hxxps://github[.]com/97-42/steam-for-school

Analysis

user interaction
yes
max time kernel
227s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/97-42/steam-for-school
Sample260415-mppdzaey4y

Score

9^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Renames multiple (6118) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 1 IoCs

flow	pid	Process
156	2244	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Executes dropped EXE 22 IoCs

pid	Process
4092	SteamSetup.exe
4168	steamservice.exe
4464	Steam.exe
4968	steamservice.exe
12360	Steam.exe
12564	steam.exe
13624	Steam.exe
13832	steamsysinfo.exe
13900	steamwebhelper.exe
13948	steamwebhelper.exe
14092	steamservice.exe
14256	steamwebhelper.exe
14380	steamwebhelper.exe
14396	steamwebhelper.exe
15216	SteamServiceTmp.exe
15268	steamservice.exe
15828	gldriverquery64.exe
15872	steamwebhelper.exe
16112	gldriverquery.exe
16136	vulkandriverquery64.exe
16196	vulkandriverquery.exe
16904	steamwebhelper.exe

Loads dropped DLL 64 IoCs

pid	Process
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
12360	Steam.exe
4092	SteamSetup.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13832	steamsysinfo.exe
13832	steamsysinfo.exe
13832	steamsysinfo.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13948	steamwebhelper.exe
13948	steamwebhelper.exe
14256	steamwebhelper.exe
14256	steamwebhelper.exe
14256	steamwebhelper.exe
14256	steamwebhelper.exe
14256	steamwebhelper.exe
14256	steamwebhelper.exe
14256	steamwebhelper.exe
14256	steamwebhelper.exe
14256	steamwebhelper.exe
14396	steamwebhelper.exe
14396	steamwebhelper.exe
14380	steamwebhelper.exe
14380	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
155	raw.githubusercontent.com
156	raw.githubusercontent.com
150	raw.githubusercontent.com
151	raw.githubusercontent.com
152	raw.githubusercontent.com
154	raw.githubusercontent.com

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_74B0F1158CF3BBDE3B65AF739E904359	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_74B0F1158CF3BBDE3B65AF739E904359	steamservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\btnDisTopLeft.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_m3.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0421.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0331.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_button_steam.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_dpad.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_button_x_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\2916.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_m1_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_lfn_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_button_x_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_090_media_0302.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\avatar_184blank.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_lstick_right_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0220.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_050_menu_0050.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\hp_m2_md-1.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_dpad_left_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_l4_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_gyro_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0305.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_050_menu_0060.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\desktop_ps4.vdf_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0329.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_040_act_0335.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\flag_left.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_thai.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_trackpad_r_click.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_color_outlined_button_square_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_button_x_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamui_portuguese.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_lstick_down_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_r_down_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\gameproperties_dlc.res_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_030_inv_0323.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamclean_french.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_m4.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0427.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\NotifyTrayHintDialog.res_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_rt_click.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\chord_ps4.vdf_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\3518.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0405.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_l_touch.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win64\locales\zh-TW.pak_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0451.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0330.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_lstick_right_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_up_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_rstick_touch_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\locales\fr.pak_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_lstick_up_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\sounds\recording_start.wav_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdRight.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamui_vietnamese.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0300.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0313.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_gyro_pitch_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_l_up_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0341.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_button_share_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_l_right_md.png_	Steam.exe

Access Token Manipulation: Create Process with Token 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
4968	steamservice.exe
14092	steamservice.exe
15268	steamservice.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2244	msedge.exe
14380	steamwebhelper.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Steam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Steam.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamservice.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	steamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	steamwebhelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207231253576660"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	steamservice.exe

Modifies registry class 57 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-721190819-434563495-2007910846-1000\{FD53A675-BBD0-48C6-8113-225E77376543}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	steamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	steamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	steamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	steamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Steam.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
4092	SteamSetup.exe
12484	msedge.exe
12484	msedge.exe
13624	Steam.exe
13624	Steam.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
15268	steamservice.exe
15268	steamservice.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe
13624	Steam.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
13624	Steam.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4168	steamservice.exe
Token: SeSecurityPrivilege	4168	steamservice.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeSecurityPrivilege	15268	steamservice.exe
Token: SeSecurityPrivilege	15268	steamservice.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe
Token: SeShutdownPrivilege	13900	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13900	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe
13900	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4092	SteamSetup.exe
4168	steamservice.exe
13624	Steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5444 wrote to memory of 1044	5444	msedge.exe	86
PID 5444 wrote to memory of 2244	5444	msedge.exe	87
PID 5444 wrote to memory of 2988	5444	msedge.exe	88
PID 5444 wrote to memory of 2988	5444	msedge.exe	88
PID 5444 wrote to memory of 2988	5444	msedge.exe	88
PID 5444 wrote to memory of 5636	5444	msedge.exe	89
PID 5444 wrote to memory of 5636	5444	msedge.exe	89
PID 5444 wrote to memory of 3464	5444	msedge.exe	90
PID 5444 wrote to memory of 5524	5444	msedge.exe	91
PID 5444 wrote to memory of 3464	5444	msedge.exe	90
PID 5444 wrote to memory of 3464	5444	msedge.exe	90
PID 5444 wrote to memory of 5524	5444	msedge.exe	91
PID 5444 wrote to memory of 5524	5444	msedge.exe	91
PID 5444 wrote to memory of 5092	5444	msedge.exe	95
PID 5444 wrote to memory of 5092	5444	msedge.exe	95
PID 5444 wrote to memory of 3488	5444	msedge.exe	96
PID 5444 wrote to memory of 3488	5444	msedge.exe	96
PID 5444 wrote to memory of 5084	5444	msedge.exe	98
PID 5444 wrote to memory of 4408	5444	msedge.exe	109
PID 5444 wrote to memory of 6108	5444	msedge.exe	110
PID 5444 wrote to memory of 2840	5444	msedge.exe	111
PID 5444 wrote to memory of 948	5444	msedge.exe	112
PID 5444 wrote to memory of 948	5444	msedge.exe	112
PID 5444 wrote to memory of 5460	5444	msedge.exe	113
PID 5444 wrote to memory of 5460	5444	msedge.exe	113
PID 5444 wrote to memory of 4404	5444	msedge.exe	115
PID 5444 wrote to memory of 4404	5444	msedge.exe	115
PID 5444 wrote to memory of 5516	5444	msedge.exe	117
PID 5444 wrote to memory of 5516	5444	msedge.exe	117
PID 5444 wrote to memory of 1756	5444	msedge.exe	118
PID 5444 wrote to memory of 2872	5444	msedge.exe	119
PID 5444 wrote to memory of 1756	5444	msedge.exe	118
PID 5444 wrote to memory of 2872	5444	msedge.exe	119
PID 5444 wrote to memory of 2872	5444	msedge.exe	119
PID 5444 wrote to memory of 1980	5444	msedge.exe	120
PID 5444 wrote to memory of 4092	5444	msedge.exe	121
PID 4092 wrote to memory of 4168	4092	SteamSetup.exe	123
PID 5444 wrote to memory of 12248	5444	msedge.exe	130
PID 5444 wrote to memory of 12248	5444	msedge.exe	130
PID 4464 wrote to memory of 12360	4464	Steam.exe	131
PID 5444 wrote to memory of 12484	5444	msedge.exe	132
PID 12360 wrote to memory of 13624	12360	Steam.exe	136
PID 13624 wrote to memory of 13832	13624	Steam.exe	137
PID 13624 wrote to memory of 13900	13624	Steam.exe	139
PID 13900 wrote to memory of 13948	13900	steamwebhelper.exe	140
PID 13900 wrote to memory of 14256	13900	steamwebhelper.exe	142
PID 13900 wrote to memory of 14256	13900	steamwebhelper.exe	142
PID 13900 wrote to memory of 14380	13900	steamwebhelper.exe	143
PID 13900 wrote to memory of 14396	13900	steamwebhelper.exe	144
PID 13900 wrote to memory of 14396	13900	steamwebhelper.exe	144
PID 5444 wrote to memory of 14924	5444	msedge.exe	145
PID 5444 wrote to memory of 14924	5444	msedge.exe	145
PID 14092 wrote to memory of 15216	14092	steamservice.exe	146
PID 13624 wrote to memory of 15828	13624	Steam.exe	151
PID 13900 wrote to memory of 15872	13900	steamwebhelper.exe	152
PID 13900 wrote to memory of 15872	13900	steamwebhelper.exe	152
PID 13624 wrote to memory of 16112	13624	Steam.exe	153
PID 13624 wrote to memory of 16136	13624	Steam.exe	154
PID 13624 wrote to memory of 16196	13624	Steam.exe	156
PID 13900 wrote to memory of 16904	13900	steamwebhelper.exe	158
PID 5444 wrote to memory of 17608	5444	msedge.exe	160
PID 5444 wrote to memory of 17608	5444	msedge.exe	160
PID 5444 wrote to memory of 18124	5444	msedge.exe	161
PID 5444 wrote to memory of 18124	5444	msedge.exe	161

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/97-42/steam-for-school
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffccd06c188,0x7ffccd06c194,0x7ffccd06c1a0
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,7293366054928046427,12448619820678770761,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,18337677735482566607,8977729090426931503,262144 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,5886316630012688445,8002259859637450959,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:8
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,1111829230213552273,1255666049616869095,2097152 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,3314143837643915060,3706006617192090217,2097152 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,11456288376481803790,16526491644026869953,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4744,i,8612153165701597766,4621057960826233492,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,12515420347522320651,5080072226168920701,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,12515420347522320651,5080072226168920701,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,4683006395196757643,15578804174058359894,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,2722500681482009067,16668457507144394671,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,12956788455235618463,14861213927824988134,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,8128703212511252395,4793423338709489297,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,6323232000743524756,2233285106311075064,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,16491526474309777533,6652423240414653924,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8605216526022454376,16491163948950459373,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,17071142244578870623,12726542500889925212,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6340,i,2891510075174118488,5106189167857443052,2097152 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,12130431909665552833,13818428987684101254,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:1980
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,10991604220331833338,14379131114700357885,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:12248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6752,i,16225795966786887011,14634036090789760803,262144 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:12484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,14957367720209334530,4572853663528697584,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:14924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,12853372900105806163,12901163418248866475,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:8
  2⤵
  PID:17608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3324,i,15600543769185424375,15602872247648664410,524288 --field-trial-handle=2288,i,9751220916612556537,11467023508240659396,262144 --variations-seed-version --mojo-platform-channel-handle=1012 /prefetch:8
  2⤵
  PID:18124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2260

