWxvN//7a0buGRGGTdm
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
MD5 0d45588070cf728359055f776af16ec4
SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
SHA256 7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
MD5 c5b9fe538654a5a259cf64c2455c5426
SHA1 db45505fa041af025de53a0580758f3694b9444a
SHA512 f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa
SSDEEP 96:xr7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkNL38:xxbGgGPzxeX6D8ZyGgmkN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Steam.exe

IMPHASH a150f31740d399a874804a4f4b1b9da3
SHA256 3caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04
MD5 b4411620a3551834e4f699cc5a9b27e6
SHA1 5093960cc86613e310d13770b5adef00fe93f3eb
SHA512 47dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024
SSDEEP 98304:dDokH1WPirCS6Ijt91p2GWNzSC34g2FiiIk:ttHSiJXGNNiE/k
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

33:e7:4a:53:b6:76:2b:fb:db:e5:e7:05:12:f4:b3:c9:41:47:82:2c:ee:d4:2b:c1:b9:db:8e:02:90:36:7b:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Chains

Mar 16, 2022

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Serial Number

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2021 - Oct 9, 2024

Minor OS version

0

Major OS version

6

Entry point

1265117

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\buildslave\steam_rel_client_win32\build\src\steamexe\Release\steamexe.pdb

kernel32

VerifyVersionInfoW WriteFile GetSystemTime ReadConsoleA SetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber GetEnvironmentVariableW SystemTimeToFileTime RemoveDirectoryW GetFullPathNameW WriteConsoleW FreeEnvironmentStringsW FindResourceA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation SetStdHandle SetConsoleCtrlHandler SetFilePointerEx LCMapStringW CompareStringW HeapAlloc HeapFree HeapValidate HeapSize GetConsoleOutputCP ReadConsoleW GetConsoleMode SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType ExitProcess InterlockedPushEntrySList RtlUnwind LocalFree GlobalLock GlobalUnlock GlobalAlloc SizeofResource LockResource LoadResource GetModuleFileNameW GetVersionExA OpenProcess GetExitCodeProcess GetCurrentProcess SetLastError GetEnvironmentStringsW DeleteFileW CreateDirectoryW VerSetConditionMask MulDiv FreeLibrary LoadLibraryA GetProcAddress Sleep GetCurrentThreadId DeviceIoControl GetFileAttributesW FindFirstFileW FindClose CreateFileW MoveFileExW GetModuleHandleA GetTickCount CreateFileA LeaveCriticalSection EnterCriticalSection GetLastError ProcessIdToSessionId GetCurrentProcessId GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx GetCPInfo DecodePointer EncodePointer OpenEventA SetEvent SetErrorMode CloseHandle RemoveDirectoryA GetFileAttributesA MultiByteToWideChar OutputDebugStringA GetStdHandle GetCurrentDirectoryA GetCurrentDirectoryW FindNextFileW WideCharToMultiByte GetModuleHandleW LoadLibraryExA LoadLibraryExW LoadLibraryW FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetFileTime ReadFile SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime SleepEx GetSystemTimeAsFileTime CopyFileW GetDateFormatW GetTimeFormatW FileTimeToSystemTime GlobalFree SetHandleInformation VirtualProtect VirtualQuery GetModuleFileNameA GetModuleHandleExA GetModuleHandleExW LocalAlloc IsBadWritePtr CreateIoCompletionPort PostQueuedCompletionStatus InitializeCriticalSection DeleteCriticalSection ResetEvent WaitForSingleObject CreateEventA QueryPerformanceCounter QueryPerformanceFrequency GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation TerminateProcess GlobalMemoryStatusEx VirtualAlloc IsDebuggerPresent GetCommandLineW RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread SetThreadPriority TerminateThread GetExitCodeThread SuspendThread ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree SetThreadAffinityMask SetEnvironmentVariableW SetCurrentDirectoryW CreateProcessW GetSystemInfo GetProcessAffinityMask SetUnhandledExceptionFilter DebugBreak GetProcessHeaps SetProcessAffinityMask InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete GetStringTypeW

