41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f

Analysis

user interaction
yes
max time kernel
899s
max time network
761s
platform
windows11-21h2_x64
resource
win11-20260130-de
resource tags

arch:x64arch:x86image:win11-20260130-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
st-setup-1.8.30.exe
Size 10.6MB
Sample260417-y37y1sbv21
SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
MD5 54cceb7c9c0c50a9d2f0b1b4f173eb33
SHA1 ffc28139e6c2d2eeeb27bc39f2ab20e4b8b4c08e
SHA512 41a589e7ea52d1a8730a4f12ef3db6e5738cb426f38483e8dc178e42d3ef58e1459cc61cccab800891f38fc9e6e3eccc76c46c2782108d084d91234b1f43b53d
SSDEEP 196608:CW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7YD:7CDQaC28nl78Kg6zCWCdFs
TLSH
T1C0B633942474E24DE0BA0031EC61EF66DDF4B09A5B058A1E4299CB6577E4BE34C2FECD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4268	icacls.exe
716	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\SteamTools\vcruntime140.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\imageformats\qico.dll	st-setup-1.8.30.exe
File opened for modification	C:\Program Files\SteamTools\SteamTools.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Network.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Svg.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Core.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\msvcp140.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\platforms\qwindows.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Uninstall.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\SteamTools.exe	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Widgets.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\vcruntime140_1.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Core.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\Qt5Gui.dll	st-setup-1.8.30.exe
File created	C:\Program Files\SteamTools\msvcp140_1.dll	st-setup-1.8.30.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1268736783\Filtering Rules-AA	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1268736783\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1865911349\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1268736783\Part-NL	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_665310047\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1562110714\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1719655591\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1085799203\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1268736783\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1085799203\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1268736783\adblock_snippet.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_665310047\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1268736783\Part-ZH	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_665310047\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_768338586\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_768338586\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1562110714\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1085799203\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_735659521\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1268736783\Part-ES	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1094816146\_locales\or\messages.json	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
888	SteamTools.exe
1664	SteamTools.exe

Loads dropped DLL 33 IoCs

pid	Process
4856	st-setup-1.8.30.exe
4856	st-setup-1.8.30.exe
4856	st-setup-1.8.30.exe
4856	st-setup-1.8.30.exe
4856	st-setup-1.8.30.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
1664	SteamTools.exe
1664	SteamTools.exe
1664	SteamTools.exe
1664	SteamTools.exe
1664	SteamTools.exe
1664	SteamTools.exe
1664	SteamTools.exe
1664	SteamTools.exe
1664	SteamTools.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5568	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209308520363500"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2 = 5c00310000000000915ca6a21000535445414d417e310000440009000400efbe915ca6a2915ca6a22e00000092b6020000001700000000000000000000000000000049a31a0173007400650061006d006100700070007300000018000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).left = "395"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).bottom = "898"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 02000000030000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\4\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).right = "1534"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).y = "4294967295"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).bottom = "1018"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1920x1080x96(1).y = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 6 IoCs