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\steam.exe" -silent
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Steam\Steam.exe
  "C:\Program Files (x86)\Steam\Steam.exe" -silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:12360
- - C:\Program Files (x86)\Steam\Steam.exe
    "C:\Program Files (x86)\Steam\Steam.exe" -silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:13624
  - - C:\Program Files (x86)\Steam\steamsysinfo.exe
      "C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1773426488 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\74A5.tmp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:13832
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=13624" "-buildid=1773426488" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:13900
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1773426488 --initial-client-data=0x27c,0x280,0x284,0x278,0x288,0x7ffcb4c8af00,0x7ffcb4c8af0c,0x7ffcb4c8af18
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:13948
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,2600299350704497010,18289331772441626093,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1924 --mojo-platform-channel-handle=1912 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:14256
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2196,i,2600299350704497010,18289331772441626093,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2264 --mojo-platform-channel-handle=2244 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:14380
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2312,i,2600299350704497010,18289331772441626093,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2332 --mojo-platform-channel-handle=2328 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:14396
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4084,i,2600299350704497010,18289331772441626093,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4128 --mojo-platform-channel-handle=4124 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:15872
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=4764,i,2600299350704497010,18289331772441626093,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4856 --mojo-platform-channel-handle=4852 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:16904
  - - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
      .\bin\gldriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:15828
  - - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
      .\bin\gldriverquery.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:16112
  - - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
      .\bin\vulkandriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:16136
  - - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
      .\bin\vulkandriverquery.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:16196

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
PID:4968

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:12564

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:14092
- C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
  "C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update
  2⤵
  - Executes dropped EXE
  PID:15216

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:15268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520 0x50c
1⤵
PID:15728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:17096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SteamService.dll

Path C:\Program Files (x86)\Common Files\Steam\SteamService.dll
Size 3.5MB
SHA256 7b6730263a0ee9fef1e1bd9a0a05a7f952f843af0412151e5f2cda835819fcca
MD5 2d46c9bac2c0539db39464feff39bbe7
SHA1 07d9b4516920d5ac765b51f09006e98abd7f4061
SHA512 45449b5bc2df8916d390665cae44e2984a1778ef1b71fd566aa4e62b5b33a5d824678af8f59c9b120555ffa48902b9a73a05468a05dc9701ae3a39c1edf9f03e
SSDEEP 49152:bMHZqsw40iZpixOZNpGXakoSGxphGXRRswSWL+2+121tPcJRJ+jdyJBjdehkh2Oj:bMHtZpigZNpEakodxGBywSl2+miJRJsi
TLSH
T18B06BF12FA42C171E89E02B5647F9B7E597DAA204738C4C3ABD42D699C701E33B3B356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamServiceTmp.exe

Path C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
Size 2.8MB
SHA256 eeed0d75b1e5f4bd1370d1a046a59830809f942ea923c3c6661636bfbddb0c19
MD5 fef2e712973ce9ceb729088cc371fe71
SHA1 d189666ec917978d4ae66e5e4d1582e5bffe50b4
SHA512 3fa2df2a690c7841d50987dafaaf6bef6659fe3192600656f9350cd13bb5a183031b1b76f081d14dbd3ea400728858e628e78404decba697f96d0b5d9b6b3fe0
SSDEEP 49152:QyvvpZKgLzjeDfXHnUGXy1+BZ+Z1hV9WEXetPrja45kmyNF2URsu+T6cMg:QyvhvcfkGCw4ZbV9WF9jaBmR
TLSH
T1B9D5AE12FA4148B9E9D31174E2EF577A4A396F20033588C797D03FA998325D2BB3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuidsdk.dll.new

Path C:\Program Files (x86)\Common Files\Steam\cpuidsdk.dll.new
Size 3.2MB
SHA256 f4bb9d0c583292ed099ee80e8ea3a5698c29d348e92b165d9577100029b9c940
MD5 447d5ee3b1d4312f589091ffba693909
SHA1 29640faf3ea00c8521091c4019890f2c700d11c1
SHA512 ab89790256848234b75efa151eb8b0dd1f739465beb2bc9e0152dda4a1de681b60323b1efe93b1cc1b838b839c8250b2471ea40f5bcb2263845f945c6fdd6d6a
SSDEEP 24576:a0PWQrf/gfY+Q9SzA7hgR8RleZXDhuy5DOTuBwK5LMY5OpTbMQRFifjysvmJbwjV:VVozA7SzwUKmi+jysvVroZ0yTqlDh
TLSH
T160F57D55B7D84CF1E5AA1A3203AAEF180F7ABA50873586EF26D41A4D2D318C0BD3D357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashhandler.dll

Path C:\Program Files (x86)\Common Files\Steam\crashhandler.dll
Size 382KB
SHA256 bad79c49530aa12093919a58e5d9bf9847d33b406d97d14d896e9108125a722a
MD5 7f5440715325a3a733a98b921e4d17e1
SHA1 6eb76ae8fc580166b2bd94ab5cbfc5821d25b4c9
SHA512 54ce21e99b08800627d27829617b21586f26e726fdbf5ae005e69e27b6e6795e14cd891900076835a96b8bfb79d1d50799253257f2988f028bad9b0ba21a3936
SSDEEP 6144:fVzeklWbcrcFvCQ1RjguJ5d0Tjvk2NbQHdwefw6PvRw6AOfjZE6+/4mu+:ZjlWbcrUvDfguJ5d0Pk28pa6NjZA/b
TLSH
T14E84BE11F4D1C072D97E24307878AB7A5A7DB9600F6569EBE3C80A7B5E302C29735B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.exe.new

Path C:\Program Files (x86)\Common Files\Steam\drivers.exe.new
Size 7.2MB
SHA256 9daf97b4123452c29e1b9b1cb9b9e56e68441e4e2cb979b926c2c120e64ed404
MD5 54442b65334fdde3cc24aa820783bb27
SHA1 1ec6c20b13da27cc50e98c54648904f84670924c
SHA512 a144764f9c766c6ba3f9de526dae35b181351c0010fa95695c2b0a9139b87d3eb9dc247f43bf6d552584c9cf87986f222653a291a66c462bc667587e03ae133d
SSDEEP 196608:8mwHw/Az0Z4TvgYWMkaVv/Az0Z4TvpoJ3YWMka4:8mwBzWGvDWMezWGvuJIWMY
TLSH
T1417623657A450EBCEBF1BA38E7DD432513A81D9206B798CF13D43F893936D43B99A081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secure_desktop_capture.exe

Path C:\Program Files (x86)\Common Files\Steam\secure_desktop_capture.exe
Size 3.7MB
SHA256 6f156764844137da0ac76e1195abf68cc119fbee28e2ed48c54ae457ded92c04
MD5 026656c2f5fc838d7ee0e4c11738fa04
SHA1 b7b9ab4517743eb71e136132f89ba22fbab11ff3
SHA512 410056b960e7427f08267492105532bf734f7c31727407843d33c22907928d3b631e78629f2a1a512c9d7409be8d4be7d8097dbcdabb3758db925173f6fea664
SSDEEP 49152:dGtlqCCVwASOa0IU6i3CSL9HGnFt6CgekOP1pku8wupzJyTeO6bxQNZB1B1rYjdm:gb+54FP1pkVHrx+0dHfX9nndlvmx
TLSH
T11B067C16666800ECD5B7D138D6CA5623E7B17C1613B09BCB02E4BB661F33AE16E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service_default_Public_versions.vdf

Path C:\Program Files (x86)\Common Files\Steam\service_default_Public_versions.vdf
Size 808B
SHA256 8f34aed61c3025a06ec920eed6b27744c5265b228797264ce3efd689002c9767
MD5 e9bd240971d1ef6e8a651f159e1f908b
SHA1 32aa6bd5fe0a6aa7207816c0118878be0b6c5db6
SHA512 88d53b6e16b05a4baab47b90ce0002031b66780d7230fd51675ab39dcc028fada7220b9d2e3aec15a0f7c751769e17cb33ce83325cf729b8396eeea06aaf01f5
TLSH
T15E01490FC8EBECF725624F6B2757D486CB76942B5E8628936B45211C9BF182C0F46A1C
MD5 SHA1 SHA512 TLSH

Submit Download

service_minimum_versions.vdf

Path C:\Program Files (x86)\Common Files\Steam\service_minimum_versions.vdf
Size 727B
SHA256 a75ecb06d45017d2289ec27dac9f418c6ef82a9352e012670a0c67161c25c52c
MD5 47ea8d10c7c8e5ab9259a6b164a9e2d3
SHA1 cdaedb2b5d5b937930eef504de997592e95f487d
SHA512 8b85dffebf9e21e436d48292fb3bce54e01b1470bc1fc7dabbee2233743c7025cd7c59523ffa1d0f1ca50d2b1edf7bb18787aa4df61d7dfec155323ae0eb1ccf
TLSH
T1DA01DC1FBCC2A8BA2BB2465B8BF78CCE6F780906549A3CC05D840C4893E8E1C1709045
MD5 SHA1 SHA512 TLSH

Submit Download

steamerrorreporter.exe

Path C:\Program Files (x86)\Common Files\Steam\steamerrorreporter.exe
Size 672KB
SHA256 49570d9d750228a9ee7362955166851540daa6029dc6dfaaeee4db81fdeba3b4
MD5 a50935d49f7e416b387a64275ce2600d
SHA1 ec6e48471bd2734086298c18ee1545e65dca46cf
SHA512 d0612ec236f02e3a84dc38405ad5324f45820950140d0c14723bdb8d986b45a88e72f9cc2365ccf6b750368dac138da8598dd11c5945e43eaa533c9697b70872
SSDEEP 6144:DoUH2gFv6lEZluhDmblgCA2warzg8XMNm2N/a2HPSvAOfxJEKsGER0u+GIIIIIIb:cUWovekluhDmsxog8wLSvN7om5L/VTEr
TLSH
T16BE419607901497DEBF07634EBED937513A92E91073754CF23D03F8A3932A83AA7A156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamxboxutil64.exe

Path C:\Program Files (x86)\Common Files\Steam\steamxboxutil64.exe
Size 753KB
SHA256 c05c5a24cd31875e01f18ca5227f717b0853b7bcd8baf18055ff3bba2ec5d598
MD5 89436cf9f8332acb660008e8c7c6e7ed
SHA1 566ac21ef9013292ce44d10cfe2546f63beaa42b
SHA512 503a01a3d6b6abb3741c1c740bfc5f39d6fa486ea2ee9ea4f1d7cd31dc490b11b6a574342be362cedaf56d13bff72d7abd1d653adc4efa8576917aecff34baf6
SSDEEP 12288:v6X+vW4eJ12w6sce05XlfIg3OJ/Ozim5S8:v6QW4eoe05Xlfzm/CimE8
TLSH
T1AEF41964660509FCEAE1B634DBCE5211D3B13D52023785CF13E07F9A3F37A62AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Steam.exe