user32

DispatchMessageW TranslateMessage GetMessageW ReleaseDC GetDC PeekMessageW GetWindowThreadProcessId EnumWindows SendMessageW IsWindowVisible GetProcessWindowStation MonitorFromWindow PostThreadMessageW LoadIconW LoadCursorW EnumChildWindows SetClassLongW SetWindowLongW GetWindowLongW MapWindowPoints MessageBoxW GetWindowRect SetWindowTextW RedrawWindow EndPaint BeginPaint UpdateWindow KillTimer UnregisterClassW GetClassInfoExW wsprintfA DialogBoxParamA EndDialog GetDlgItem SetDlgItemInt GetDlgItemInt SetDlgItemTextA OpenClipboard MonitorFromPoint SetClipboardData EmptyClipboard GetWindowTextLengthA GetDesktopWindow SetTimer MsgWaitForMultipleObjects SetWindowPos MoveWindow GetUserObjectInformationW GetMonitorInfoW AllowSetForegroundWindow MessageBoxA DestroyWindow DefWindowProcW RegisterClassExW CreateWindowExW CloseClipboard ShowWindow

gdi32

DeleteObject TextOutW CreateDIBSection SetTextColor SetBkMode SetBkColor SelectObject RemoveFontMemResourceEx AddFontMemResourceEx GetTextExtentPoint32W GetStockObject GetDeviceCaps DeleteDC CreateICW CreateFontW CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat

advapi32

RegOpenKeyExA RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyA RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA ReportEventW RegCreateKeyExA RegCloseKey

shell32

SHGetFileInfoW CommandLineToArgvW ord680 SHGetKnownFolderPath

ole32

CoTaskMemFree

oleaut32

VariantClear

comctl32

InitCommonControlsEx

psapi

GetModuleFileNameExW GetProcessMemoryInfo GetModuleInformation

version

VerQueryValueW

crypt32

CertGetCertificateChain CertOpenStore CertCloseStore CertCreateCertificateContext CertFreeCertificateContext CertAddCertificateContextToStore CertFreeCertificateChain

ws2_32

ntohl ntohs getaddrinfo freeaddrinfo closesocket shutdown socket WSAStartup WSAGetLastError WSARecv WSARecvFrom WSASend WSASendTo htons __WSAFDIsSet select WSASetLastError WSACleanup send recv connect WSAIoctl setsockopt WSASocketA htonl getsockname ioctlsocket bind

wsock32

ord1142

bcrypt

BCryptGenRandom

bin/SteamService.exe

IMPHASH a0070b5f41c964af345a108615eaf556
SHA256 f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e
MD5 2de3f7cf6020b3bb6bc4199459a63016
SHA1 8a30e5e333a353eb069ab961a4c1918fcbb44623
SHA512 5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e
SSDEEP 49152:EmvpI/M4M2YEOpBGcCxutN8Lf6vMTC4gbZtPW3bwDlmTbCeieU8K9f2ywH:Emv+M2CGZxY8Lf6L4gdw3b6mT7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

bc:eb:c4:9a:14:5c:de:c9:0a:d5:e3:15:79:9c:0f:a5:f5:98:41:3e:c9:d4:f9:80:f3:34:7f:e2:30:b6:6a:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Chains

Mar 16, 2022

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Serial Number

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2021 - Oct 9, 2024

Minor OS version

0

Major OS version

6

Entry point

1490257

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\buildslave\steam_rel_client_win32\build\src\SteamServiceHost\Release\SteamService_exe.pdb

