41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f

Analysis

user interaction
yes
max time kernel
124s
max time network
125s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/03/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
st-setup-1.8.30.exe
Size 10.6MB
Sample260331-jc2xraf14j
SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
MD5 54cceb7c9c0c50a9d2f0b1b4f173eb33
SHA1 ffc28139e6c2d2eeeb27bc39f2ab20e4b8b4c08e
SHA512 41a589e7ea52d1a8730a4f12ef3db6e5738cb426f38483e8dc178e42d3ef58e1459cc61cccab800891f38fc9e6e3eccc76c46c2782108d084d91234b1f43b53d
SSDEEP 196608:CW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7YD:7CDQaC28nl78Kg6zCWCdFs
TLSH
T1C0B633942474E24DE0BA0031EC61EF66DDF4B09A5B058A1E4299CB6577E4BE34C2FECD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

steam defense_evasion discovery persistence phishing privilege_escalation spyware trojan

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5668	icacls.exe
4196	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
57	3272	chrome.exe

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
46	3272	chrome.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0328.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_070_setting_0080.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_rfn_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_button_steam_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_button_menu_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_dpad_right_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_button_x_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_touch_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_l_down_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\menus\steam.menu_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0335.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_100_target_0080.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\rampUp_1.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\familyview.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_touchpad_edge_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\sounds\deck_ui_out_of_game_detail.wav_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0300.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamui_portuguese.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_trackpad_r_touch_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_rm.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_l1_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_m3_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0343.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\joyconpair_left_sr_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_dpad_right_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_gyro_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_p3_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_swipe_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_l_left_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\locales\fil.pak_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_button_view_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_l5_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_buttons_s.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_up_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\8bitdo_button_home_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_rb_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\switchpro_rstick_right_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_040_act_0336.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_toast_newturns.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steambootstrapper_japanese.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_button_steam_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_l2_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_r_touch_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\sounds\deck_ui_typing.wav_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0311.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_color_outlined_button_x_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_l.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_l2.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_dpad_up_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0321.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_060_vehicle_0070.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\notfamilyview.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\switch_controller_portuguese.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\trackerui_italian.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\platform_swedish.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_lb_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_button_share_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0315.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_stop_over.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\overlay_ukrainian.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\vgui_spanish.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_rb_md.png_	Steam.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Executes dropped EXE 7 IoCs

pid	Process
2376	SteamTools.exe
4436	SteamSetup.exe
5264	steamservice.exe
584	steamservice.exe
5568	Steam.exe
28284	Steam.exe
28392	steam.exe

Loads dropped DLL 28 IoCs

pid	Process
3364	st-setup-1.8.30.exe
3364	st-setup-1.8.30.exe
3364	st-setup-1.8.30.exe
3364	st-setup-1.8.30.exe
3364	st-setup-1.8.30.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
28284	Steam.exe
4436	SteamSetup.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	chrome.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
584	steamservice.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3272	chrome.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134194160208203802"	chrome.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Steam.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2376	SteamTools.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4284	chrome.exe
4284	chrome.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe
4436	SteamSetup.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2376	SteamTools.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe
Token: SeSecurityPrivilege	5264	steamservice.exe
Token: SeSecurityPrivilege	5264	steamservice.exe
Token: SeShutdownPrivilege	4284	chrome.exe
Token: SeCreatePagefilePrivilege	4284	chrome.exe