pid	Process
888	SteamTools.exe
3188	explorer.exe
4668	explorer.exe
2252	explorer.exe
3500	explorer.exe
6040	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
888	SteamTools.exe
3500	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe
1848	msedge.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
1848	msedge.exe
888	SteamTools.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
888	SteamTools.exe
3188	explorer.exe
3188	explorer.exe
4668	explorer.exe
4668	explorer.exe
2252	explorer.exe
2252	explorer.exe
3500	explorer.exe
3500	explorer.exe
6040	explorer.exe
6040	explorer.exe
3500	explorer.exe
3500	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4268	4856	st-setup-1.8.30.exe	78
PID 4856 wrote to memory of 716	4856	st-setup-1.8.30.exe	80
PID 4856 wrote to memory of 1436	4856	st-setup-1.8.30.exe	83
PID 5236 wrote to memory of 888	5236	explorer.exe	85
PID 888 wrote to memory of 1848	888	SteamTools.exe	86
PID 1848 wrote to memory of 5996	1848	msedge.exe	87
PID 1848 wrote to memory of 3084	1848	msedge.exe	88
PID 1848 wrote to memory of 5568	1848	msedge.exe	89
PID 1848 wrote to memory of 3084	1848	msedge.exe	88
PID 1848 wrote to memory of 3084	1848	msedge.exe	88
PID 1848 wrote to memory of 3580	1848	msedge.exe	91
PID 1848 wrote to memory of 3580	1848	msedge.exe	91
PID 1848 wrote to memory of 2512	1848	msedge.exe	92
PID 1848 wrote to memory of 2512	1848	msedge.exe	92
PID 1848 wrote to memory of 2512	1848	msedge.exe	92
PID 1848 wrote to memory of 1156	1848	msedge.exe	93
PID 1848 wrote to memory of 1156	1848	msedge.exe	93
PID 1848 wrote to memory of 1156	1848	msedge.exe	93
PID 1848 wrote to memory of 6048	1848	msedge.exe	95
PID 1848 wrote to memory of 6048	1848	msedge.exe	95
PID 1848 wrote to memory of 2316	1848	msedge.exe	96
PID 1848 wrote to memory of 2316	1848	msedge.exe	96
PID 1848 wrote to memory of 1044	1848	msedge.exe	98
PID 1848 wrote to memory of 4152	1848	msedge.exe	99
PID 4152 wrote to memory of 6040	4152	msedge.exe	100
PID 888 wrote to memory of 3344	888	SteamTools.exe	103
PID 888 wrote to memory of 4108	888	SteamTools.exe	106
PID 888 wrote to memory of 3732	888	SteamTools.exe	109
PID 888 wrote to memory of 4708	888	SteamTools.exe	111
PID 888 wrote to memory of 1888	888	SteamTools.exe	113
PID 1848 wrote to memory of 4892	1848	msedge.exe	115
PID 1848 wrote to memory of 4992	1848	msedge.exe	116
PID 1848 wrote to memory of 4908	1848	msedge.exe	117
PID 1848 wrote to memory of 4776	1848	msedge.exe	118
PID 1848 wrote to memory of 4776	1848	msedge.exe	118
PID 1848 wrote to memory of 3344	1848	msedge.exe	119
PID 1848 wrote to memory of 3344	1848	msedge.exe	119
PID 1848 wrote to memory of 1852	1848	msedge.exe	121
PID 1848 wrote to memory of 1852	1848	msedge.exe	121
PID 1848 wrote to memory of 3864	1848	msedge.exe	127
PID 1848 wrote to memory of 3864	1848	msedge.exe	127
PID 1848 wrote to memory of 2380	1848	msedge.exe	128
PID 1848 wrote to memory of 2380	1848	msedge.exe	128
PID 1848 wrote to memory of 5068	1848	msedge.exe	129
PID 1848 wrote to memory of 5044	1848	msedge.exe	130
PID 1848 wrote to memory of 5044	1848	msedge.exe	130
PID 1848 wrote to memory of 3128	1848	msedge.exe	131
PID 1848 wrote to memory of 3128	1848	msedge.exe	131
PID 1848 wrote to memory of 4708	1848	msedge.exe	132
PID 1848 wrote to memory of 4708	1848	msedge.exe	132
PID 1848 wrote to memory of 4304	1848	msedge.exe	133
PID 1848 wrote to memory of 4304	1848	msedge.exe	133
PID 1848 wrote to memory of 1368	1848	msedge.exe	134
PID 1848 wrote to memory of 1368	1848	msedge.exe	134
PID 1848 wrote to memory of 4336	1848	msedge.exe	135
PID 1848 wrote to memory of 4336	1848	msedge.exe	135
PID 1848 wrote to memory of 488	1848	msedge.exe	136
PID 1848 wrote to memory of 488	1848	msedge.exe	136
PID 1848 wrote to memory of 656	1848	msedge.exe	137
PID 1848 wrote to memory of 656	1848	msedge.exe	137
PID 1848 wrote to memory of 720	1848	msedge.exe	138
PID 1848 wrote to memory of 720	1848	msedge.exe	138
PID 1848 wrote to memory of 3228	1848	msedge.exe	139
PID 1848 wrote to memory of 3228	1848	msedge.exe	139

C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe
"C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T
  2⤵
  - Modifies file permissions
  PID:4268
- C:\Windows\SYSTEM32\icacls.exe
  icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"
  2⤵
  - Modifies file permissions
  PID:716
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"
  2⤵
  PID:1436