kernel32

GetFileSize GetFullPathNameW RemoveDirectoryW OutputDebugStringA SetLastError GetCurrentProcess GetCurrentProcessId ProcessIdToSessionId GetVersionExA GetModuleFileNameW GlobalAlloc GlobalUnlock GlobalLock VerifyVersionInfoW CreateFileA MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next InitializeCriticalSection DeleteCriticalSection SetEvent ResetEvent CreateEventA WideCharToMultiByte SetProcessAffinityMask GetProcessHeaps DebugBreak WriteConsoleW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage SetStdHandle DecodePointer GetConsoleOutputCP SetFilePointerEx GetTimeZoneInformation HeapReAlloc CreateDirectoryW ExpandEnvironmentStringsA VerSetConditionMask LocalFree GetTickCount OpenProcess TerminateProcess DeviceIoControl GetConsoleWindow SetConsoleTitleW SetConsoleCtrlHandler MoveFileExW CopyFileW Sleep CreateMutexA ReleaseMutex OutputDebugStringW WriteFile SetFilePointer SetFileAttributesW ReadFile GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW GetCommandLineW CreateProcessW GetExitCodeProcess GetProcAddress WaitForSingleObject CloseHandle SetCurrentDirectoryW ExpandEnvironmentStringsW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetLastError GetModuleHandleA LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FindResourceA LockResource LoadResource LoadLibraryExA FreeLibrary LoadLibraryA WTSGetActiveConsoleSessionId LCMapStringW CompareStringW HeapFree HeapAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe ExitProcess HeapValidate HeapSize GetModuleHandleExW GetLocalTime VirtualQuery EncodePointer RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx SetUnhandledExceptionFilter QueryPerformanceFrequency QueryPerformanceCounter GetCurrentDirectoryW SetThreadAffinityMask SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertFiberToThread DeleteFiber GetFileType GetEnvironmentVariableW FindFirstFileExW FlushFileBuffers GetDiskFreeSpaceA GetDriveTypeW GetFileSizeEx SetEndOfFile SetFileTime SleepEx GetSystemTimeAsFileTime GetModuleHandleW LoadLibraryExW LoadLibraryW GlobalMemoryStatusEx VirtualAlloc VirtualProtect GetModuleFileNameA LocalAlloc IsDebuggerPresent GetCommandLineA GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GetSystemInfo GetProcessAffinityMask RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SwitchToThread CreateThread GetCurrentThread OpenThread TerminateThread GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle

user32

GetDlgItemInt SetDlgItemInt GetDlgItem EndDialog SetDlgItemTextA GetWindowTextLengthA MessageBoxA GetDesktopWindow GetProcessWindowStation GetUserObjectInformationW OpenClipboard EmptyClipboard SetClipboardData MessageBoxW CloseClipboard DialogBoxParamA GetWindowThreadProcessId EnumWindows GetWindowRect SetWindowPos IsWindowVisible wsprintfA ShowWindow

advapi32

StartServiceCtrlDispatcherW SetNamedSecurityInfoW RegQueryValueExW RegEnumValueW RegDeleteValueW LookupPrivilegeValueA SetTokenInformation DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW ConvertStringSidToSidW SetEntriesInAclW StartServiceW SetServiceStatus SetServiceObjectSecurity RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceObjectSecurity OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW GetSecurityDescriptorDacl RegSetValueExW RegCreateKeyExW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExA RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegEnumValueA RegEnumKeyExA RegDeleteValueA RegCreateKeyExA RegCloseKey

shell32

SHGetFolderPathW ShellExecuteW CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

ws2_32

recv send WSAGetLastError closesocket gethostname WSAStartup WSACleanup WSASetLastError

shlwapi

SHDeleteKeyA

wintrust

WinVerifyTrust

psapi

GetProcessMemoryInfo GetModuleFileNameExW

bcrypt

BCryptGenRandom

public/steambootstrapper_brazilian.txt

SHA256 70c39d5d5b16640165de19cee80da4a391035108cbc5f5009372a86954f0fe92
MD5 8ebd46495dd3b4ab05431c5c771d5657
SHA1 e426214322a729faddb5bc80053af5750c76683b
SHA512 53afd923f583eda4db580935a8cdd62413af8e830c04f2c12d15c55e905c114ec11a5e4483660601504c27e9350e9e47c6432f8f699464e11c5050fe846d7dc4
SSDEEP 96:3aArpYaRZ8hYzaAD25nmoVIPEPVIPErKOo8D85e:Gar8iRCNmVPXP738D85e
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_bulgarian.txt