Suspicious use of FindShellTrayWindow 49 IoCs

pid	Process
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe
4284	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe
2376	SteamTools.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 5668	3364	st-setup-1.8.30.exe	79
PID 3364 wrote to memory of 4196	3364	st-setup-1.8.30.exe	81
PID 3364 wrote to memory of 5276	3364	st-setup-1.8.30.exe	84
PID 3012 wrote to memory of 2376	3012	explorer.exe	86
PID 4284 wrote to memory of 4492	4284	chrome.exe	88
PID 4284 wrote to memory of 4148	4284	chrome.exe	89
PID 4284 wrote to memory of 4148	4284	chrome.exe	89
PID 4284 wrote to memory of 3272	4284	chrome.exe	90
PID 4284 wrote to memory of 4672	4284	chrome.exe	92
PID 4284 wrote to memory of 4672	4284	chrome.exe	92
PID 4284 wrote to memory of 1680	4284	chrome.exe	93
PID 4284 wrote to memory of 6032	4284	chrome.exe	94
PID 4284 wrote to memory of 1680	4284	chrome.exe	93
PID 4284 wrote to memory of 6032	4284	chrome.exe	94
PID 4284 wrote to memory of 4428	4284	chrome.exe	95
PID 4284 wrote to memory of 4428	4284	chrome.exe	95
PID 4284 wrote to memory of 4612	4284	chrome.exe	97
PID 4284 wrote to memory of 4612	4284	chrome.exe	97
PID 4284 wrote to memory of 1476	4284	chrome.exe	98
PID 4284 wrote to memory of 2624	4284	chrome.exe	100
PID 4284 wrote to memory of 2624	4284	chrome.exe	100
PID 4284 wrote to memory of 5556	4284	chrome.exe	101
PID 4284 wrote to memory of 5556	4284	chrome.exe	101
PID 4284 wrote to memory of 4724	4284	chrome.exe	102
PID 4284 wrote to memory of 4724	4284	chrome.exe	102
PID 4284 wrote to memory of 4300	4284	chrome.exe	103
PID 4284 wrote to memory of 4436	4284	chrome.exe	104
PID 4436 wrote to memory of 5264	4436	SteamSetup.exe	105
PID 5568 wrote to memory of 28284	5568	Steam.exe	112

C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe
"C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T
  2⤵
  - Modifies file permissions
  PID:5668
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"
  2⤵
  - Modifies file permissions
  PID:4196
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"
  2⤵
  PID:5276

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Program Files\SteamTools\SteamTools.exe
  "C:\Program Files\SteamTools\SteamTools.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff839bdc728,0x7ff839bdc734,0x7ff839bdc740
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,15842358439786226449,5227329772158854395,262144 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1508,i,6579702753117398975,17177889907111312434,524288 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - Detected potential entity reuse from brand STEAM.
  - System Time Discovery
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,811603462896219467,5778381857818786107,524288 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,17229921602791436379,13383237241343358087,2097152 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,14487192519101756546,12016868973050247774,2097152 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4252,i,2247981543822312847,16005310487616516875,2097152 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4260 /prefetch:9
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,3768712097587458939,2914798871553800365,2097152 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,5287780520641280638,7293092151868329310,524288 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5480,i,3475012180967595801,9233919288588319524,2097152 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5848,i,15804909040426613461,12905363155683510302,2097152 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3728,i,1339817612067719614,750375692091501641,2097152 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6052,i,3390047237981070672,14186529015943458270,524288 --field-trial-handle=2008,i,16945915958322989050,14020732280500047065,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:4300
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:5264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2400

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
PID:584

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\steam.exe" -silent
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Program Files (x86)\Steam\Steam.exe
  "C:\Program Files (x86)\Steam\Steam.exe" -silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:28284

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:28392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Steam.exe

Path C:\Program Files (x86)\Steam\Steam.exe
Size 4.2MB
SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
MD5 33bcb1c8975a4063a134a72803e0ca16
SHA1 ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65
SHA512 13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49
SSDEEP 98304:7JeV/ztZBe91oiImuUiK9N9EGQKF9lSHbr7aw:1S/hwkmg4EpbrOw
TLSH
T1C516BF62BB41C071F9C201B964BE9F7A497DAE204775C0D397D43E6A88311D32B3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamService.exe

Path C:\Program Files (x86)\Steam\bin\SteamService.exe
Size 2.5MB
SHA256 ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d
MD5 ba0ea9249da4ab8f62432617489ae5a6
SHA1 d8873c5dcb6e128c39cf0c423b502821343659a7
SHA512 52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b
SSDEEP 49152:G+v+Y6iR3Gdcw/9I4AEZvvxYtP6iJ6aFmDJRicyM/wHH1sc:G+v+YbGiwV9AEZvW0iJRma
TLSH
T14FC5AE12FA4248BDE9D21578E2EF537B4A396E101335C8C787D03F5568326D2BA3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 15KB
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
TLSH
T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_button_news_mousedown.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_
Size 20KB
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
SSDEEP 48:X77qTxcazfhjZRRRRRRRRRRRRRRRRRRRKFvJJJhmAr:X774zmvJJJhmu
TLSH
T18F9209380E706CCE81CE9A27AB348AD2A9D2DC6F36632E348653350FC1948543EA734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_clean_bulgarian.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_
Size 23B
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
MD5 SHA1 SHA512