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:5236
- C:\Program Files\SteamTools\SteamTools.exe
  "C:\Program Files\SteamTools\SteamTools.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fff36b4c188,0x7fff36b4c194,0x7fff36b4c1a0
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,2332366219621305567,5801162305639514407,262144 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,6600165443672054790,1097655086496042974,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
      4⤵
      System Time Discovery
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,4927979789369189914,6063213651460028941,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,4527907753858687729,598583782530343009,2097152 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,14521069346520391998,15136533417614554811,2097152 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,16002087043553741501,6512494309205693353,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,5350629026860887475,251445711537648109,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,5413420081297682961,17177445580704819417,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,5413420081297682961,17177445580704819417,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,12759630190815578782,17686946091062815366,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,17147474689100435941,6196621962015158511,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,14331906374573601788,10759939362514298021,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,6654847127150469289,12366709347351552389,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,15319790435770193149,2130685868690427957,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,17160209938167758548,7263851274037244096,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,4833709066483854286,521091366046121535,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,7240778578551193310,747648447086840217,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:14
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,17851044218747697652,6993129163410256894,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5836,i,14061673371789126717,12318547914366661345,262144 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,18024627354712139467,11629085580030341027,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,11965780531424361167,5359234560091316901,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:3128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,9198157797469085194,4917574315149562993,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,8542236075078530449,13794242260184034753,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9260404956326439687,4859914563189454585,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:14
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,9410092268959821854,6379378168631507777,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,775769814326191638,5068130218066511351,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=1172 /prefetch:14
      4⤵
      PID:488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,12613209174752587025,7039962606587078354,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:14
      4⤵
      PID:656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,13943435596013040680,4444288269457159888,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1168,i,5888043993177418803,12451726124996729249,524288 --field-trial-handle=2188,i,16692676649513572918,10445130903598279756,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:3228
- - C:\Windows\explorer.exe
    explorer.exe ""
    3⤵
    PID:3344
- - C:\Windows\explorer.exe
    explorer.exe \config
    3⤵
    PID:4108
- - C:\Windows\explorer.exe
    explorer.exe \depotcache
    3⤵
    PID:3732
- - C:\Windows\explorer.exe
    explorer.exe \steamapps\common
    3⤵
    PID:4708
- - C:\Windows\explorer.exe
    explorer.exe \userdata
    3⤵
    PID:1888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4464

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1132

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2252

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3500

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6040

C:\Program Files\SteamTools\SteamTools.exe
"C:\Program Files\SteamTools\SteamTools.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Core.dll

Path C:\Program Files\SteamTools\Core.dll
Size 657KB
SHA256 0efd139f4201aea356b6baddb159534badfeb388bb7dd54ee9d614f166cc64a2
MD5 a0f3f5d8aedd622aaebc9251e10c15ed
SHA1 271d2c2362f979d47b79acee65cc4ef7b152343e
SHA512 5788813567c26c8a70f6a4369085790a49c44c02a706d7b5bcec68b98ba773598840bd57068aef34fa4c0a25ee5305ce7293335921e33fd25f92c664eb4dd72f
SSDEEP 12288:JuigyYF+iXvJAarykqB4YbiKxXiVncYNCdJqgmVKcfK12:Ju7LciXBAaTe4JKxXiBREdJNma0
TLSH
T17DE48E56B3F400B9D5A7C138CA534517E7B3B4551320ABDB07A09ABA2F23BE1673E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Program Files\SteamTools\Qt5Core.dll
Size 5.7MB
SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
MD5 817520432a42efa345b2d97f5c24510e
SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
TLSH
T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Program Files\SteamTools\Qt5Gui.dll
Size 6.7MB
SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
MD5 47307a1e2e9987ab422f09771d590ff1
SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
TLSH
T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Program Files\SteamTools\Qt5Network.dll
Size 1.3MB
SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
MD5 3569693d5bae82854de1d88f86c33184
SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
SSDEEP 24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
TLSH
T168556C67B3A142E1D56AC139CA5BCA03E672700087665BEF1279CF592F737E2263E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Program Files\SteamTools\Qt5Svg.dll
Size 322KB
SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
MD5 03761f923e52a7269a6e3a7452f6be93
SHA1 2ce53c424336bcc8047e10fa79ce9bce14059c50
SHA512 de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
SSDEEP 6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
TLSH
T1B0642957F3120896D927D27CCA9B8916E6B334100363DBDF022A8A5A7F237E17A7D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Program Files\SteamTools\Qt5Widgets.dll
Size 5.2MB
SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
MD5 4cd1f8fdcd617932db131c3688845ea8
SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
TLSH
T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamTools.exe