SHA256 b387e2fb971297d3438acca130c53dfdd202ae2ca5b52d6503333734cda4fbfc
MD5 239c03a3dc1c27993da724736d086cef
SHA1 ff88246f8ea3502873dcbdc622378f006c58a2e6
SHA512 656922e8f2dec46ef36efba5c85088c47b02e89f62b27559611fcbe6ef85c6cd8462a4532e2d2d7f4faa977ab24f0de6f5f72e3075f8889db9e6e60baa162a32
SSDEEP 192:sK8p+typPx7rYLxGnyVUY8WYw6i0KfBKKfg38m8i/:sK8piqMLxGnyVU/YEWYWg38m8G
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_czech.txt

SHA256 60c29f3c57c44c58daf69be797bfede31967b1ddfc9bb68cb7ddaa0acda67c8c
MD5 6def4d3cf1453d5fb69d22fca29892a4
SHA1 09fe62653e55668de75a9fc5b64949ea81eb4991
SHA512 ee4f3f5dd8a8aadde9cff8f8aca8a45fa419c36fd8a4a7d3af9b71e1f7e5d9e1d01c329c70e6da53238822b536e35224e55004bf2e1af4ec17d5b56ccfc58549
SSDEEP 96:2iAz7xzQK8VzRZfVAxzQXRQM1qN/lS4xIjfiI7yOo8S8qQk:lAz9zozrdAZQXRJqi4OvO38S8qQk
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_danish.txt

SHA256 fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115
MD5 03b664bd98485425c21cdf83bc358703
SHA1 0a31dcfeb1957e0b00b87c2305400d004a9a5bdb
SHA512 4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d
SSDEEP 96:iKSCj4RjGEcH6RZY77p7zrOsLEPnvIBXKvI2BqOo8380Bg3:BJj4jGnH6rY77lrOxPnQoQmq38380By
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_dutch.txt

SHA256 56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192
MD5 31a29061e51e245f74bb26d103c666ad
SHA1 271e26240db3ba0dcffc10866ccfcfa1c33cf1cc
SHA512 f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8
SSDEEP 96:TnsaIWCk1TXfSRkAcXJNRZY/r/iza1GUNrzRxbM4x9yJs+Xc1AZqI79qIjiOo8nl:LsaIVATvycZNrY/KQyJs+ZZz79zji38l
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_english.txt

SHA256 2eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0
MD5 2fe6613e267857982d7df4368c9827ec
SHA1 d520c7427b283e3ff167b850ab15352e46d328d3
SHA512 cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4
SSDEEP 96:hSlb0IG997a8ICgARZ2pyUBnXPz5dc6LzIIivI/BxkHLs06J:8lHmbICgAr2hJc6LkIiQ/DOLsVJ
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_finnish.txt

SHA256 e350ca62e777da4da6d25885be96d48e7ce3acf021a74f2a4902354a1bf03fbb
MD5 594be5b10d9f551e551cf20eae0e6dfc
SHA1 191c20f5cb0c27ecc5a055fa2379694f5e27a610
SHA512 e27bf6593a177c22e16ddf5a44d82b34b02063645a7fd63943b936028d9c433c89628038768a300c296c2d3bcab2ef6b8532a19f7283952d041865c704f62b0b
SSDEEP 96:OJCZC1RCSwhp1RZY/T4zcVYsspWIN71BIxZvaZIUZvaPOo828jbG:JkPwhp1rY/Ucx0ALbYi3828jK
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_french.txt

SHA256 8cce22e7f13486f2bc612dcc8fa31d81038e6084a350fa10299d40c3a7f878c8
MD5 da69785dfbf494002f108dd73020183d
SHA1 34bb6061cdf120e7dced0402e588c3f712cf2dc0
SHA512 db773783b63ed1d66a59272e05304c174b69f85d2838ae8049dffed6b6b30c2011fd9042dd652f9a1733a2b6891870b426cf1985d41921e5360c9b1ae1330e20
SSDEEP 96:vk3l1CEN8RLcSMWPrfwgXWRZDbUvzBT5H52EkJJIbcYIbsgqOo83fy8WJv:sVIEug0ETrDsB+EkQbclbsgq38Py8WJv
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_german.txt