Submit Download

steambootstrapper_brazilian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt
Size 4KB
SHA256 0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544
MD5 0340d1a0bbdb8f3017d2326f4e351e0a
SHA1 90d078e9f732794db5b0ffeb781a1f2ed2966139
SHA512 9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93
SSDEEP 96:3aArpYaRZ8hYzaAD25nDoVIPEPVIPErKOo8D85e:Gar8iRCNDVPXP738D85e
TLSH
T1EEA113AF179911BC58BDC3ED370E4E9725CC6172662EA88895CECB0D0DE740772B3592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_bulgarian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt
Size 6KB
SHA256 76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9
MD5 4c81277a127e3d65fb5065f518ffe9c2
SHA1 253264b9b56e5bac0714d5be6cade09ae74c2a3a
SHA512 be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a
SSDEEP 192:sKVp+typPx7rYLxGnyVqY8WYw6i0KfBKKfg38m8i/:sKVpiqMLxGnyVq/YEWYWg38m8G
TLSH
T1CED18C59076964DE4631F05EA9047E4B3DCA90FF3BB38B0501E9697C3EE307572BA289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_czech.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt
Size 4KB
SHA256 650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7
MD5 2158881817b9163bf0fd4724d549aed4
SHA1 c500f2e8f47a11129114ee4f19524aee8fecc502
SHA512 f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28
SSDEEP 96:20Az7xzQK8VzRZfVAxzPXRQjpqp/lSPxIjfiI7yOo8S8qQk:/Az9zozrdAZPXR6qOPOvO38S8qQk
TLSH
T127A1351D035654B899BCC26C722C45B326CC9273A76338996ACEC76C4FA714BB3B7550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_danish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt
Size 4KB
SHA256 fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115
MD5 03b664bd98485425c21cdf83bc358703
SHA1 0a31dcfeb1957e0b00b87c2305400d004a9a5bdb
SHA512 4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d
SSDEEP 96:iKSCj4RjGEcH6RZY77p7zrOsLEPnvIBXKvI2BqOo8380Bg3:BJj4jGnH6rY77lrOxPnQoQmq38380By
TLSH
T190910C4E5B79A1BCC8BCC6ACB22E05A3559CA13BE2322C4911CDC32D1F9785773BB152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_dutch.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt
Size 4KB
SHA256 56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192
MD5 31a29061e51e245f74bb26d103c666ad
SHA1 271e26240db3ba0dcffc10866ccfcfa1c33cf1cc
SHA512 f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8
SSDEEP 96:TnsaIWCk1TXfSRkAcXJNRZY/r/iza1GUNrzRxbM4x9yJs+Xc1AZqI79qIjiOo8nl:LsaIVATvycZNrY/KQyJs+ZZz79zji38l
TLSH
T17D91D15F136EA1FC89F8C2ACA90D42E7298DE2329227594C15DFC63D0E57417B2F61A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_english.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt
Size 4KB
SHA256 ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6
MD5 da6cd2483ad8a21e8356e63d036df55b
SHA1 0e808a400facec559e6fbab960a7bdfaab4c6b04
SHA512 06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925
SSDEEP 96:hSlb0IG997a8ICgARZ2pyUBnXPz5dc6LzIIivI/BxkHLs068:8lHmbICgAr2hJc6LkIiQ/DOLsV8
TLSH
T10F81BD6E072A71F185B1E57C760E0AD3998871BBA3221D5826DEC21C1F9711B63FB361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Core.dll