Path C:\Program Files\SteamTools\SteamTools.exe
Size 1.7MB
SHA256 992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa
MD5 9ab2a4fa1b4da8db2e102c0fcba6e5f0
SHA1 a1b85c90f9f3717570448bab83d9ba103cb31a13
SHA512 acd2445a4351e9a1e04caa574631ae8480386d411adbd7b74af24085c85fcdc487f0f90432e496b3fe47258d6bf21a74c1f9f001b006ad4912c4e432129eadbb
SSDEEP 24576:X5vF+/wYyf1jXjBHT0SMSnVpcZuphOH7q9r/bWYAo3P:5F+/wYU1jtIKKZupaqhz0E
TLSH
T1BF857D0BB278C1FDD067C179C51A9A0BDA717446172196DF22908AA53F33BE21E7F368
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Program Files\SteamTools\imageformats\qico.dll
Size 37KB
SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
MD5 a9abd4329ca364d4f430eddcb471be59
SHA1 c00a629419509929507a05aebb706562c837e337
SHA512 004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756
SSDEEP 768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
TLSH
T1BA038D67E72904C6E227CB39D1524A27FA31F5219B92CBCF526686590F237C23D7C398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\SteamTools\msvcp140.dll
Size 612KB
SHA256 86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
MD5 ba72c2f6f465926980adc2fb7f8b3490
SHA1 63de0e3c14d0f45c1edab1c3ecd4adfb78ee8cdd
SHA512 05136a8dde4359efd112341b12e0545accc8d018e4fa7495b071197833a0227bd50879d7753b61582505b8e2286f845604008bd2020e689e148037a9ef7d7474
SSDEEP 12288:lOpw3ob/5jh6lN0RXhsdufjqDZZX/t5xTOKGmm75s79s8gywMQEKZm+jWodEEVo+:r3ob/5jh6lN0RXhsdufjqDZZX/t5xTOh
TLSH
T173D41A27AB5905B4E052E378A1C78711D7F1BC058322E3C782A6E27D2F673D5AB3B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140_1.dll

Path C:\Program Files\SteamTools\msvcp140_1.dll
Size 30KB
SHA256 af589d441cd97638b1a0b9192a4014c52b64b35ecf5437caa65f27b3583e07aa
MD5 18a6c1a3d630dfcbc227082d5b06681a
SHA1 6634a25660e5843cf7fba6dc09b9dfcb698432a5
SHA512 5716e41de4f2ed7fee286c898411d99e11392f60df91b2423539c51016a7b9a12945087e6d1a47256c084ceb06556334ef03e34a8647d704582abe5745292581
SSDEEP 384:NlKX7EGOdlBJkQhnlVI/GD2Wcg53Wco+F0GftpBjLHc4HRN7hlI5e368:nKoBJkQhlVl3v+ixBIe68
TLSH
T132D25B86FB6C8983E8535C7092A5CE83BC3DF3C25B21965B1265E29D1CE37D0AB34619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Program Files\SteamTools\platforms\qwindows.dll
Size 1.4MB
SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
MD5 4931fcd0e86c4d4f83128dc74e01eaad
SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d
SSDEEP 24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
TLSH
T1D4658C57A3B54299C26BC23DC64B8B17D6B1701503219BCF01A98E597F23BE3277EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\SteamTools\vcruntime140.dll
Size 83KB
SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
MD5 0c583614eb8ffb4c8c2d9e9880220f1d
SHA1 0b7fca03a971a0d3b0776698b51f62bca5043e4d
SHA512 79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
SSDEEP 1536:ikqwmvKrSgB91BDJ25Tg/G0G5r4Gt7qNBPS9DH6ecboHjPxu+dBsi6:i3CuavtckJSVqNBPSUecboHjPx/O
TLSH
T15A838C4567E802B6E06B9130C0E28E47FB76B485877047DF037A56AE1F53BE18B3AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\SteamTools\vcruntime140_1.dll
Size 43KB
SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
MD5 3b22b2ec303b0721827dd768c87df6ed
SHA1 86f8af095cf7368ccbff2d0fd6d33586145acd2b
SHA512 79db774980ee132797f7e7dbc0e055b724d8fbf0e4917523b285f918730adfff81022cc6f5e15469b011d55501fd7b085bc070e9ecdfb75c05f4d6622a7f2475
SSDEEP 384:GRiuauREnUUWU55vZvS05fJjPg2h1RWmbzA+XfAXxy85xH0f9lWrGKWVQRpBj0HP:DJnUUV7xPg4RdPvv2DHkR+W+1CP
TLSH
T1F6135B54977C8486E56B85B0C4A2CF27FE39F6925710928F0B65D29C2E537C0E73D21E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a67530703c53458c9f8facc22bec3fe1fa29031470fa0a1bc4472eff03fb4e2a
MD5 8c50dcab6e83fcd2f9c91ac8185c2219
SHA1 661a4b8acdc70edc799cc5ce7e30cbdebabfc1d9
SHA512 a67070ee5bb2cbdd9c50723c49c7f67b23eab9c1771f9c216eb7367776246ae9c0bfed11a8f3a7dff7c1a05dcabf64d874d4d780e3224df070c6c37a95649918
TLSH
T1F2D08C4821F26CBAD08ACA7219457B0A2959E6A79E93AB2E39B36C786C4302115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