SHA256 02e48ee4e10354a2b2741d2e57ef565404753779f847906b5ae5c98ede06c01b
MD5 395286db3e67a59868e2662c326c541a
SHA1 716014d76622612a1bde2d4e1744d024f6d0b830
SHA512 64cdf1e6701ea57474051e338eee74859fc0ff4acd71ee0718a9b8cd698e94a9793c1901b6791fc0fc268c53fbc1e7e2f94ac1024f3f8765bf713954c194b0fe
SSDEEP 96:hn6e0CBtWTeRBtWTkcBMBcVRZY13nSYzBPCN0Ky5zaxhlwG/Iq8N8S32IBa3DOoo:h6erBtWqBtWDBMBcVrYF7GvFANv4D38f
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_greek.txt

SHA256 88919d7be26fb3e06401fc0254733d92fd743ecc56da4177b41613e1f094c3e8
MD5 b9e30df8cf272813b121133fcf259752
SHA1 16706f982f16d5feb9c808f94b8cfa50c23f5d80
SHA512 7beb65c0477b02742741a8ce23557f4f15e8cf1b1ef03a6bbadbf594bdf2cd686d7356d93719111d27b309a10ca75846765a13bb3eb4d0411785dfb13a675fc4
SSDEEP 192:xjAVmh67h7mrdtjIWdS0ZOwdS0ZQo38a8FN:9pVnOYQo38a8j
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_hungarian.txt

SHA256 1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5
MD5 18aaaf5ffcdd21b1b34291e812d83063
SHA1 aa9c7ae8d51e947582db493f0fd1d9941880429f
SHA512 4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154
SSDEEP 96:ADKraKKnH5BpRZELDO1cMQzQNW3kjN7MIOjHfvMIOwuOo888OK:W+a5BprELDXMAQNnN1OjHfhOwu3888OK
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_italian.txt

SHA256 b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585
MD5 8958371646901eac40807eeb2f346382
SHA1 55fb07b48a3e354f7556d7edb75144635a850903
SHA512 14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554
SSDEEP 96:5fTYcpLQ4J+4XRZauvgpJ2zyHTNb9eMuIluIVOo83zy8Xa6:xpkA3XrDQHlHV38Dy8Xa6
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_japanese.txt

SHA256 fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265
MD5 7e1d15fc9ba66a868c5c6cb1c2822f83
SHA1 bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7
SHA512 0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406
SSDEEP 96:wnwSwjaxKPVcljckFEJckFzRZYwCeHalzL9L3XHwrqdJOxoPLD1hKkHzULyqI5d5:ewSwINckeJck5rY5RXwaJdykHRly38TD
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_korean.txt

SHA256 10720923c1048502c5191d6d1d8580e35e707b24d457941dae94a87371af989a
MD5 d75580775d67a85353189736222a8878
SHA1 ccb2275c8f5d119640064fd533ca15f30d93f331
SHA512 757dd94a1e3debb2520855a3d00e44e3a98b5764caf9c16c8d088fc1a1f1024eed742f1051635721f4bf2c00d1dac11fd975c09a7f5df78d1863de88f9bbf9fe
SSDEEP 96:bno0CtiVRtncgzjthtF5NdLRZYyzzjBaz23//w2Dv3R8QtVSMfXIjNXIPemiOo8U:zorkv+gnRFTtrYxUXLLB8Q2Oq3838gpq
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_koreana.txt

SHA256 10720923c1048502c5191d6d1d8580e35e707b24d457941dae94a87371af989a
MD5 d75580775d67a85353189736222a8878
SHA1 ccb2275c8f5d119640064fd533ca15f30d93f331
SHA512 757dd94a1e3debb2520855a3d00e44e3a98b5764caf9c16c8d088fc1a1f1024eed742f1051635721f4bf2c00d1dac11fd975c09a7f5df78d1863de88f9bbf9fe
SSDEEP 96:bno0CtiVRtncgzjthtF5NdLRZYyzzjBaz23//w2Dv3R8QtVSMfXIjNXIPemiOo8U:zorkv+gnRFTtrYxUXLLB8Q2Oq3838gpq
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_latam.txt