Path C:\Program Files\SteamTools\Core.dll
Size 657KB
SHA256 0efd139f4201aea356b6baddb159534badfeb388bb7dd54ee9d614f166cc64a2
MD5 a0f3f5d8aedd622aaebc9251e10c15ed
SHA1 271d2c2362f979d47b79acee65cc4ef7b152343e
SHA512 5788813567c26c8a70f6a4369085790a49c44c02a706d7b5bcec68b98ba773598840bd57068aef34fa4c0a25ee5305ce7293335921e33fd25f92c664eb4dd72f
SSDEEP 12288:JuigyYF+iXvJAarykqB4YbiKxXiVncYNCdJqgmVKcfK12:Ju7LciXBAaTe4JKxXiBREdJNma0
TLSH
T17DE48E56B3F400B9D5A7C138CA534517E7B3B4551320ABDB07A09ABA2F23BE1673E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\SteamTools\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\SteamTools\Qt5Gui.dll
Size 6.7MB
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
TLSH
T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files\SteamTools\Qt5Network.dll
Size 1.3MB
SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
MD5 3569693d5bae82854de1d88f86c33184
SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
SSDEEP 24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
TLSH
T168556C67B3A142E1D56AC139CA5BCA03E672700087665BEF1279CF592F737E2263E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files\SteamTools\Qt5Svg.dll
Size 322KB
SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
MD5 03761f923e52a7269a6e3a7452f6be93
SHA1 2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA512 de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP 6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
TLSH
T1B0642957F3120896D927D27CCA9B8916E6B334100363DBDF022A8A5A7F237E17A7D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\SteamTools\Qt5Widgets.dll
Size 5.2MB
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
TLSH
T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamTools.exe