3f3ac344-52b2-43a9-afb6-4d6e6d0b959a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f3ac344-52b2-43a9-afb6-4d6e6d0b959a.tmp
Size 414B
SHA256 f26219e44b6bf40d3978600b8251c816245016122e7ccf9ad4a82220f7063bb1
MD5 d738c005e0064111f644c52c969e71f9
SHA1 ca4280e63aa9630dbe22b06a3731c0d446ea0086
SHA512 843fbd9dab03107caf05511d3de2fd3329ba4e2c63e02013d13da12824fbbafcc94fe30813993451c9094fd828530e1c757e665a97486e8e0a0e4de77693e79e
TLSH
T1B2E02B6ACD25DC3708FD071971500B49F76113271650565F3A3C920C8F7163A09D6C2C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 335B
SHA256 e8bdb06ed90ee49198a0ea63fb8e0908fc1db0ce07777b30b5a7dd7dd14eb414
MD5 1b779068a2d3971f2b7825db9ea84cec
SHA1 a30ae8fe2ed874a04a94f3fabc12018985fefce1
SHA512 7b253726fa336dcf84d9e2e0ca5c01131e617714b44d094215e8dfbcc3b48e22ed6ff330ea3e9202659bda42744511ed93a929d261430062ed0a77716e9c9809
TLSH
T13FE0269C4ACFC3BEE25074C742784F0D8290361EDBE86DDA27008884B247B40AB8BDB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 807B
SHA256 cdb8eec0e4c5ab5f03db920b318d1ff5aa3a3472e44dc5ddccba27c682eaa4c0
MD5 bb7e84442d76443fec42ca900621e023
SHA1 f6b3843e9b86c4a8a5f7b1e8c69c7e32b6727587
SHA512 b4ba2c3a360282267dfc3dd2d084f39cb1d7b687110781de29fec8f15dbb4bae15616b5e7e4ceadee7ead47523c6326750cb66803aaa71c4c2f8d5517c0136bd
TLSH
T10601C44E5763E6FC31829242C1EC6AB34502709EAAFC98D1359C6488F542E02C77ACF5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 c0ce5f623085c0284e4bf9920bec066b9a46ce3881cbc2067b0bf839f2144126
MD5 90b9061608b241711955e65c9d34220d
SHA1 da05f5c3d61a45c8f65435e8f62fc2e3ce27553e
SHA512 7262386d7bd645823d7a5e4186a1a373136136ecf4414b56d83056dfae506857c7d9bffe1c4c77440faf794f97d17c500f64c72591de992bc79eb6ee5143621d
TLSH
T1CAE0264C0B82EBFC428BA507914E4B1AC484341FD5BC9EED32867488FC40A08E24DCF0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 659B
SHA256 8bf89e6d777476900aee025f01348f335922f20052d453aae22267127c407ee1
MD5 19c15977151a3c713c56c032af4ecc72
SHA1 8ce50efb6f84967945a94f50469e28f37b4e7595
SHA512 600cccb9902456a69686d50fa9f87d5870913ac71eb71965d7ea65659cbf27be82afe932dba3f18085c246bfabdf4d64353324aad26217cb26a4b3b72735c145
TLSH
T1C00149ADBB8C698DC2E84CFD9532F1001F6821D7C40FEF675520F88022A13F81B34428
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 72175603dd4de98f1d917a2e69222feff14fe4789ab252a4179718256168d6c4
MD5 131e055020d4959a274412e18f9f564c
SHA1 4c0540de1aa04c638a1e90ed46b40a54e9a8eb6b
SHA512 23bbb10f87d3bce45fa99baacafd9cb106012f316b75ba7640eef2c49ad93b128a922a82cc19fbf551dd098123373f2522568743a252a0a39075bbb4f9cdf8ca
SSDEEP 96:5i25i5Lw8nHz3U4wQMjaYNEPwpJafkV0cz+BpANWDvJx5PUI7a9dfqVFJ4exdDW0:s25i5Lw8nT3U4wQMjayEopJafkV0cz+j
TLSH