SHA256 05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c
MD5 7913f3f33839e3af9e10455df69866c2
SHA1 15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25
SHA512 534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804
SSDEEP 96:9FDhCIRRcJ3NkrHRZYGerQrmermz+Ejp6lLSG+oIq2K/+oIq2vgKOo8348o06:fsISbSrYrybSZYlEzKazv938o8o06
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_norwegian.txt

SHA256 cbfbe91d4a4661df814ea447c03f4ca872ef3e27073a1eb746faccbfe75afc8a
MD5 5462f47e56b978659ef56f196db013f4
SHA1 4749824d4e909369f59217d4980963ff17353f3f
SHA512 5a437968fc06619cf553ced32dba9c7c948f4364f02c8017986e9a4f09e9832b849c7e0567485ca1beba34a258d29b2612ea3ed6045c81777e9a5201139f81a3
SSDEEP 96:hL+9CbrRtcejaRZYBEpdzudyyACWxmkz6lIb2oZIA+Oo8q80Br+:EQb1+ejarYO7u4mkz6Sb2o2A+38q80Ba
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_polish.txt

SHA256 0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32
MD5 9b0b0e82f753cc115d87c7199885ad1b
SHA1 5743a4ab58684c1f154f84895d87f000b4e98021
SHA512 b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df
SSDEEP 96:Wa2CgROcEhwYRZYXvs9zp6SjluImGIljIjXOo89p8FR:X1wVEhwYrYQoI4fOD3838FR
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_portuguese.txt

SHA256 2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04
MD5 eb8926608c5933f05a3f0090e551b15d
SHA1 a1012904d440c0e74dad336eac8793ac110f78f8
SHA512 9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a
SSDEEP 96:uIsrct89cRZetJ2Ommrzrrd2GQvqGVA9VM7KOo8388UL6:Lt89crMYOZXwSwIx38s8UL6
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_romanian.txt

SHA256 52f256ded29ce22945b5bc0ef7a227189dfa91da69265ec13283a7067c239071
MD5 31bd3d4d8de5af4642b21d586d5ee54d
SHA1 552bebb93c71cd8acd72558db1810530909fb276
SHA512 cea49fc70b18a1294ec7e564ff7f4d1ff7efeb0db1cf1b088da6adcecc282569380f225e9a150d1666c5c1977ba4de0a5d9d667c72cfb8569a50546b978e9132
SSDEEP 96:Ivm7CuRPcPlXRZYIiK2zHazOPPUqlWdSHd1IAGo+pRIAGxMpnOo83L8sN:SmeeEPlXrYht6zKUodCwo3878sN
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_russian.txt

SHA256 08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e
MD5 e04ad6c236b6c61fc53e2cb57ced87e8
SHA1 e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4
SHA512 0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331
SSDEEP 96:c5qCHRRc8sF+RZLqls1s1pzMDqAFoJFOTfNfKIik6IiVqOo868Crsk:GxS8sErWl+s1BFpg1Zh3868Crsk
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_schinese.txt

SHA256 948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f
MD5 56dcf7b68f70826262a6ffaffe6b1c49
SHA1 12e4272ba0e4eabc610670cdc6941f942da1eb6a
SHA512 c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2
SSDEEP 96:/BAGpCOREHce3QuRZY7yezuqY2v14q3HPG9AHINL4QI04VOo8a8Jz:Sr+re3QurY7XfHPgNL4d04V38a8Jz
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_spanish.txt

SHA256 41ecfe0ffd6043a66a41bf9ea032712f2d1bbc19b434c6c666a107ee379f21e4
MD5 e9b8fccdb78bf9d275b79c75b2ff3e7b
SHA1 4b549411ed4db0f0a3699e76531353c226b06a76
SHA512 4ce905a31f3a410712722271abd7e0a9a6c43646b61a321912b4a8e8f6fab68ab69add1d701c501bb069b8ecb65ecaf3bfa9be983933d0234a8c81c24bc6601f
SSDEEP 96:pFDhCIRRcJ3NkrHRZYGerQrmermz+Ejp6lLSG+oIq2K/+oIq2vgKOo8348o06:rsISbSrYrybSZYlEzKazv938o8o06
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_swedish.txt