Path C:\Program Files (x86)\Steam\Steam.exe
Size 4.1MB
SHA256 3caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04
MD5 b4411620a3551834e4f699cc5a9b27e6
SHA1 5093960cc86613e310d13770b5adef00fe93f3eb
SHA512 47dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024
SSDEEP 98304:dDokH1WPirCS6Ijt91p2GWNzSC34g2FiiIk:ttHSiJXGNNiE/k
TLSH
T13516CF52BB01C031E9D202B964BEAB7A197DAD204735C5D3A7D43D6D88312E33B3B796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamService.exe

Path C:\Program Files (x86)\Steam\bin\SteamService.exe
Size 2.7MB
SHA256 f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e
MD5 2de3f7cf6020b3bb6bc4199459a63016
SHA1 8a30e5e333a353eb069ab961a4c1918fcbb44623
SHA512 5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e
SSDEEP 49152:EmvpI/M4M2YEOpBGcCxutN8Lf6vMTC4gbZtPW3bwDlmTbCeieU8K9f2ywH:Emv+M2CGZxY8Lf6L4gdw3b6mT7
TLSH
T16FD5AE12FB4149BAE9D213B9E2FE537A0E396E50032585D783D03FE558326D26B3A3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 12KB
SHA256 3a74a4317a3fb1fca854196bdb470a67ad5ec232578feb3596370b4cfc41ebf6
MD5 65350684a823a04acdbaa585ef19cf97
SHA1 cd23beb77ca44f6017503e5ecc541d02d1461076
SHA512 ad9a751a1e4d7946bb2986b9b975f3874e2b48cc41fd6ab8e0bc49a7f8975bd094b0a80a7acdbe6e9b98eeefb624df5dad72235afc536177ea5921f73d3f2cf3
SSDEEP 96:Pl97rEeD99WUWp+wDuBNGBWSldb3Q0EdQWNqvVNXavfQeFj/wIsISI+9IqIXIPMR:99x9FO+Fx/j/9p7+qzYtY
TLSH
T1B7427E476D3D409F13984E6D16E6A0DE129C427F6A9892F3B7E24B0B7108F19B5BC339
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 15KB
SHA256 575f59027fbf4788edfbef78ed718fb07cd8be551cc22d7313ad9e40a5c86ed5
MD5 3305dbec2e4a61b1d0848971e448bd3e
SHA1 d0ed23281df39f494aee176f070901a0276e78d8
SHA512 838468a68ff4d8024f836658f386bcd7e801bc9ad8a53be51fdfaf0efe710227c32fafc20a088691acd13c626155fb2d44e053f3d7d4168f2db0f2dc7316aeb1
SSDEEP 96:Pl98h+yMyPB8GWlbQEQqVXvQeniIsI+wIIIr8bARlOFdTm4FMUCYPMUC/njVrr:99uM4BIrp+91TlOFdTm4nY
TLSH
T1B4723F476D3C40AF13599E6D12E6A0DE129C427F6A9891F3B7E25B1B7108F19B1BC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 1KB
SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
MD5 a2ec2e91c3ef8c42e22c4887d032b333
SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3
TLSH
T1A121002E2BBB491FCE0E0C7BC18FB9A0543FB15C39C314C4BEA4489E7D20E11506DA14
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf~RFe5a902b.TMP

Path C:\Program Files (x86)\Steam\config\config.vdf~RFe5a902b.TMP
Size 1KB
SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
MD5 6e6a2b18264504cc084caa3ad0bfc6ae
SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679
TLSH
T1FA119E5C6BB7490FCF1E0877C28FB955582FB08D79C354D8BFA448997E10E22106ED15
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap_log.txt

Path C:\Program Files (x86)\Steam\logs\bootstrap_log.txt
Size 9KB
SHA256 fb157b063afdd93e6199cbb826ea28f4eb77494cfc197cc0505ee7c518ccd884
MD5 16d2d195ee61d7bf783d248caa8144a0
SHA1 68a8ce2966fc5a331144063c0ddcbe3e8a2c2cbe
SHA512 0eac92a977a340724e986a080d4eab623625583cb52d9466d389e898437b0327c59daab27efa48a43c635279625e4f93f6f9ecff66412c41890b826c780f097f
SSDEEP 192:KF9QrAQ5XExLF572AOPDGZibvBF2T2alUFfp2Mbsf1F5BZKjR1WGBanX:u5+UxLFO74TdF3h
TLSH
T15622DB6B1718C8BB8B840171E4E44FDA4F2E381357031EF6BB542A5CB895925ACFB52F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btnOvrOffBottom.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOffBottom.tga_
Size 444B
SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
MD5 89cb2bc5ccdab01b0653d4dbb3d6a062
SHA1 afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9
SHA512 e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653
TLSH
T1CFF004040C400137C744757DDCD7C5CD77D4F4301540014C57D0307504D5041D1F44D0
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 6KB
SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
MD5 5a5715177822e69c98aab578421ae78f
SHA1 175ea27d6ef6df27fae93a724c94b2c770f78205
SHA512 b11d05dff7f9ce55c2b30de82709f5aa9b410734e1b88a6879e3489394a5b36a27389022de0a741a16f70d0639439d4f75942c3fd604567d63b9ec229d86b331
SSDEEP 48:dfnnnW6kQhYvc072yybS7WWjsHannnffw:Xr
TLSH
T161E12E6C226CC9DA805BB8F0CA19CBF804060EC9E85E11DFA0D73E8CFE38C8AE431500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_localfiles.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_
Size 14KB
SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
MD5 c4e538289a4c12da96cec77e7a3e36d8
SHA1 12d57144c0e79edbabc8033a9bf22b1720299f2f
SHA512 db3eac8c05b7277a6ab9974c682b20350705fcf616040204bab053d98cf193c2d6fc416eb571ca67f7e53bda59ccaddc0351bf60310a64dba2d83fd9aa539ab1
SSDEEP 384:1MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMrMMMMMMMMMMMMMMMMMMMMMMMMMMMMM0MY:ABTA
TLSH
T157626B16A05E37CE310A055AD1256DA3FA2021F58355346F30FBDE1668702B71AEEFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 15KB
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
TLSH
T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 92KB
SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
MD5 323181f4e9013b8b341897abd322e56c
SHA1 85e2e4a5d38c515185415bd4aa8d24f32d428fa2
SHA512 24fc5c82e25f2ee689b0888c6905f13ae74037e8db06a39b247d525071c858e8a284600dc5e33f006a2657d04c0b045c146c2af0951c7ecdceec34082a95d004
SSDEEP 192:JjJzVPBVK2A54RrjK/MQqLVWT5qOuIToER2zrpIEl:Jd5FjKkQqLVWT5qOu+tR2znl
TLSH
T1719359726F6CFC49BC94C88EE14132D065725AE7804B2551F8B4EE30E1E7ED72E9A94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_button_news_mousedown.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_
Size 20KB
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
SSDEEP 48:X77qTxcazfhjZRRRRRRRRRRRRRRRRRRRKFvJJJhmAr:X774zmvJJJhmu
TLSH
T18F9209380E706CCE81CE9A27AB348AD2A9D2DC6F36632E348653350FC1948543EA734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tabStdBottom.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdBottom.tga_
Size 48B
SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
MD5 bd64c051ae2410eef96839a3cb7297f7
SHA1 95a5b0455d69127fe50e396153c795d9914ce0d4
SHA512 ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793
MD5 SHA1 SHA512

Submit Download

steam_cloudsync.ico_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync.ico_
Size 47KB
SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
MD5 da277b7a17374bde018ffab02015238b
SHA1 ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd
SHA512 5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53
SSDEEP 768:CHjkEJqa7vWVw70BCDiSfUpWy46032U/C0Tz+3TaZeYJqF3D7RTB6F0SBS6:CDlJdvIw72ILUsyi9/CQ+34eY4zBCph
TLSH
T19F237CBEA78A557DC9A0473840CAEA7C433A6EC5E0A7C2C751D07F5B5C35643BE0E1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_cloudsync_posix.tga_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync_posix.tga_
Size 64KB
SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
MD5 be3a210738638c4f33aa7e01cb475e26
SHA1 02276a10cd77cfd57e4c796c45d69d526f8420bd
SHA512 6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb
SSDEEP 1536:fQF+zt5w33333333333333333W3333333333333333333DkqbbbbbbCm/b77vBQT:d5bbbbbbCm/b77MquuamizaWraS2Dz7o
TLSH
T165535F64EB112ABC9EF1BF05A6EA967813165D42113BCCFA168D7F4231F3A319DC6D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_tray.tga_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_tray.tga_
Size 1KB
SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
MD5 7ecf5b072a3c49209af4710481dff5c9
SHA1 6b49560eb27b2d7cd169c066208d4fd3a4863f3b
SHA512 ec9ed9d824471655a48b48324a023a7231560810f6403f0ded04af35b51dde4dcd244bd4147570ac9c5cf0c841af33caaf8de7d60cf20f6fcbedbd1717d6d262
TLSH
T12D1163C2ACCD1788DB12C53807E6E6021C320C1608B66EC9B4277356097B43CAAF649B
MD5 SHA1 SHA512 TLSH

Submit Download

filter_clean_bulgarian.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_
Size 23B
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
MD5 SHA1 SHA512

Submit Download

filter_clean_schinese.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_schinese.txt.gz_
Size 33B
SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
MD5 dd542d7ca2128ef0e7c3411b5ab9e8d3
SHA1 0a98ce0efdb5fd75d3c697f06f3c084d5882dc49
SHA512 0d0c1801d0bdf69d2010b0e26ce0a156fa50baaa0370330bdcdb879cbd09a6146d7bc89de2d5ea6f3615123a60e1be87def44c07f92de24615974e3cae2cab85
MD5 SHA1 SHA512