T18881808AA2F2C46CFBE0117F85DE99CE7631A068C2774E1712F2713D5A16B7211B9738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594944.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594944.TMP
Size 3KB
SHA256 01f53ee75c5e61a60bd8d5218ca8491e78b00e9261080c3c815dfe30d09e482a
MD5 7ebc795d076f685ac9a50fd516761c8c
SHA1 1b0e34e0543e36507fa5de82b8929a17dad2133d
SHA512 7b885feeff21765fe45cd77f48c34720ecf92c10b9f9b2b277aa499b42a61e49b87572f98da48897a2b1068c0281e96f0f406f68dcd6fb77829ad92df126cd26
TLSH
T1C371FB49A2F78469F7E051BF86EEA0CD7670A0A9C2771E2702F6313D5A15B3111B9738
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 107KB
SHA256 2d15d1a30785666c49831a5f576a862cbcf96e20e769a85459f93b023a1fb8d0
MD5 8b81c51427788daa7c346b9f7679e4c1
SHA1 b466666ca62f4102f15a65b4b84907a97b184028
SHA512 170baf598b42456ff411222239f85c936c74e063f1b5677f763c9d2eb99ce633d4ec96e49eacf6a0981bb5447433c3c030c17b43ca40ca5aba08d9a798b5051f
SSDEEP 1536:RfEE4+V7loQNNGZqW3w5PDuVjbpBuW8vRZsM62UhPq:qSVOZi7ZU0
TLSH
T1DFB35227D6A64C6B01F16264EC754382F325436F9282A82F3A3C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 44ff9fed7bd82557f87f6ac89a1ae99faf98cb1d464f554cd79794ea31d25184
MD5 ed0879bd63de8cf96587294e0c871dee
SHA1 d9ef249600588039609caef5c1b3144dbed60825
SHA512 4a0b0adcdbbadb117969b469229e3b716f887d9508afc892a78a6705b9860713c74a2676f15d0828245cd6543b6ccaacc155702330e603d998137674b219bc65
TLSH
T1F051CDFB83F4957E9A0195F0EA146E2FCE5C0515436C3CAA85E4AF1BA3E3470E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8e17440461cbd6cf2f9c3a16bb8b422262ec4db5c8b5685199e5da4f5f28b0a8
MD5 5ff5bfb035447a613be27f5e61e9397e
SHA1 cdfa4b72a525668688b0ab43e9d90baef9099209
SHA512 acb3e57f4ec14fe5258023fb63271ba541c8e9779fcb0b208b1a034d8766feb10bcaf71040e59dd6350fcf415d7c9ea79a158d5a3a1cbbb9f0bbf67319c76200
TLSH
T1B951BDFB83F4957E9A0195F0EA146E2FCE5C0521436C7C9A85E4AF1B93E3870D101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3f97cf4c205b8466a261e7bcb13e3e66706c0648a5a9ddab79a9847c47c9b456
MD5 9470fed3d6687fedf6d257b3874149aa
SHA1 16c499c763fae738fcde4f31a6060e61b04c0477
SHA512 c3ac17dd78b470846429bf9e48707480c3c8a9dd5da26a19c409e60002eceedc7a31589227fda56581fdbb50bda927243ca63561f8e0b2dc62bfe8849e246ff3
SSDEEP 192:sxZSqRTyijBKOMl8UQH2BU/fgsFlVWLTP6Uuqzodpzo/W6+WN5EQM/Y0rmXriJLW:sxZFsqWBU/fgsFl8TcR8/b5I/52i1f+
TLSH
T18072E816AA2899778CD7D219F655BB93D7F9057391400E44AAFC9B0C04E7BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fa185b391d3c9469cd4b57014238d806385176c11e7b2c2143a9b7adcb9813f9
MD5 af13a4b77319bce5dcd5de8ac0619e5f
SHA1 be04a7f678d9a66203bbba03476942008c33fd7e