SHA256 4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690
MD5 b2248784049e1af0c690be2af13a4ef3
SHA1 aec7461fa46b7f6d00ff308aa9d19c39b934c595
SHA512 f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c
SSDEEP 96:cnvF+VYBVZcdOMuRZvODz1Q4EqvL8FdGPbII8ncswBIIZswpOo8V8pVKw:CvsVsV6dOJrc1qGSdGPsI3+Idp38V8vl
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_tchinese.txt

SHA256 5e6b0978fe8e2d14905f46e089b06681d6dfe76dd0c1551c168171ac4de75969
MD5 5c7bc92e0d948e3bba3f26f64a22fe7e
SHA1 bd259397a312bee9b8262058c30e0e354eeea93a
SHA512 8a6e18ce3d38a9658172b1871255a9941c572114137e468f130956c73ff13f282a46074a1dda6404dbdbf317ecdaadf01324194b8f8c081f862037784f4946ba
SSDEEP 96:MBA8ClRHcPTTeRZYEIlzAtwLaIrjGRXaFHJICVkHJIDVIOo8J8Jn:xT/8PTTerY7HH4qFHGvHGC38J8Jn
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_thai.txt

SHA256 49b6b664d50a1ae0c732bcfbbdd1db1812ddccf00bcf5f40200f0e7cff5542ee
MD5 1a537a1d30fba1d3db449a9207b63835
SHA1 ab6903b4c8d6bd3571960b1218714b8d76b1880d
SHA512 1215b0d017a6e3ea207edafe8edd500a91a7a971b2f989d8006fa65e475ae32ec00df3e8ec06b4077f64f5b789c536bfb9d8b9945ca0e0731d68e48876bd8459
SSDEEP 192:MFlO8vlYUUlM/aUl1orYy5U55Z5I5vF3k5caR57jR5qf5c5AK5D7XBzmUZT5odWn:MFBwuYMy5U55Z5I5vF3k5caj7jR5qf5q
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_turkish.txt

SHA256 711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f
MD5 29f9a5ab4adfae371bf980b82de2cb57
SHA1 6f7ef52a09b99868dd7230f513630ffe473eddf8
SHA512 543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a
SSDEEP 96:xnkgCvLRzchBmRZY6PfwEGcyDQz32cgRc1PqX0pVmbIN0P1bINuOo888SM:Rkv9ohBmrY68A3eXWRYSk3888SM
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_ukrainian.txt

SHA256 3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99
MD5 cadd7a2f359b22580bdd6281ea23744d
SHA1 e82e790a7561d0908aee8e3b1af97823e147f88b
SHA512 53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519
SSDEEP 192:RQqEG5oFQE3FqioFq2rYFdpp0XnZZSEbUFvxlDl2oC38gv851e:RxEoAQE1PAfM/pp0XnZ0nvHDl2X38gvr
MD5 SHA1 SHA512 SSDEEP

public/steambootstrapper_vietnamese.txt

SHA256 8a049b6126e904dcb9ba5d8af21cc0ab25ca55221cf2cd48eea45504fe23083b
MD5 f8a86b74ce3b446e3111d1480b5feaf7
SHA1 af21c55fd6ac99e65db55af9b8f4ffe790c4382c
SHA512 70f8009f5940b10b77a6c152c8c73f3dd425fb9ac917014504e8116ef00032888de686271e0262cbe7a55c6e605e837dcfbeb54ece71e49646b1030195fa0845
SSDEEP 96:UWzvmCjzNlWR9cbG8THYCqrRZYT7zB4dbwfKKKX/TBAqLvI36zvI3FAqOo82f8U/:UMvlvNl2ObfT49rYDB4dUyKKX7Bns36W
MD5 SHA1 SHA512 SSDEEP

uninstall.exe

IMPHASH 4ea4df5d94204fc550be1874e1b77ea7
SHA256 d0b0305b42c35716482a6aa08c8257c19aad225e3ffd9ab1f0de411d8b9e592e
MD5 4f009883567dfa9e908c5ffa25a2fa0a
SHA1 5848783144c5a04fd4fff71651e3195444156b03
SHA512 015e03849ccb6f646538ebb5a1f75bd973258564a4d2664f51da11e88316e9a3d2863de131f105daf2173a5c494e6c6bcc621c6952144ed4bf4bd2bbdec5ef6d
SSDEEP 3072:cAe+3aJpgWXTBuA/JFONMVRO9qyVK+J5n/79:/B+pgUXJFOSVAqyVK+J5nj9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