Path C:\Program Files\SteamTools\SteamTools.exe
Size 1.7MB
SHA256 992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa
MD5 9ab2a4fa1b4da8db2e102c0fcba6e5f0
SHA1 a1b85c90f9f3717570448bab83d9ba103cb31a13
SHA512 acd2445a4351e9a1e04caa574631ae8480386d411adbd7b74af24085c85fcdc487f0f90432e496b3fe47258d6bf21a74c1f9f001b006ad4912c4e432129eadbb
SSDEEP 24576:X5vF+/wYyf1jXjBHT0SMSnVpcZuphOH7q9r/bWYAo3P:5F+/wYU1jtIKKZupaqhz0E
TLSH
T1BF857D0BB278C1FDD067C179C51A9A0BDA717446172196DF22908AA53F33BE21E7F368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Program Files\SteamTools\imageformats\qico.dll
Size 37KB
SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
MD5 a9abd4329ca364d4f430eddcb471be59
SHA1 c00a629419509929507a05aebb706562c837e337
SHA512 004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756
SSDEEP 768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
TLSH
T1BA038D67E72904C6E227CB39D1524A27FA31F5219B92CBCF526686590F237C23D7C398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\SteamTools\msvcp140.dll
Size 612KB
SHA256 86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
MD5 ba72c2f6f465926980adc2fb7f8b3490
SHA1 63de0e3c14d0f45c1edab1c3ecd4adfb78ee8cdd
SHA512 05136a8dde4359efd112341b12e0545accc8d018e4fa7495b071197833a0227bd50879d7753b61582505b8e2286f845604008bd2020e689e148037a9ef7d7474
SSDEEP 12288:lOpw3ob/5jh6lN0RXhsdufjqDZZX/t5xTOKGmm75s79s8gywMQEKZm+jWodEEVo+:r3ob/5jh6lN0RXhsdufjqDZZX/t5xTOh
TLSH
T173D41A27AB5905B4E052E378A1C78711D7F1BC058322E3C782A6E27D2F673D5AB3B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files\SteamTools\msvcp140_1.dll
Size 30KB
SHA256 af589d441cd97638b1a0b9192a4014c52b64b35ecf5437caa65f27b3583e07aa
MD5 18a6c1a3d630dfcbc227082d5b06681a
SHA1 6634a25660e5843cf7fba6dc09b9dfcb698432a5
SHA512 5716e41de4f2ed7fee286c898411d99e11392f60df91b2423539c51016a7b9a12945087e6d1a47256c084ceb06556334ef03e34a8647d704582abe5745292581
SSDEEP 384:NlKX7EGOdlBJkQhnlVI/GD2Wcg53Wco+F0GftpBjLHc4HRN7hlI5e368:nKoBJkQhlVl3v+ixBIe68
TLSH
T132D25B86FB6C8983E8535C7092A5CE83BC3DF3C25B21965B1265E29D1CE37D0AB34619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\SteamTools\platforms\qwindows.dll
Size 1.4MB
SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
MD5 4931fcd0e86c4d4f83128dc74e01eaad
SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d
SSDEEP 24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
TLSH
T1D4658C57A3B54299C26BC23DC64B8B17D6B1701503219BCF01A98E597F23BE3277EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\SteamTools\vcruntime140.dll
Size 83KB
SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
MD5 0c583614eb8ffb4c8c2d9e9880220f1d
SHA1 0b7fca03a971a0d3b0776698b51f62bca5043e4d
SHA512 79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
SSDEEP 1536:ikqwmvKrSgB91BDJ25Tg/G0G5r4Gt7qNBPS9DH6ecboHjPxu+dBsi6:i3CuavtckJSVqNBPSUecboHjPx/O
TLSH
T15A838C4567E802B6E06B9130C0E28E47FB76B485877047DF037A56AE1F53BE18B3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\SteamTools\vcruntime140_1.dll
Size 43KB
SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
MD5 3b22b2ec303b0721827dd768c87df6ed
SHA1 86f8af095cf7368ccbff2d0fd6d33586145acd2b
SHA512 79db774980ee132797f7e7dbc0e055b724d8fbf0e4917523b285f918730adfff81022cc6f5e15469b011d55501fd7b085bc070e9ecdfb75c05f4d6622a7f2475
SSDEEP 384:GRiuauREnUUWU55vZvS05fJjPg2h1RWmbzA+XfAXxy85xH0f9lWrGKWVQRpBj0HP:DJnUUV7xPg4RdPvv2DHkR+W+1CP
TLSH
T1F6135B54977C8486E56B85B0C4A2CF27FE39F6925710928F0B65D29C2E537C0E73D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 83afbe71430a4287d0a1cd2f641c6e55b47322121f1a043d3048b8f758a94d97