SHA512 428f9cbadf0ef6184fe2d0329613905830f15cda02dff92bd62d9b21c2f5871e254fb4019c79ca55e39473c023694ced05cee1df2abf47cbb218cfcd759952a5
SSDEEP 192:sxZSqRTyijBKOMl8M2BU/fgs1TpVWLTP6Uuqzodpzo/W6+WN5EQM/Y0r7XxiJLIE:sxZFseBU/fgs198TcR8/b5I/55i1jL
TLSH
T1B072D715AA2899778CC7D219FA45BB93D6F91573D1404E48AAFC9B0C00E7BED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 bda3d41ef8dad71f7d648272d228162516bd6a4066741fafdc376b7a77617b67
MD5 dfb50bcbb2809fac15f73c5e7f38a17a
SHA1 d6aff0b08ad45a4a5a163a6d2ea260e2d77f20ff
SHA512 d4145e0ce92ebc7df191c9011088cb39ec3004f7cfa242c2976325a24b93d69e3995607b9b8ccd6867ede9f9c1f7a10b54c8688573e78cb7869960f9b20a705a
SSDEEP 768:kA4so86s2+q7pLkdL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3RU3SLw:kA4so86s2+CkJ/HzWRmH9QYRu1jaKRUD
TLSH
T153031D3B680CCB7F4F844E9CDC2ABE8A6DE8018F96988D5447FA444C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9dd2bd6-4a8f-42dc-ae4a-f28358bb8d24\index-dir\the-real-index
Size 2KB
SHA256 2078a31859a99ab0106e63a445ce31bdf7d69f7bc1b6f2843dc72bcdcbce346e
MD5 15e39fcc36ebb78b27b77498d2980463
SHA1 1fbd8a41747d9603001ec08071b65b15ae09a021
SHA512 9d220507b75e342a527a0bfac84320ca9f15b3a7d090650ef25c3d083b1e777c0757bcbce4922b07279b45a7916171789c432dee7170221d6284b9164254d767
TLSH
T11F41D79C9C8D4D53CE3946B159F9253833B888FE29589B0B6CFC123A6C876A51C93208
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d68cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d9dd2bd6-4a8f-42dc-ae4a-f28358bb8d24\index-dir\the-real-index~RFe5d68cf.TMP
Size 2KB
SHA256 5917b06af89214a618c67e0473cd79ee88803d82a1bc835ba9d109579cf43d4d
MD5 61b5266ea27315e1a2fd4885e81530cb
SHA1 7c6996a626c4c7e5da137c08145e4f3d3b4787b5
SHA512 b556fa56b6b7824729ce6471c4b19809d1a3c9b6abd38667d9ae286978382577eda6ee20b69fa137993105294912767083375d0312d2a0f4dfd3e59cdc9149d3
TLSH
T11A41E99A6C834E23CD3080B299C92069333DA8A50944EF0B39FCCA33ACD76A82D53254
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 373456c142554126a41b85bb4814bda616d65e84135c052942114e6d16cceb06
MD5 8e0f9f153f842451d0c9db760747d81b
SHA1 d65330f95cf2afc7a76303de171e86d44e80c1f4
SHA512 dcd0c5073a165d6161ec01f824feeadfa6e3bf7fa4d9cda588908042fc53d396f77b8ed8b2bd5b382b9c26eb159aa21717078199b167c932b95260e4c4f6be1a
TLSH
T10FE0D8F73EE71924EDAB9BD5647180A41042B8688948EC4E642A739B20B22493446CA1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 25KB
SHA256 e5df7c377e63469f4e1d29b723267d0be7b5bcc62a41b3227a8b06fbce30b37f
MD5 c7b7071bfcc087bd1ef92e58e5625d34
SHA1 b09efe4ffecaaefc27e47492d8f78a9c577f86d0
SHA512 82a4868709a5c875a98e6f5c51852b89e2f66607f9e6293ac2077d43b62ea6d384cad3df7ba20b429d1915ff0e3aa1164e71afd5b63025e3ed7377ce30f693fe
SSDEEP 192:ubB91NPhfYXHkvl7X3S9rYBxTutBDR1itgB5b+Y3MrTI9rzH4f5PKBeasI8nL:ul9rPJYXkt7HShYZqD4RB