Submit Download

game_details_header_green.tga_

Path C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_green.tga_
Size 2.1MB
SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
MD5 1ed17a7d11da47608f99d98a8d249e6f
SHA1 ea3d9e0de541be2a346e93e63286f0265ac302fc
SHA512 e423be766c3d615dee6f3ed8b0b7bb5735ec13617a93f6f5403a3e7c4c379b9ab87e9fd5f0c9fa9338f656e321488d0aba895ac9f77da413e27473b2218b9ac7
SSDEEP 49152:q3m8TZFdk4Sd9DM8CsBALhExgBrPzkpRkQhbCh6:fDM8o6xgBnkkH6
TLSH
T1EEA54B0FF4A936693DC1EB9E11B1F1F438EA07534182DA93BDD79B4960C2C84A741B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_brazilian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt
Size 4KB
SHA256 70c39d5d5b16640165de19cee80da4a391035108cbc5f5009372a86954f0fe92
MD5 8ebd46495dd3b4ab05431c5c771d5657
SHA1 e426214322a729faddb5bc80053af5750c76683b
SHA512 53afd923f583eda4db580935a8cdd62413af8e830c04f2c12d15c55e905c114ec11a5e4483660601504c27e9350e9e47c6432f8f699464e11c5050fe846d7dc4
SSDEEP 96:3aArpYaRZ8hYzaAD25nmoVIPEPVIPErKOo8D85e:Gar8iRCNmVPXP738D85e
TLSH
T138A113AF179911BC58BDC3ED370E4E9725CC6172662EA88895CECB0D0DE740772B3592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_bulgarian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt
Size 6KB
SHA256 b387e2fb971297d3438acca130c53dfdd202ae2ca5b52d6503333734cda4fbfc
MD5 239c03a3dc1c27993da724736d086cef
SHA1 ff88246f8ea3502873dcbdc622378f006c58a2e6
SHA512 656922e8f2dec46ef36efba5c85088c47b02e89f62b27559611fcbe6ef85c6cd8462a4532e2d2d7f4faa977ab24f0de6f5f72e3075f8889db9e6e60baa162a32
SSDEEP 192:sK8p+typPx7rYLxGnyVUY8WYw6i0KfBKKfg38m8i/:sK8piqMLxGnyVU/YEWYWg38m8G
TLSH
T148D18B59076964DE4631E05EA9047E4B3DCA90FF3BA38B0501E9697C3EE307572BA249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_czech.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt
Size 4KB
SHA256 60c29f3c57c44c58daf69be797bfede31967b1ddfc9bb68cb7ddaa0acda67c8c
MD5 6def4d3cf1453d5fb69d22fca29892a4
SHA1 09fe62653e55668de75a9fc5b64949ea81eb4991
SHA512 ee4f3f5dd8a8aadde9cff8f8aca8a45fa419c36fd8a4a7d3af9b71e1f7e5d9e1d01c329c70e6da53238822b536e35224e55004bf2e1af4ec17d5b56ccfc58549
SSDEEP 96:2iAz7xzQK8VzRZfVAxzQXRQM1qN/lS4xIjfiI7yOo8S8qQk:lAz9zozrdAZQXRJqi4OvO38S8qQk
TLSH
T15EA1241D036654B859BCC26C722C46B326CC9273A76338995ACEC77C4FA714BB3BB550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_danish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt
Size 4KB
SHA256 fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115
MD5 03b664bd98485425c21cdf83bc358703
SHA1 0a31dcfeb1957e0b00b87c2305400d004a9a5bdb
SHA512 4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d
SSDEEP 96:iKSCj4RjGEcH6RZY77p7zrOsLEPnvIBXKvI2BqOo8380Bg3:BJj4jGnH6rY77lrOxPnQoQmq38380By
TLSH
T190910C4E5B79A1BCC8BCC6ACB22E05A3559CA13BE2322C4911CDC32D1F9785773BB152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_dutch.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt
Size 4KB
SHA256 56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192
MD5 31a29061e51e245f74bb26d103c666ad
SHA1 271e26240db3ba0dcffc10866ccfcfa1c33cf1cc
SHA512 f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8
SSDEEP 96:TnsaIWCk1TXfSRkAcXJNRZY/r/iza1GUNrzRxbM4x9yJs+Xc1AZqI79qIjiOo8nl:LsaIVATvycZNrY/KQyJs+ZZz79zji38l
TLSH
T17D91D15F136EA1FC89F8C2ACA90D42E7298DE2329227594C15DFC63D0E57417B2F61A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_english.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt
Size 4KB
SHA256 2eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0
MD5 2fe6613e267857982d7df4368c9827ec
SHA1 d520c7427b283e3ff167b850ab15352e46d328d3
SHA512 cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4
SSDEEP 96:hSlb0IG997a8ICgARZ2pyUBnXPz5dc6LzIIivI/BxkHLs06J:8lHmbICgAr2hJc6LkIiQ/DOLsVJ
TLSH
T1D381BE6E072A71F185B1E57C760E0AD3998871BBA3220D5816DEC21C1F9711B63FB361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_finnish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt
Size 4KB
SHA256 e350ca62e777da4da6d25885be96d48e7ce3acf021a74f2a4902354a1bf03fbb
MD5 594be5b10d9f551e551cf20eae0e6dfc
SHA1 191c20f5cb0c27ecc5a055fa2379694f5e27a610
SHA512 e27bf6593a177c22e16ddf5a44d82b34b02063645a7fd63943b936028d9c433c89628038768a300c296c2d3bcab2ef6b8532a19f7283952d041865c704f62b0b
SSDEEP 96:OJCZC1RCSwhp1RZY/T4zcVYsspWIN71BIxZvaZIUZvaPOo828jbG:JkPwhp1rY/Ucx0ALbYi3828jK
TLSH
T1A8A1339E172AD1BCD0FCC5AC651840A759C8F9B7EA222C4493CA939D4DE345772B32B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_french.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt
Size 4KB
SHA256 8cce22e7f13486f2bc612dcc8fa31d81038e6084a350fa10299d40c3a7f878c8
MD5 da69785dfbf494002f108dd73020183d
SHA1 34bb6061cdf120e7dced0402e588c3f712cf2dc0
SHA512 db773783b63ed1d66a59272e05304c174b69f85d2838ae8049dffed6b6b30c2011fd9042dd652f9a1733a2b6891870b426cf1985d41921e5360c9b1ae1330e20
SSDEEP 96:vk3l1CEN8RLcSMWPrfwgXWRZDbUvzBT5H52EkJJIbcYIbsgqOo83fy8WJv:sVIEug0ETrDsB+EkQbclbsgq38Py8WJv
TLSH
T116A1F14E17FC32E965F8826D370916A35598E076F222B94859CA830D1F9B42773FB2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_german.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt
Size 4KB
SHA256 02e48ee4e10354a2b2741d2e57ef565404753779f847906b5ae5c98ede06c01b
MD5 395286db3e67a59868e2662c326c541a
SHA1 716014d76622612a1bde2d4e1744d024f6d0b830
SHA512 64cdf1e6701ea57474051e338eee74859fc0ff4acd71ee0718a9b8cd698e94a9793c1901b6791fc0fc268c53fbc1e7e2f94ac1024f3f8765bf713954c194b0fe
SSDEEP 96:hn6e0CBtWTeRBtWTkcBMBcVRZY13nSYzBPCN0Ky5zaxhlwG/Iq8N8S32IBa3DOoo:h6erBtWqBtWDBMBcVrYF7GvFANv4D38f
TLSH
T1E2A1FF6E077A61FDD5FDD66C610A85B3358DF227A312284D11CDC23E1E9343772B92A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_greek.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt
Size 6KB
SHA256 88919d7be26fb3e06401fc0254733d92fd743ecc56da4177b41613e1f094c3e8
MD5 b9e30df8cf272813b121133fcf259752
SHA1 16706f982f16d5feb9c808f94b8cfa50c23f5d80
SHA512 7beb65c0477b02742741a8ce23557f4f15e8cf1b1ef03a6bbadbf594bdf2cd686d7356d93719111d27b309a10ca75846765a13bb3eb4d0411785dfb13a675fc4
SSDEEP 192:xjAVmh67h7mrdtjIWdS0ZOwdS0ZQo38a8FN:9pVnOYQo38a8j
TLSH
T181D19BCF72597EBCD0A8D15E188811BB27C85D39A61AD9C8225DC72C7DFA0237232957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_hungarian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt
Size 4KB
SHA256 1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5
MD5 18aaaf5ffcdd21b1b34291e812d83063
SHA1 aa9c7ae8d51e947582db493f0fd1d9941880429f
SHA512 4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154
SSDEEP 96:ADKraKKnH5BpRZELDO1cMQzQNW3kjN7MIOjHfvMIOwuOo888OK:W+a5BprELDXMAQNnN1OjHfhOwu3888OK
TLSH
T13BA11EAF033A70BDEDBDC16E36184293119EB127E22B2C7A22CED71C5E136177672156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_italian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt
Size 4KB
SHA256 b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585
MD5 8958371646901eac40807eeb2f346382
SHA1 55fb07b48a3e354f7556d7edb75144635a850903
SHA512 14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554
SSDEEP 96:5fTYcpLQ4J+4XRZauvgpJ2zyHTNb9eMuIluIVOo83zy8Xa6:xpkA3XrDQHlHV38Dy8Xa6
TLSH
T162A100BE13AA60BCA8BDD26CA20951D7258CB4F77723354801CE971D1FC7513B6B21A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_japanese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt
Size 5KB
SHA256 fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265
MD5 7e1d15fc9ba66a868c5c6cb1c2822f83
SHA1 bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7
SHA512 0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406
SSDEEP 96:wnwSwjaxKPVcljckFEJckFzRZYwCeHalzL9L3XHwrqdJOxoPLD1hKkHzULyqI5d5:ewSwINckeJck5rY5RXwaJdykHRly38TD
TLSH
T132B11F7C93AA24B98879C2BE290C56F36949AD27ED63392145DEC02C2E7360FF5315B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_koreana.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt
Size 4KB
SHA256 10720923c1048502c5191d6d1d8580e35e707b24d457941dae94a87371af989a
MD5 d75580775d67a85353189736222a8878
SHA1 ccb2275c8f5d119640064fd533ca15f30d93f331