MD5 24c7685d186d53435d3a2b39d775099d
SHA1 634e481177a93204c9e60c336fddd6de2516f9bb
SHA512 8488d3e6a9420da631fbcb3e6b6168fc2cc0460d7055a0f0255da2c58b36e71d5dd24d27d4eabda9fcf749ca140b34ff0098073cc37cadb39edf11e9ec639f6b
TLSH
T1D0E0E56AC825E83B18FE072870504705EE9013162A90894F7E3D86188FB463B4286C9D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ae11ff9590a6483b20aa11af1443041fc90a133d96897e3ca303463aeb8be0ac
MD5 d976916f80bd88456b765a2d44854899
SHA1 95faebf2ed4e52800f4bc01f08a093a9421f568d
SHA512 11e0c0c30339936143baa78a37a6fc7e51353356dbb4d986827ffced479578209323b5cef65f84348727e27a16f07b833ff8b809f795380485e69ec73deb38c9
TLSH
T17521C79935EE8C98CFB871F411517D8222551F041AE53F07B182BB20CC3FC9AD6868B3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 45cea958818cba053249db28856fd00088aaea310a280bb752ce2a975b1240a8
MD5 b1918671339a095da3f3305bb38f7a0e
SHA1 9fc7abb5e153bb26a3de8e4d0858847b636cf503
SHA512 d6fac527203e98417e91aa88c7d814b0cc719ac987a8f5721a00b6b3ff6f3050dc67a1cb4ed828e5c38146b6739455dcb804856a58b6a25c262c52426d59a220
SSDEEP 96:DGKI/7yaIapTztAKsHbDkLrNoMuYIgmgTHJor:DGKI/7yaIapTxAKsHbDkLrNomIgmgrJ2
TLSH
T185C18BF7C3E4852DD95196F4EB156E2FCE290914436C3C66C8E8AF1B53E2872E20179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 851B
SHA256 062b602cd88d4b2bb70a29145348636da1e40e7d648d019dff2759e0f11f51ac
MD5 2b40d1322532a9e7df1d9af314387e5c
SHA1 d2bfbd514d4c3539c50a032c3c3d22095288c69e
SHA512 715aadf14408c91b78ecef0edcfbd476e2ffe17c1a7cb164fcfc87be1311043d47bbe01f937789e495b308017f11f29b767d7d7251d2bc34120cdcb126f7c905
TLSH
T15A01AFABA77E7C17107C45BB2E05BC0655FEA83042D27CF5CEAA816C70D05F70B12856
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 876779b13f48aebb50177641a44cc73f3eeea5a91bc47ee7939434357f8c7303
MD5 2b169e2f070dfdac2a972e7c270f4e03
SHA1 73665aa8c9ded41f59c7b1f9ea17fdaa4ac4f369
SHA512 779cc929f0fa4a403a2b6a742bdc1ab36cbd94609824c6d5d0e191f019a98e4eb34dd80be4b9d8307a73277c4521da4f933b340864158bd6a16602f73d03cf67
SSDEEP 192:wRNFcBzWeB2Euan4/mn/f3xetua4lv7pFhAPRp2b8sY9YHsb+WNhuM2D4Qp2wbMq:wRfmzWeEE9pb8XBOwhQR2OMt8
TLSH
T1E152C52DB954397B4CDBC229FD21BB07E6F2102164942E88EEFC891C18E79CE7117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 75b121981ce1914097de658bcb6008e63265d8711025ed111226d02da699bd7d
MD5 1381db3e0f10bfa503675f2904d5a713
SHA1 94699fc8492138aa08b47c225615004362a83821
SHA512 bb79852f70eb12b9ab16611b4c3ff8fd428cf58701702f0a5f45037a2debacab18a1b8467d1a656bd7f17d9185da01a82557b334c0a0fb9977f58cc43160cd61
SSDEEP 192:wRNFcBzmeB2Euan4/mn/f3xetua4lv7pFhAPRp2b8sX9YHsb+WNhuM2D4Qp2wbMq:wRfmzmeEE9pb8XWOwhQR2OMt8
TLSH
T1A352C52DB9543A7B4CDBC229FD21BB07E6F2102164942E88EAFC891C18E79CE7117417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 21e81c420f3d017ae32c8b64d4e6d75c94b8234e6b16495dd8068581d8c1d8ae
MD5 00354c26d974dd37c82892cc4543401d
SHA1 998a31960482acf892a8127374d96c3a440e9e8d
SHA512 002a30061d299c004f2cb1f953a686553784e46d60be4a0ead8a5803cc85dda5c5d4c62a1b8c130db4c0b1023316a356061b53cd0cdbc9a204299c12d96f29e7
SSDEEP 384:OEjql7KxkXqKf/pUZNCgVLH2Hfgsl817pLuLcifMtXODql+ErU3HtHGDu9P:OIql7KxkXqKf/pUZNCgVLH2Hfgsi17p+
TLSH
T1BA72FA676C4C9E770F94C9CCD8267E4FADB5024B65DDC86482FA982A03D5ACF110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 925363eef57a859537314345aab32720271c04e4b15e2d85368534571f60968b
MD5 7417710bab1ed5c9097c5c4771ad25ce
SHA1 bbc4a6299fb14bf6cb2d3a76f85d548bbdad4ea5