0e:9d:65:11:83:b6:3d:8d:bb:79:0d:cf:81:80:07:0c:3d:c6:99:63:96:c1:7a:c4:5f:04:f9:90:19:af:53:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Chains

Mar 22, 2022

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US

Serial Number

06:89:b3:bc:eb:44:09:89:0a:32:d7:19:76:b1:32:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 7, 2021 - Oct 9, 2024

Minor OS version

0

Major OS version

4

Entry point

13238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount CreateFileW GetFileSize MoveFileW SetFileAttributesW GetModuleFileNameW CopyFileW ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode WaitForSingleObject GetCurrentProcess CompareFileTime GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GetDiskFreeSpaceW lstrlenW lstrcpynW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 8dc2be6679497994e3ddc97bc7bc1ce2b3c17ef3528b03ded6696ef198a11d10
MD5 0c44f21d4afc81cc99fac7cc35e4503a
SHA1 3d0d5c684df99a46510c0e2c0020163a9d11c08d
SHA512 4e4bd35d6aa21cecbfe7a93a2ee7db8ee78ca710a4193dfe240d1067afbe10f61db332c1c85f6cc3ba404d895a959742401b615ef8ff5bd9028254c4a43a0923
SSDEEP 48:S46+/N3TKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mCofjLl:zPuPbOBtWZBV8jAWiAJCdv2CmpL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ShellLink.dll

IMPHASH 45fa690faed482cb9bfd08458ed442ae
SHA256 5d103419245e2a5f124a96cace25d6836b2398edc0aa3919829b0fd6ad8b5d6a
MD5 d62d3e349689811f838dd10fb216eba1
SHA1 edcafd517860cb6b4bd299e20b17ad74a6fa2a5d
SHA512 fc7d5826cb9f85068ea702f007920bf7ae63758d13c48761e83cc9e8ac06b231f40e17a9f3340d60d874ad2cf6e0991eb98a52cf893ab785489e0cdbbf294f88
SSDEEP 96:fQW7e3a0JF5jdrORE6C4tb+X+bzYz3Cl6nfkfLGpRO:4687JQCdiaR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 d93b76d51bd2214fa6e999c1bf70b4aff5165a6542f9b9b2a92b5672601f4624
MD5 da3486d12bb4c8aec16bd9e0d363d23f
SHA1 863244a4845c9d5dea8dd36e1083f5639e1224e1
SHA512 8e40adb65a4ad46f3bc5920d7fd8294397268e754b1eb00d4f7b0883be6468448033d9a46cf3a00fccddb4a7c81e7f984cf5a25731532c1aeface69573dfe59f
SSDEEP 96:iAwofR7VVNRn5/7hY0buGRGGM/o3FYsIR:YWxvN//7a0buGRGGTdm
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsExec.dll

IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
SHA256 7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
MD5 c5b9fe538654a5a259cf64c2455c5426
SHA1 db45505fa041af025de53a0580758f3694b9444a
SHA512 f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa
SSDEEP 96:xr7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkNL38:xxbGgGPzxeX6D8ZyGgmkN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

SteamSetup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/StdUtils.dll

msvcrt

shlwapi

version

kernel32

user32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

user32

generic

Steam.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

psapi

version

crypt32

ws2_32

wsock32

bcrypt

generic

bin/SteamService.exe

kernel32

user32

advapi32

shell32

ole32

oleaut32

ws2_32

shlwapi

wintrust

psapi

bcrypt

generic

public/steambootstrapper_brazilian.txt

public/steambootstrapper_bulgarian.txt

public/steambootstrapper_czech.txt