SHA512 757dd94a1e3debb2520855a3d00e44e3a98b5764caf9c16c8d088fc1a1f1024eed742f1051635721f4bf2c00d1dac11fd975c09a7f5df78d1863de88f9bbf9fe
SSDEEP 96:bno0CtiVRtncgzjthtF5NdLRZYyzzjBaz23//w2Dv3R8QtVSMfXIjNXIPemiOo8U:zorkv+gnRFTtrYxUXLLB8Q2Oq3838gpq
TLSH
T162A1E1DF1B6721E850F9C01C1B68A5A302C8B132FB23145CADC9DF5D4E6B05776B65B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_latam.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt
Size 4KB
SHA256 05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c
MD5 7913f3f33839e3af9e10455df69866c2
SHA1 15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25
SHA512 534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804
SSDEEP 96:9FDhCIRRcJ3NkrHRZYGerQrmermz+Ejp6lLSG+oIq2K/+oIq2vgKOo8348o06:fsISbSrYrybSZYlEzKazv938o8o06
TLSH
T1F9A1969E03DD26B89CF8C05E6A09C6A3628CE173B521B84412CEC31D1D9754BF373685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_norwegian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt
Size 4KB
SHA256 cbfbe91d4a4661df814ea447c03f4ca872ef3e27073a1eb746faccbfe75afc8a
MD5 5462f47e56b978659ef56f196db013f4
SHA1 4749824d4e909369f59217d4980963ff17353f3f
SHA512 5a437968fc06619cf553ced32dba9c7c948f4364f02c8017986e9a4f09e9832b849c7e0567485ca1beba34a258d29b2612ea3ed6045c81777e9a5201139f81a3
SSDEEP 96:hL+9CbrRtcejaRZYBEpdzudyyACWxmkz6lIb2oZIA+Oo8q80Br+:EQb1+ejarYO7u4mkz6Sb2o2A+38q80Ba
TLSH
T1CC911E4E4779B1FDD978C5AC712E06F7429CF13BD2222D4941CDC21E0E9795772BA182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_polish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt
Size 4KB
SHA256 0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32
MD5 9b0b0e82f753cc115d87c7199885ad1b
SHA1 5743a4ab58684c1f154f84895d87f000b4e98021
SHA512 b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df
SSDEEP 96:Wa2CgROcEhwYRZYXvs9zp6SjluImGIljIjXOo89p8FR:X1wVEhwYrYQoI4fOD3838FR
TLSH
T17B91129D036E61F8DAB8C1AD6A680AD315CDF07AEA27194812CF860D4F5301773F76A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_portuguese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt
Size 4KB
SHA256 2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04
MD5 eb8926608c5933f05a3f0090e551b15d
SHA1 a1012904d440c0e74dad336eac8793ac110f78f8
SHA512 9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a
SSDEEP 96:uIsrct89cRZetJ2Ommrzrrd2GQvqGVA9VM7KOo8388UL6:Lt89crMYOZXwSwIx38s8UL6
TLSH
T18B91225E03AD1178897DC3AD770D5A9735CCA272B93A288817CE8B0E1E87417B3F3152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_romanian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt
Size 4KB
SHA256 52f256ded29ce22945b5bc0ef7a227189dfa91da69265ec13283a7067c239071
MD5 31bd3d4d8de5af4642b21d586d5ee54d
SHA1 552bebb93c71cd8acd72558db1810530909fb276
SHA512 cea49fc70b18a1294ec7e564ff7f4d1ff7efeb0db1cf1b088da6adcecc282569380f225e9a150d1666c5c1977ba4de0a5d9d667c72cfb8569a50546b978e9132
SSDEEP 96:Ivm7CuRPcPlXRZYIiK2zHazOPPUqlWdSHd1IAGo+pRIAGxMpnOo83L8sN:SmeeEPlXrYht6zKUodCwo3878sN
TLSH
T12CA1429F139AA4F9AEB9C16C760809E314CCA172A226688E12CEC31D1E834D773B35C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_russian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt
Size 6KB
SHA256 08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e
MD5 e04ad6c236b6c61fc53e2cb57ced87e8
SHA1 e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4
SHA512 0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331
SSDEEP 96:c5qCHRRc8sF+RZLqls1s1pzMDqAFoJFOTfNfKIik6IiVqOo868Crsk:GxS8sErWl+s1BFpg1Zh3868Crsk
TLSH
T18BD1005907AE60ED4538E05FE9086E0B3DCA91BF3B3B170400E86E7E2DE7426727A255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_schinese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt
Size 4KB
SHA256 948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f
MD5 56dcf7b68f70826262a6ffaffe6b1c49
SHA1 12e4272ba0e4eabc610670cdc6941f942da1eb6a
SHA512 c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2
SSDEEP 96:/BAGpCOREHce3QuRZY7yezuqY2v14q3HPG9AHINL4QI04VOo8a8Jz:Sr+re3QurY7XfHPgNL4d04V38a8Jz
TLSH
T15D81E0AD136974F84539C1BC761C4AEB304CB032B6336C881ACAD65D5E8742B37B16A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_spanish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt
Size 4KB
SHA256 41ecfe0ffd6043a66a41bf9ea032712f2d1bbc19b434c6c666a107ee379f21e4
MD5 e9b8fccdb78bf9d275b79c75b2ff3e7b
SHA1 4b549411ed4db0f0a3699e76531353c226b06a76
SHA512 4ce905a31f3a410712722271abd7e0a9a6c43646b61a321912b4a8e8f6fab68ab69add1d701c501bb069b8ecb65ecaf3bfa9be983933d0234a8c81c24bc6601f
SSDEEP 96:pFDhCIRRcJ3NkrHRZYGerQrmermz+Ejp6lLSG+oIq2K/+oIq2vgKOo8348o06:rsISbSrYrybSZYlEzKazv938o8o06
TLSH
T11AA1869E03DD26B89CF9C15E6A0AC6A3628CE1B3B521B84412DEC31D1D9754BF373685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_swedish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt
Size 4KB
SHA256 4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690
MD5 b2248784049e1af0c690be2af13a4ef3
SHA1 aec7461fa46b7f6d00ff308aa9d19c39b934c595
SHA512 f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c
SSDEEP 96:cnvF+VYBVZcdOMuRZvODz1Q4EqvL8FdGPbII8ncswBIIZswpOo8V8pVKw:CvsVsV6dOJrc1qGSdGPsI3+Idp38V8vl
TLSH
T15591C05E4729A1F89A7DC1AC654D01BB18CCB03BE2622D4D11CE8B6D6EA741732FB252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_tchinese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt
Size 4KB
SHA256 5e6b0978fe8e2d14905f46e089b06681d6dfe76dd0c1551c168171ac4de75969
MD5 5c7bc92e0d948e3bba3f26f64a22fe7e
SHA1 bd259397a312bee9b8262058c30e0e354eeea93a
SHA512 8a6e18ce3d38a9658172b1871255a9941c572114137e468f130956c73ff13f282a46074a1dda6404dbdbf317ecdaadf01324194b8f8c081f862037784f4946ba
SSDEEP 96:MBA8ClRHcPTTeRZYEIlzAtwLaIrjGRXaFHJICVkHJIDVIOo8J8Jn:xT/8PTTerY7HH4qFHGvHGC38J8Jn
TLSH
T13E81AEAE132960FC457AC17C2B0806A724DCB033B6233D4A1ACED35D5F1382F76B26A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_thai.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt
Size 7KB
SHA256 49b6b664d50a1ae0c732bcfbbdd1db1812ddccf00bcf5f40200f0e7cff5542ee
MD5 1a537a1d30fba1d3db449a9207b63835
SHA1 ab6903b4c8d6bd3571960b1218714b8d76b1880d
SHA512 1215b0d017a6e3ea207edafe8edd500a91a7a971b2f989d8006fa65e475ae32ec00df3e8ec06b4077f64f5b789c536bfb9d8b9945ca0e0731d68e48876bd8459
SSDEEP 192:MFlO8vlYUUlM/aUl1orYy5U55Z5I5vF3k5caR57jR5qf5c5AK5D7XBzmUZT5odWn:MFBwuYMy5U55Z5I5vF3k5caj7jR5qf5q
TLSH
T164F17FB7224A64D4B868561E26193392265CAD623F73F8D045CE519E5AF270BB032FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_turkish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt
Size 4KB
SHA256 711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f
MD5 29f9a5ab4adfae371bf980b82de2cb57
SHA1 6f7ef52a09b99868dd7230f513630ffe473eddf8
SHA512 543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a
SSDEEP 96:xnkgCvLRzchBmRZY6PfwEGcyDQz32cgRc1PqX0pVmbIN0P1bINuOo888SM:Rkv9ohBmrY68A3eXWRYSk3888SM
TLSH
T12D91EE9D06BE24BC96BDD5AE39480AB7518EE333F3316C4952DDCA2D4E1701372B7650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_ukrainian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt
Size 6KB
SHA256 3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99
MD5 cadd7a2f359b22580bdd6281ea23744d
SHA1 e82e790a7561d0908aee8e3b1af97823e147f88b
SHA512 53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519
SSDEEP 192:RQqEG5oFQE3FqioFq2rYFdpp0XnZZSEbUFvxlDl2oC38gv851e:RxEoAQE1PAfM/pp0XnZ0nvHDl2X38gvr
TLSH
T15FD1FF5A036D20EE4135E1AEF6086A4B3DDE51FE7B274B0501E97F3E2EE3011627A395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_vietnamese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt
Size 4KB
SHA256 8a049b6126e904dcb9ba5d8af21cc0ab25ca55221cf2cd48eea45504fe23083b
MD5 f8a86b74ce3b446e3111d1480b5feaf7
SHA1 af21c55fd6ac99e65db55af9b8f4ffe790c4382c
SHA512 70f8009f5940b10b77a6c152c8c73f3dd425fb9ac917014504e8116ef00032888de686271e0262cbe7a55c6e605e837dcfbeb54ece71e49646b1030195fa0845
SSDEEP 96:UWzvmCjzNlWR9cbG8THYCqrRZYT7zB4dbwfKKKX/TBAqLvI36zvI3FAqOo82f8U/:UMvlvNl2ObfT49rYDB4dUyKKX7Bns36W
TLSH
T104A1FF5E03A97068C0BCC13DEA4C058B2BCDF93FE7111E4426E9876D0E674637776A99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam.exe