SHA512 d5b18ce25d3dd96964f9a6f4789899103a03751f5ae8a4c148c29770b8bde6db78b2b92eb068deae7b93dd2284cdf689f846255240ae95a11ae483ca58dc2c55
TLSH
T1AAB0122090416601C04303F01183048D37545FA1C7061701A3E4A971D8265A14015560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59572e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59572e.TMP
Size 96B
SHA256 de360a008989f6748b11ce642385d27559e540406360a9df057bf8a8ac1df3db
MD5 1159cf94315ca64c91f6b810fd96483b
SHA1 5f92c1c8dd4bbba00a51f0649d38bd0c98d7bfc4
SHA512 db6f2ce965fd32ff753f2dcea48d2897bfc42e8153b345bd87d11fdf89c190430669308e703940111df0ada161f79f93d2e1e3250dbf16cb26fa719de8be201c
TLSH
T1ECB00295D5126253C09303F02595A5EB76A0EF76CE131213B2E01E66DC29B754626574
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 185KB
SHA256 50fa271ff3d7cb0b346993d7c4984d149444c34160e071712579377b7f42739a
MD5 e2e1ce2083e666c03d902da735e517ee
SHA1 1a0d7ee3ea168fb5da49c6c610e32783e4efc84a
SHA512 9ed59265a6d0d9361571c736688fd2a6a8990c358144764f71d070df96bbb7d2d4261dbfc4dbd2123e2683d5fed80bc1d3ccac0368c7b2c7bbf2fe78a73cad49
SSDEEP 3072:lE6Zx6ukiacqgm7UUQ+xSRmMCxe76++J3qUQm08KMWF0bFTcVHr6z3:l+1ckAv6MTuz++JjcMW2VcVLA
TLSH
T1540422A70C2F7CA601BEC2C55407AD9C85A2489E681188F871C6EB5D39EE3D376139F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 185KB
SHA256 2124b8af31b5fe703294be4c406f9de444e4e12b290ef73c77bb28b9661b0ba6
MD5 6e324b20f1e6051e0fb012ad1cd4fec0
SHA1 a56f1bedeef030e3b03c695530a48242d2872973
SHA512 0de847798353c5b531b596ee15837ddb338a44c594da981a1aea36e98aef28219e34b2530c787b8990fe84b71523ce7ef33ade5a511d35b0a08c27d076e98eb3
SSDEEP 3072:JE6Zx6ukiacqgm7UUQ+xSRmMCxe76++J3qUQm08KMWF0bFTcVHr6z3:J+1ckAv6MTuz++JjcMW2VcVLA
TLSH
T1510422B70C2F7CA601BEC2C55407AD9C85A2489E681188F871C6EB4D39EE3D376139F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 87990e52f9afaf2ad49ea608e3ffad2dc5452c9b64248136eecd329fabda2ab6
MD5 15d8cb50b9a46c6522e9c20d87dd6e41
SHA1 971f47182ed85ef3b9ed77e4ae1ff8ac19bbb1df
SHA512 097c6e217eacc5d50049c6211332108e5b89b4e403bd9103d0860bd353c9fb1869812f7e5ed97a0f4e55baddfcd8b2be48ebc2d2ea95e78f8f801e666b00c3ef
SSDEEP 1536:SNP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNz:m++J3qUQm08KMWF0bFTcVHr6zo
TLSH
T1A29302B9991EBC79636EC69690079CAC4CE39CDD151014BC30C65F1E18BA3A3A34B8E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl46F8.tmp\System.dll
Size 12KB
SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
MD5 67fc1324e53b1f3854557f23b0c22654
SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
TLSH
T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsl46F8.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl46F8.tmp\nsDialogs.dll
Size 10KB
SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
MD5 b9cf10930a5144fdda9479613ee3c84b
SHA1 5110556ff6ed1559c73cdd444f6e2408db570653
SHA512 bb9947763fea6915e90e662438d1247678576ff944f9918dcbb0c93d669f8a0dd7dd60db95f53e52faf1e0d3d627789cbcd6196441113556acaa6711b6b6f350
SSDEEP 192:VvvwccHJBa8oStSigfl6dblJDBUorNuCjLUoaTOt37Eezqm:VvvwVPa8oStSTUDiorNRjwoT7EeWm
TLSH
T15C22E85BFAA4D2EEC4974136D5BB5B06CBB170125692DA4E0B3096897F233433A2D74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsl46F8.tmp\nsExec.dll
Size 6KB
SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
MD5 cf0cac49c427a501d7806033941a6da1
SHA1 92acf906cc962b7e4c4138aac8ecec67c9629b4a
SHA512 7ad31611d7c0657d70318c16c781b7da793c8a19e4dfafcc90abcd4c8eb0dbad3aacf643b558b573502e50f504bb9f384b4df95f0db840e68763f03a7d8e85d6
SSDEEP 96:wC66T7ItPQcwPbfTA3Ck3lKYHxFYSdt4RTUR+4nz:dT7+EEjje4
TLSH