Path C:\Program Files (x86)\Steam\steam.exe
Size 4.5MB
SHA256 1d2fbcc0402dc5a1f64b2e1d924e6e38e1dd76197c0246ddf89094fb86fda915
MD5 b97ff5ac5bfa46f131e2f9c454cffb75
SHA1 2dd08d23b218d0f6b5b3edb851ef181c136c787a
SHA512 ad7388924ee3c7d45e813502c78ace1762915ecbed53943eb70021e790a07a1d3baf0e7b83977ed294d870c37738f33319d9340713bf7a2910878568a8bac393
SSDEEP 98304:s+1SXHClNj4CbK6RJgSg+AG8mGz+5uqzOLHk:5EXQ7hAeuO4Hk
TLSH
T12A26BE12FA41C071E9D2017568AEAB7A497EAE304739C4C397D43D6ACC316D33B3A796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5444_1408492504\manifest.json
Size 52B
SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
MD5 152537f005b8875f68b1af4ac41c46f1
SHA1 70f529940adc1404721cbc1542c65eee289216ff
SHA512 bfcf5e9523b9268e1b0a546b5786498b1decc624ab1ba4fdd89e2e92edacd20800d731fef37c98aef45c64268d267b97d09f78124167685dd152bacd620dc9d0
TLSH
T1D0900260053491171AC10E546570F8859391661955850D1D0545154806A546CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5444_1539769389\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5444_1539769389\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5444_1662540118\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 030978901609c12837a9b1afdcd1ee9f12ef19339fd94725f17a7cdb1e945f36
MD5 35e76198d1c2c61d3c2a49119ba65747
SHA1 a5ae8329c9e762bed0a3d6bc5584e8faf6d26a77
SHA512 8b21ab6c5e29ab0ea7652b7adadb04a05eb734a52faa779252fbec4acd45079c7ad3f83f36227a419f0a59fc94eb1cf408bcd782459cf4691b6eb727be746fd3
TLSH
T136D0800925B7DC74D059847018977B4D7555CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 827caedd6ba67a465e2378da508ebf9f7e5dc38b9ff3d1086fe8a0b10ad23634
MD5 6a7649ad8529021b8a0bf012adb69564
SHA1 bc6cb8e64c0f5c84a887a19005280de2e2ff95dd
SHA512 316ecd29696eeae0002f91778818c1c4166e5bbf8440eddea3560a6ea0fb49f25e4e33c48c2d7c73eb08507c015f5aa7eb4187e6558ebdc4cd44c5bd980d8c3a
TLSH
T133D0800529B3DC74D055847018D77B4D7665CD6B4D4657163473283D1C4B4504D911DB
MD5 SHA1 SHA512 TLSH

Submit Download

89383d69-2c37-42d5-9c9d-ef887cda9598.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89383d69-2c37-42d5-9c9d-ef887cda9598.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a19c6ffbe7ff9c7a68c9350ba3b70bcb35545bbd45831f22a80b4878ec6ae502
MD5 b286e598cd4ac0210f08e506dcca9013
SHA1 2e6912752f7fff1d931f9ce4d489f383f29c3199
SHA512 04b9d52eb0863fa249f70e8e00fb264844fcd88ad147cf37977f161ad2e3e839c1e4745d86fb867a0a1e9281a1e9df0c292c5dba3d3077cc371d5ad27aa8de15
TLSH
T1D3E02BA5C872BC3B08FD171854649647EB5413872792484B3A3CC3088FB5A3785CA85C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 2.2MB
SHA256 3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
MD5 70f3bc193dfa56b78f3e6e4f800f701f
SHA1 1e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA512 3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1
SSDEEP 49152:2DcHcEngZtNm1LQRHH4PTwZX6kg9hsf4lcszpyu7d/TC:rngZtNm1G4Pw6dJzZNTC
TLSH
T1C3B53302B3B4E46AFCA39A34FDE592F64231BE48E504DE5723847F2F34B61519E49362
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 eb732acb1982eb1b0433d0efd7d8e7c132bfe4dc7ac5986a52c2c6e3d1663c5b
MD5 b362af77cf596c795f6420d6436fed39
SHA1 8f6e7beac3c3f42d7bf3d3742c58ae619d830edb
SHA512 1b1a6b6b3e1d7ee05deaf120b1dcb36223963aad7f3b5f94604b8f5256fc6ac8765216b6ef84bdcc66b664391927b0ef129b8b3d9798cdc8079067e661e810a5
SSDEEP 192:dFykF3NUliARWGWAk4ue0vos37uAzKTDu0c6AZcTy+imafYg7/GhqDYTb9Xip5vl:tzGaQT6/M7p1DxdeZrrwa
TLSH
T1CD0207407382E1A5FBD9727DB9C0BC857976463882877E9FA7DC083F1B0F6A561407A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590824.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590824.TMP
Size 3KB
SHA256 6034618c146c7aa9a5ad0f42be8b4cfd07b0dda250d2a1d1f9f14f3923d3adcc
MD5 6f7a0c4dcf96d942028876663ef27a3f
SHA1 69881035e771c3d48c9a56d397c855b0f35a952e
SHA512 87c0f7e5464a135783f6a8dab2f2a473f795f98b8912e8821b39468ae6c4cc68b5fea4dbf4bae44fe8e492f3f5392542af81a8493c0489fec1947e87be8bc347
TLSH
T19761D550738284A5F7ED43B9EAD574C97EBA477902CB3E1B32AC4C7F56057315084B22
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 39925cf649c2c3eba10807f5e67de29d93a56d0469d7de306521a6d4a1df800c
MD5 51ba91456d4fe1593849ebdc7c312a13
SHA1 de03ea5b70a08efd2c7c5095aaafd9e0157eb101
SHA512 f8fe6668bb8ac8740dc5b0c5e4d9a1806a5adcf35a6d3ccf0c3210162bb3192a6dc42ebe6343e2f603c8aad09fde96ff7eb92f13557a6537e826d902c18ca96d
TLSH
T12E61ACF383F5856D9A0296F0AA18EE2BCE2D0514832C3D6AC5E4AE57D3E3871E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a278a84f6c9eb29692d7697fc9a41e2369ee6f0a1fb829f2177c3bd6cf5612c4
MD5 e94e9fda5f3e61f613d9a5a655d50cf4
SHA1 e70589d32d1147c7c7d6174b86418988eb0b7ad2
SHA512 a851fa422378d2cd95469c3db52fe1df3611e595e64573b1c726aa35b927ed714c15a044d04e4754c0e90f8c83990c50f9b95bb54a9dc100d0af757f15a478a2
TLSH
T1C571BDF383F5856D9A0295F0AA18EE2BCF2D0514832C7C6A85E4BE57D3E3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d81ea4833c3d984952404781f8d7baeb01a4810412f51231e5c490133f0d64d8
MD5 8d183ea0bccf142cf4fbcf7631eb0419
SHA1 aba4a993c43d82db262c433e85bb1c2376b188db
SHA512 6ca0fe46a7041424b130ca14c5a969c166980394456511b55e3b17056d2925d08c268b0cd314c2a83d95ba19fbd2fa671ad6647dd29e6742432a86d4ab34107a
SSDEEP 192:sxZFRsyMqZ/K1Ml8UQe9C/fuXspSfrsUkqrjT1zodpv3nHW6+WNY6hFYf6oP3mVU:sxZFdq4C/fYspSjtkiWvHbnFemVJbi
TLSH
T10582D856693C5D7BCCD7D61DF985BB53D6F91522D2904E44AAFC8A0C00EABED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a984b2a7a7483cfc4096e3af30fccdca1ddc04b398597866a1d287fecf789b46
MD5 6772431393bb7f3e7aa2a3c66796f103
SHA1 ede118e6992b1702a1ecf510356400a547d6834a
SHA512 f3379516f1ed50c4333db7c5bedcc0ccf5c973f0e5ab81dd2e6cfce30f5c7dccfcb7a4ada7572697df0ff8bf427e2db54b55db1c245df767c1126d4743a29241
SSDEEP 192:sxZFRsyMqZ/K1Ml8MkC/fuXsmhfrsUkqrjI1zodpv3gHW6+WNYel/YKYpgmV+8I2:sxZFdMC/fYsmhjtkiz4Hbz/hmVJjJ
TLSH
T11572E8166A3C9D7BCCD7D619FA85BB53D7F91523D1804E44AAFC8A1C00DAADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 106e473c01b196a6c8a18719a763cc39a99699e9471e0d877dca70510f4b407b
MD5 10645f2d50a20bdde47ee328664cae98
SHA1 10ea5c7b97f7abc99d3dc4c06f71d47184236424
SHA512 cf70379045931a2edfcdcbb843d9413c1799530c2868f84cc0bbc1d36aa525dd8e9787534117d70c2ee0afaf3f1f4766496e945c521a4d6c70db0ce43068845e
SSDEEP 768:DcgLiAo7pLuL/aeWvaShq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCMKJLlhzCpUror:DcgLiAUE/aeWvaShqu1jaXMKJLDOp/r
TLSH
T162F20C3B2C0CCB7E4F844E9CDC2ABE8E6DE8028B9698C95447FA445C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 18c2eb3ba3328d5209f31feeaa1e5205be784f01d95a8c8cd42cc83e18c7ca5f
MD5 a502ea915940977aa6db1139209da62f
SHA1 2e0d66b573b29a362115227717c72e90a6d1bc3c
SHA512 0cc76f9fa45420585157353686ca883b7c5b8a1b9fb23a03236f52c26a1ddb06de40b7d24d0ddd785aa02e1c10ac42f85f767f438cbc72a3f6db529db2b56b20
SSDEEP 192:kBhNHfIVfhRXF4B6W4KqV2j6Ok4pYLQobOyzcp/KLNz3BH99l:krN/INhx+kcxKBzxHjl
TLSH
T169B23B11717A02913A7E398EC595B42F26C230633198B53B7BB914A60F6BE20DDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
Size 145KB
SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
MD5 79f8327a9cd094a4edb1fd159e289e95
SHA1 4d3615906d16d8a807e1bd394bef139507ce12ff
SHA512 9ab212871ccbe15c062da9898a782d75d208a2591b4c804df3e32581751801889f8cad8fae53dc0307cb89172c4536d35e44c06d63df6928ec4c4446a55a1343
SSDEEP 3072:tPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEY6lCuZY:9X1aI5aZoKzMJ07NtxoY
TLSH
T1C7E3F110CDC51FA8CEAC362C60FE0F1A63D1C69D4867A5C9DB63FD0A6F97A0492275C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 89c391846df933833d72c5ba24b407c965b5a0c26e23c3af985815beda838c15
MD5 164c192550a3b460f4c4599e1f1744e3
SHA1 b069c0ea8c08e05af3ecbab7442c2e2f0e383478
SHA512 a8c0f3864e68696f19ad6a3eec24b826d4001d65b0a3d712987554f56ff9d57f557ae485a2d15193524c44ddf394e9bef1a5b2545edcd5433c2b9307ef7a5d71
SSDEEP 768:RFJccQb3qwgBbDYtJyiMKx2E8sXTXRs2KcP:5ccQb3QOJyixiUTX2aP
TLSH
T165E2B2F194D7997BE9AE4B97A37D6E429EBCC153B1880994B7D80D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 e9665e1694b3f9aadfab30f17430ac8ec31276463cd600a7d8d1f32e898b1d24
MD5 124ef28bdaf394dbb9de1433a58f72df
SHA1 02e08b0aae5444c4d8144784f6eaa9f5bf5a4b47
SHA512 df9d48884c029c567c5ec236ca0f50ba8c3cd7fae2d86d162264729ce52e1ff69671241c3e41ef23e974ffd0cd15c15253da11abee454a7a1d769ca6709d2b0b
SSDEEP 768:RFCccQ73qwglaAYtJyiMKx2E8sXTXRs2KcP:yccQ73wgJyixiUTX2aP
TLSH
T1F6E2B3F194D7997BE9AE4B87A37D6E429ABCC153B1880994B7D80D0CCC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5cca28ad717bd4f7bea83fa99feed4d633b6a964a47b1d98d1881bf9e5cec51d
MD5 41bf5242bbcf9a244f2812ab28899a35
SHA1 9a25a0404e4889957bc54bb7fc4bd41cb8523cc3
SHA512 490dc33b70d67010edbd6d1f7e50b7c094e53bb60a0b27ea11fbb1aefc0e89f3eccc1ceb534ae166e5943359bd44317b3d230ec4226378560dc899ddf6481d04
SSDEEP 768:JFJccQb3qwgBnDYtJyiMKx2E8GXTXRs2KcP:BccQb3QCJyixi2TX2aP
TLSH
T1A6C24B31E8A4DEABEDE78FD5A75A7743AEF00163C5881AE8D9D85E1C00871ED170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cce01effc93c3e55427fde25adb9774e99b61ef88977834ba991859c9057d908
MD5 c2b3c2c10fcee865f3a881edd5ae8c77
SHA1 3f9a7690f32838584b55a1abe178d799d96fbbc6
SHA512 8fd7982ac092931ba49d63882ebefd77b748a62c781534da81de35b4b4a67d615d0483d68b969dd87f4516823ec0506e30d95867d19b4ef1736f014131c7fb2e
SSDEEP 768:8FJccQb3qwgB5DYtJyiMKx2E8GXTXRs2KcP:2ccQb3QYJyixi2TX2aP
TLSH
T19EC24B31E8A4DEABEDE78FD5A75AB743AEF00163C5881AE4D9D85E1C00871ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9564e4c02cff401b1285265f292af07a521819b7079e2f19cdee201b8c098670
MD5 91b3d5cfb37c68b615e77d9d0560d6a6
SHA1 d171d0e3c03fd97c5f80404bc5bdda1d02815a1a
SHA512 bfffc62e20045ee0c75104bc432b3ebf3474c5e5355a288264d875b5436e08cde8393246bfd84101fc13782520b28d373eaa4fe6622b60050d099a54c2496434
SSDEEP 768:RFIccQU3jwgle+YtJyiMKx2E8rXTXRs2KcP:4ccQU3zwJyixirTX2aP
TLSH
T1B2E2B2F194D7997BE9AE4B87A37D6E429EBCC153B1880994B7D80D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 ab74f978470affb0fbb64e1638bc9417e98ac0618833962dece6d20d2a08bed3
MD5 74cdcf8e1952b97049042016846d191b
SHA1 d7ec1784de000bd493dbdb7d8c7c7f843d7639f9
SHA512 e0eee0cd1b0a56602f72be017cde8885630839db6ae1e6ab1714805c8f5d2369a5c074bbd4ba1b132bf83b177db041b83e861a80820dd13299e1fea553e76289
SSDEEP 768:RFSccQU3jwgle+YtJyiMKx2E8rXTXRs2KcP:CccQU3zwJyixirTX2aP
TLSH
T1F9E2B2F194D7997BE9AE4B87A37D6E429EBCC153B1880994B7D80D0CCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 33ab1634a178bb7ae9e7db7601bc4031083dbc19bd1c29e7067c2f976ed4a967
MD5 c625af684b31525ff18a61a1b6d7e06c
SHA1 046af086bb8b12e594bb466cb25d465c87fed51a
SHA512 ed8b84ece43aae49acb563b3571a566a966fd412b1ba83f877eacdaddf63b49e258f6975ac778ee1b3849a5db4b7f02723dfefe492a89236bd74b8cafcd07271
SSDEEP 384:nCiFavqMg3sNz8TUNTUlIm2ZTPENO6OwfjYtJyi6/Kx2hi+XKW3Ra4XvrN1k+5vP:JFayv3ewgHFuYtJyiMKx2E+Xr3Raef
TLSH
T141C24A35EC98DEABE9E65FCAAB4A7613DFE00167C5880AD8DAD81D0E00D31DE1307C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4a29b9d9355ae5349a5064e2608928cc5923b599fdb298a48964d5ee0e4c563b
MD5 ba198345f2e8fca0a243215ab465e9b2
SHA1 a3f3983c1a9a2bfc010a240e9f2af0d007179793
SHA512 75ac26d017d5cca6b2c9c476708924c6608027a328a441f5b919d7237471c3c8b46169cae6aa863ebbc9486d92c5ff8b0e0307acbb57bf5983e59f60cbe20f04
SSDEEP 384:n/iFavqMg3sNf8TUNTUlIm2ZTPR+6OwfjYtJyi6/Kx2hixeZ5txXT3Ra4XvrN1kG:KFayv36wgHMuYtJyiMKx2E8VXT3Raef
TLSH
T198C24A31E898DEABE9E65FDAA74A7603DEE00167C58C0AE4DAD81D4D00871DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 903b984b6b887f12eaa3e41ad58f3218cd523920319e77b68b39f1bc3119eb2b
MD5 21c30913c417a806094f54206dd385ba
SHA1 983fa24a6959a334d5c7414d2d3e76aef2ff8316
SHA512 8f311a3865dea5159994f0297e20709adcc06329a6e80560a6a1fa3f569bc4feb4c88b158fca4f0486e34b27ea7b4329bb201601fec920bb6e97f692f5c0a42a
TLSH
T1E6E00203A76011FAC028433108431A647AD3803711F202965E50416D1D173103F35F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e4ed5b713433e775b7df453470edea4a8683b4fd9bb74cfbb3ba5abc326325d3
MD5 0181de3a67a4269de327c05a5b93e2bc
SHA1 4788200d20ec46afbbc1bf88dbaf4bb369e9f5ba
SHA512 fc5830fa82a2c33f5ad602ed2cfd391e2842c8c93e06fb48deef22b6837c96b8cc4a8420657541feb634e552cff22ba25f5386cf5d7da3ba0e69a62d81ecb914
TLSH
T1C5E00203235010FAC024413008831A603A53803101C302455F5041690C153403E35C80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 20d0ebae12a0c128fd5489b0ee03b4cb2e400bb4d18ae76c69bb99a933d95fe7
MD5 06f86deb79d3947d2caa95caceba2b7b
SHA1 0c15e346a6d1b1b95bf6769e961ea9a03ce50058
SHA512 730eb3cfb8e9194ff00d1e3dc59fed0e9a087ab665cce3ef007b96f1e2d1319d1857f371342a9554eb82ef5536c17efc95fa00dec3d8a2d8448a24e903c3c3b5
TLSH
T115E00203675011FEC028433008C31A743AD3803601E302555F5041692D173503F35E90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58cc63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58cc63.TMP
Size 392B
SHA256 45d7c12e58f6ae85597005278d0edd58f0d664a4cfd17fda50bc3d79118e9ff5
MD5 a46aa7283e8c0ee10574fe725ead69b8
SHA1 301c7520dcaaa6702ebdafa6ba186d7f9aea4279
SHA512 1bdcc5b037284eec1295121c834ef7ca0aba11d70a88d6e57c33740d6b42ecbfb93d0812f155f287a7ddf516655195182e2d8513e0b52ef6c0e4877dd624414f
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 551b5d45674e685ce42bfad9fff59c2b88013f6b55f022edbc16b0f3c5331515
MD5 dfadd3bbcae128d4205fcb6c178f3aaf
SHA1 005be079c2cf9d7cc57b17192391298786f0cd6e
SHA512 ccca0bb1a5dda3e846892598fcdd5961f95b6b76e8677699fb846d206cef5b8a3a9e3dad59b6d18bcf83adc115474e843a457865545a24a5e42003b77e227ce1
TLSH
T15F4120E1983D2AE1D4BD0E6EA04B78FC84D8D326F178747D6868EE98463A95E640143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d4d3d367dbed92af02a9e922ff69c96f99ab9e97faf22c0c87626cbed108aa29
MD5 46827a1af8036ffe4592dca134cc6a7c
SHA1 fbbc69c584eedda43d64fb1acb1475265acfc1eb
SHA512 7c55a965e5d045447e40031c86e59d5f28d6eddabab63758427a789caea0398a3ad28171b0718c4481abd574eb37f124010a74a4623cb91c0df1912a57eaad33
TLSH
T173412EE05C3D2AD1E0BE0AAFB04B38FC84D8D726F568747D6858EA98473A54E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 991b9f93117701e57e14915af3d800c21ab5c8b22bca75c0cf6c3657bc746cad
MD5 9f84164a2f788947be2197708128730a
SHA1 b650f3952145efef5b953a44e6b3c7e7f063864a
SHA512 d92709570bec91940d799ebc02c78fc35c206bad0a7f326c2a454134c386b049c0d5b051acfc7b5a415abd4f458b614d260e89aa993b6353e648b3461783c655
TLSH
T19E4162E15C3D1AD1D0BE0A6FA04B38FC84C8D32AF168347D6868EE984B3E94D240143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 db0431de74eb75e1a4f0980c01068e0ea4123d8c63938e970a12213e99bee9ff
MD5 61ac6000bd27c8afc8995500c980f1ce
SHA1 3959c33af89f48aebecc62dffea0ce047aa7a349
SHA512 ec7f77f03c2b8f2a4788461fd4e0c0ce6d0aa8d10487ef595fd3e774505a108e219a6c1827af91cf88e8265c3572a4594ac543024c348494c4654346996c4839
TLSH
T11C4140E05C3D2AE0E0BE096FB04B38FC84DCD226F568757D6868EEA8463A50E644143F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 101139e5345970f5e059a3ed987a0ef1b1edef0ae7d0dcf476bbae9227be7107
MD5 3c361ccbb36d0d7b48a3cba367600dd9
SHA1 309949aec44b09f88c312ab9f2db31d2ad4a0046
SHA512 60a5c9b7812e979e28b937f9b1e8ab83529ad11f67d899be81c8bd300cad795ac5b4f56bda2f2b822fc55bbbab76d637aece74ba0629644a888b3ee46a6eb47d
TLSH
T120411658BAED1144B3B76E5ADBF2A86D487E78721E46D45E00110E4E0A33F41C8A2737
MD5 SHA1 SHA512 TLSH