T15CD1CA2AA7C102A8C82F51F0A93F4A07EBA5308125785A3F2A688C0E4F53AF1737C745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw60F4.tmp\System.dll
Size 22KB
SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
MD5 a36fbe922ffac9cd85a845d7a813f391
SHA1 f656a613a723cc1b449034d73551b4fcdf0dcf1a
SHA512 1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b
SSDEEP 384:V8QIl975eXqlWBrz7YLOlE/NyQH38E9VF6IYinAM+oZ5a1TN:VgPgrfYLO+rMEpYinAMxZG
TLSH
T198B29D6346105CB2DD478834B4C9B936AF7536439AE0CAD39396C1119F607C37EBC267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw60F4.tmp\nsDialogs.dll
Size 20KB
SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
MD5 4e5bc4458afa770636f2806ee0a1e999
SHA1 76dcc64af867526f776ab9225e7f4fe076487765
SHA512 b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162
SSDEEP 384:ABSzm+t18pZ0WAg0RhIFgnGNyQH38E9VF6IYinAM+oZfNRoZk:NupZ/Ag0/T8MEpYinAMxZ7oW
TLSH
T11EA26CA385542C33CE874E3635D8653EDBB9731664808CC25326C24197A439B7FB83AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw60F4.tmp\nsExec.dll
Size 17KB
SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
MD5 2095af18c696968208315d4328a2b7fe
SHA1 b1b0e70c03724b2941e92c5098cc1fc0f2b51568
SHA512 60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5
SSDEEP 384:PbGgezxEqoyGgmkNFNyQH38E9VF6IYinAM+oZhc3iMy8:T31yGLkbMEpYinAMxZAy8
TLSH
T1DE826CB749802C66CD4F8D7039D4A83A5BB9BA531BE0C1D2535BC2518B917C2FFE82A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsw60F4.tmp\nsProcess.dll
Size 15KB
SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
MD5 08072dc900ca0626e8c079b2c5bcfcf3
SHA1 35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA512 8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c
SSDEEP 192:WUl64IGsjDNyQDbnPvy2sE9jBF6IYiYF8pA5K+oZ7W76OCwy9GUe:5ZsNyQH38E9VF6IYinAM+oZYsBe
TLSH
T1E0726BB38A582C21DE4B4D3171D4853AAEB9AA571AC0C1D3634BC1518BC1BC7BBF82F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier
Size 147B
SHA256 51aaa7f351f7c389bb989a1ad21ff64ba36c34e70a6e0e94040b6b05de30c4f2
MD5 96cc35f9c335e5d36087e266e777167b
SHA1 287b2312525e0e481580796145dd09c36470de94
SHA512 df4834206f7e5f834b80997c95bef560745e2113dfb8b8477324d55ba1986ba774c325a09e2fb811d91960ca157a0bd284645ee638789ee7bb0442832ed0a2e4
TLSH
T116C08C9A440484380F4823D828DA855EB84E748A08985590F88163869C01260826D106
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 91939.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 91939.crdownload
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
TLSH
T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/584-506-0x00000000012F0000-0x00000000012F6000-memory.dmp

Download

memory/2376-78-0x00007FF82A460000-0x00007FF82A9A1000-memory.dmp

Download

memory/3364-17-0x00007FF8440A5000-0x00007FF8440A6000-memory.dmp

Download

memory/3364-18-0x00007FF8440A0000-0x00007FF8440A7000-memory.dmp

Download

memory/3364-59-0x00007FF8440A5000-0x00007FF8440A6000-memory.dmp

Download

memory/5264-497-0x0000000000CD0000-0x0000000000CD6000-memory.dmp

Download

memory/5568-626-0x00000000009E0000-0x00000000009E6000-memory.dmp

Download

memory/5568-627-0x00000000050D0000-0x00000000050F5000-memory.dmp

Download

memory/5568-6942-0x0000000000C70000-0x0000000001122000-memory.dmp

Download

memory/5568-6944-0x00000000050D0000-0x00000000050F5000-memory.dmp

Download

memory/28284-6969-0x0000000001280000-0x0000000001286000-memory.dmp

Download

memory/28284-6970-0x00000000057E0000-0x0000000005805000-memory.dmp

Download

memory/28392-6951-0x00000000014C0000-0x00000000014C6000-memory.dmp

Download