Submit Download

2060e0b7-b1b2-4b8c-84f5-4ba102897c70.tmp

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\2060e0b7-b1b2-4b8c-84f5-4ba102897c70.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 bdfbc8dc1cfaec471397316daa064da1cb601fab40203b34d53b380740ae222e
MD5 9c0293aa483b88db751bfbe3819986d8
SHA1 c9bba2f8a64c912e573bd1c5703f03dc68fc3606
SHA512 caf09c9bd5e1342a67c38f7659133999a9d0d9fef5b70cf0b0c9d7e295c1edc0fe38b66094f7c1291dab30a04aae3a17eed248969f7522107cc2f62107d08a85
TLSH
T1B6D0922078EAC961EF45B2BA75863C5F71B047047966AFD355F0053C998E7D24690349
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d3c1e9e22d8c389730b48f32cf178a7157687ace349960da64f5ff52a7b43aec
MD5 ba53c1ce79941faab14a4b6dc8a158e9
SHA1 e5ea77135a8306f039c3eaa87e81f1d934eec122
SHA512 985e1fcbc73cb645e480de43917907d9a0e9372d79e9fe6942f4c0fb8131fa7e2b87951889cca6bd504c131b51b8fce6b04d97fb2c1ba8ccf03cced3a4abfc1e
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
Size 188B
SHA256 149390d5add7798ec7c0b34d142cffc3f3f4e654caf68f96c6a326bd6bfbebdb
MD5 3267cca0eb61b796a357f8faccc74ea9
SHA1 111c69f812711fcb1226fb130989a0849f07a056
SHA512 a36f9d694139a80e980dc152d600dc2bd10529aa8a7a039a5e39025b2491da3d1a6f41867a7623f7cd3d8763a042870da4ec5a6fa320241feb7daea7c217358f
TLSH
T1ACC022A140A9A43230AA05212C80AD40EE36F0300083A4EC825A01AC624006AA303022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5b28d2.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5b28d2.TMP
Size 188B
SHA256 4e5cd51ed5545967d28a7a35e0e19ac138914fac6ec1d22ddb0c7dd2fa52d2af
MD5 326e151c43bd1f8d01efb3e46670e44e
SHA1 9d996ba74f663e8cbdec3401f7a5a630cdda0536
SHA512 368464faa39302243a4284602b97e9117cae30c725966ab99c2549af8d3a111d558c41ea724d84e20a478fb02d423ecb50e920a0ea3fbe507cc2fbfd39a00e4d
TLSH
T15EC022628069B43734AC05251880AD42EE36E039008260E8C262812855401679213412
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 7KB
SHA256 27858377a4d5c731d6454c5c3ebac030c8f078624bddec02fec7e8f2fc55ddfb
MD5 42cbeb37db2f7c1c52221f5b083b935b
SHA1 6de8db5e5500d25be9dfa332a8edfb868e168cd6
SHA512 f9d6a4a40d8cac192d055e70bd9cc6875b4985508c991c19794409d1ecea5fdc18fe5a702ee8587186af0933d91d679c497a4652731009d938d7b0ff958a9d80
SSDEEP 192:rSURbefBXV++wpqpgPkz+PM6yIsnDjwgQ:rSU2X/wAKkzfQ
TLSH
T1DEF1860A5C28AABF4CC6D718F9667B43D7F6143135943D48E6F88A1C24DB6DC222B50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5ae62b.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5ae62b.TMP
Size 7KB
SHA256 9fe29b8c1a1f86c3415e12c7c53ed64bfcc69ed28859acfd35562d39df86d972
MD5 2ee73d5da6acbfb2dda578de03619dea
SHA1 fdde8240bc3ad24045999633c4588f73642ffacd
SHA512 4246bb57d87531ff4fe21ee759e5f1c88a3c3d613f32e569280f4627580e9ddc1a8cf13e2a874e54a9a38be6c12db6b880ee68e72e63da8dc830c5240eb2aae2
SSDEEP 192:rSURWefBXV++wpqpgPkz+PM6yIsnDjwgQ:rSUtX/wAKkzfQ
TLSH
T1BEF1860A5C28AABF4CC6D719F9667B43D7F6143135943D48E6F88A1C24DB6DC222B50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 1KB
SHA256 62202bec92bd0594c1181ab09965174d79374dc63fda5bc71a9fc988ddc207c3
MD5 1fa855ca1369566414aba287479e4868
SHA1 b80e939ed7f0502587061908fbc87298d024e57e
SHA512 46bebb04d8c2e3ef812723beeb5176e4662344ed4b8de412e7e4ff857422a6663ff21379574aafc3f17f8782077bc26095cec6dfff1104d8150fc4223bc33a42
TLSH
T1DD113272F9E44E666697893537422B430E349226E0628E8CF2CE475A03D359D2517C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 1d5f84e62e7635a8c1e379113741452f3447dc475c00492c7870dc7f1f01bcd5
MD5 92bc2601739f5061634faaf09238e07f
SHA1 c3d2638d46988584921a052a0ca92fc34f3a0460
SHA512 2c83d085323e992974877ad10906d20465ac47ab079a0d239c622ee735263b9e3f54d093b5a896832c57545e73776d476ccf3a49ebc7df4e6a008fa158c98811
TLSH
T161517432A8A8CD7746A7C451B5433B038FB9652AF6616ED8E1DE0B1C02DB5EC1343D2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 492fad3a79e2ff562752f603ef173e204db1d10df062ee2fd13a433f307aed5b
MD5 e7d7b6874be7bb34bfa71f2f69d5a71f
SHA1 35e3871bf71416be2be8c7fd968cfaddd84ccc87
SHA512 bef2b96f06c9e7219ba4fe1a32cd19e2fe5af3f7c0a4caa02ef2b495be07c289cec16b45f9a418c6ea3883c0a6bdebfc875ccc9766c73381d9993cb97ea6b46a
TLSH
T113517432A4A8CD7742A7D451B5423B038FB5612AF6616E98E1DD4B1C02DB5DC1342D2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a7716.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5a7716.TMP
Size 890B
SHA256 335bfd1f23539a26b943fabd17b9d2529a6b8b50464e33264fca0951a6f6ea07
MD5 13167ca1d33e68083240c6b85305233a
SHA1 00870eda61de6f4e474ef00acbae2ec1d22e853f
SHA512 23132c4592c0939bd8c04126b402f212b6f38ca986cea381f3063aff4a5826af2519b927912d3eff274e110daf6f4d6313dba43f5d0082b21ac9b8945fbf8073
TLSH
T1A5111272ECE09E666A97847637823F071E38922BE1664E8CF3CE534602D359D6517C37
MD5 SHA1 SHA512 TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB3.tmp\StdUtils.dll
Size 99KB
SHA256 e2ad7736209d62909a356248fce8e554093339b18ef3e6a989a3c278f177ad48
MD5 98a4efba4e4b566dc3d93d2d9bfcab58
SHA1 8c54ae9fcec30b2beea8b6af4ead0a76d634a536
SHA512 2dbc9a71e666ebf782607d3ca108fd47aa6bce1d0ac2a19183cc5187dd342307b64cb88906369784518922a54ac20f408d5a58f77c0ed410e2ccf98e4e9e39a0
SSDEEP 1536:Lyy+HcFWrX52XWcS15c4DBVOw/bEQvWt6uouMw5m0mhdBu4NpBTvO7Fvo6mVS6oN:Oy+8ozImcSNd1YHbMbC
TLSH
T1FDA30A523174345EE0E6077C176F23B3847E1728AB38A8DF47A3458ED6752E2A0F5B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB3.tmp\System.dll
Size 11KB
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB3.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB3.tmp\nsDialogs.dll
Size 9KB
SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
MD5 0d45588070cf728359055f776af16ec4
SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
TLSH
T1E412F793E5A820B3C2D3533F35BE2B2EC7B95335B0512C0482739A497A6947A6E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB3.tmp\nsExec.dll
Size 6KB
SHA256 7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
MD5 c5b9fe538654a5a259cf64c2455c5426
SHA1 db45505fa041af025de53a0580758f3694b9444a
SHA512 f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa
SSDEEP 96:xr7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkNL38:xxbGgGPzxeX6D8ZyGgmkN
TLSH
T185D1E8B932C10DF3D44D46743F22381717BDD476177542A1CB972AD61EA2AE2FE21B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx3CB3.tmp\nsProcess.dll
Size 4KB
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4464-7801-0x0000000000140000-0x00000000005B6000-memory.dmp

Download

memory/5084-577-0x00000155B3C00000-0x00000155B3CCD000-memory.dmp

Download

memory/12360-14180-0x0000000000910000-0x0000000000E19000-memory.dmp

Download

memory/12360-14181-0x0000000005840000-0x0000000005861000-memory.dmp

Download

memory/12360-7851-0x0000000005840000-0x0000000005861000-memory.dmp

Download

memory/13624-14562-0x000002335AEB0000-0x000002335AF7D000-memory.dmp

Download

memory/13624-14617-0x000002335AEB0000-0x000002335AF7D000-memory.dmp

Download

memory/13624-14563-0x000002335ACD0000-0x000002335ACD8000-memory.dmp

Download

memory/13832-14184-0x0000014714350000-0x0000014714358000-memory.dmp

Download

memory/13900-14566-0x000002100D200000-0x000002100D227000-memory.dmp

Download

memory/13900-14567-0x000002100D230000-0x000002100D26B000-memory.dmp

Download

memory/13900-14564-0x00000210045D0000-0x00000210046E5000-memory.dmp

Download

memory/13900-14752-0x00000210045D0000-0x00000210046E5000-memory.dmp

Download

memory/13900-14565-0x0000021005330000-0x00000210053D9000-memory.dmp

Download

memory/13948-14568-0x000002A41F800000-0x000002A41F915000-memory.dmp

Download

memory/14092-14357-0x0000000001C70000-0x0000000001CCF000-memory.dmp

Download

memory/14256-14601-0x000001AFDFAD0000-0x000001AFDFBE5000-memory.dmp

Download

memory/14396-14248-0x00007FFCE8480000-0x00007FFCE8481000-memory.dmp

Download

memory/14396-14247-0x00007FFCE7010000-0x00007FFCE7011000-memory.dmp

Download

memory/15268-14612-0x0000000001E90000-0x0000000001EEF000-memory.dmp

Download

memory/15728-14613-0x000001CCF1BD0000-0x000001CCF1C9D000-memory.dmp

Download

memory/15828-14452-0x00000230AC2D0000-0x00000230AC39D000-memory.dmp

Download

memory/15872-14614-0x0000023B433A0000-0x0000023B43449000-memory.dmp

Download

memory/16904-14554-0x000001989C960000-0x000001989CA09000-memory.dmp

Download