TLSH
T103C26A91757A12907A3E258E85D5B83F42C230A37158A87B3BB901B64F67E20DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
Size 145KB
SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
MD5 79f8327a9cd094a4edb1fd159e289e95
SHA1 4d3615906d16d8a807e1bd394bef139507ce12ff
SHA512 9ab212871ccbe15c062da9898a782d75d208a2591b4c804df3e32581751801889f8cad8fae53dc0307cb89172c4536d35e44c06d63df6928ec4c4446a55a1343
SSDEEP 3072:tPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEY6lCuZY:9X1aI5aZoKzMJ07NtxoY
TLSH
T1C7E3F110CDC51FA8CEAC362C60FE0F1A63D1C69D4867A5C9DB63FD0A6F97A0492275C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 906ca6b22beb5e90d71c3a5added4fc750ec3b3cea95b61493a424e489285f31
MD5 6d11a0c48d3ca544a4b95b1d0c0a2375
SHA1 5ba6b3bbe6987c3ed268bbeb2218318ccb090966
SHA512 4dd344a54648a758dadd7157055b926989a9d0aa2c03a5eadfd53f2cbe3b96282519a57e275cd31abf3fc9aee1f312bfb6a8e115bb8c7bd8cc9c9cf54e0178a1
SSDEEP 384:nsIiFJjccCs+Bt0S3v38NLP8TUNTUlIRCagPSY5amCV20fHYVnp3v0uQ8XmElj8y:IFJccQP3QPwgGv1+Y//0UJj8ySQX2A
TLSH
T16ED25B35D865CDA7ECE68EE9A35E7693EEF00163C98C8AD4D9C81E0D00D719D170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3642bf8b1ab748ea4558f24c87ef4af52986bb124aee9473b8a20fcafedc331c
MD5 af659abecb627dc195ae0885f19aed9c
SHA1 8e5bc297cbf711465ddb5df4fb6ee2c914772e07
SHA512 f9c30a7523c4372aaa9a9bd9c291a88d633ec097c78c216026c3db134c07cfa29c72e2d1060964d0c68dbf601f9abac1b33a317c10870515325fbdb7d882290a
SSDEEP 384:n2IiFJjccCs+Bt0S3v38NLP8TUNTUlIRCagPSY5amCV20fHYVnp3v0uQ8XmElj8y:2FJccQP3QPwgGv1+Y//0UJj8ySQX2A
TLSH
T136D25B35E865CDA7ECE68EE9A35E7693EEF00063C98C8AD4D9C81E0D00D719D170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 d25f7bc22ee94f7e7a195467fae9559cdfad7e165d2151c0ea892a609dfd74bc
MD5 e0859d89e6820bf67db0bc5914d09e9a
SHA1 7cf410634eae2921a8fe19c69d34a5746187e0cd
SHA512 9003f7626d6557922f1c83ee3dc20c448cb3ec9ff138a2dd15c636ec161ce39dc04304bdd8203941b7febdbacc7d50af8a8a967051588ba4a0e26492f2cd0b5d
SSDEEP 384:n2OiFJjccCs+Bt0S3N38NLP8TUNTUlIRCagPSY5a4CV20fHYVnp3v0uQ8XmElj/F:EFJccQt3QPwgGt1+Y//0UJj/aySQX2A
TLSH
T194E2B3F198E789B6E8AE4B97633D2E429AFCC053B5484994F7C41D0CCC961BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a04dba467e0954fa9fba8d5db0c2a6df650196d782e8b79c1f280919f9436853
MD5 b4ddbc0dc2eb8f0e46b19589a56e81f2
SHA1 8f1e63ce7dbf9545714f740e48d28723c4f046ad
SHA512 e3054fe6820035f4a0e805c7dc6617ec392058e87f664b30efafb80be15d25aca290d18129a0136ad835b4e9ed367bbc8d750cad17fc1c569a9bf53b582ba757
SSDEEP 384:nKIiFavqMg38NnY8TUNTUlIxBgPSY5otUOV20fHYVnp3v0u7T3Ra4VsrN1k+5vIS:qFayv3AYwgG8U5+Y//HT3Ra/P
TLSH
T1D0C24A35EC69DDE7E8EA4FDAA7097602EFE04197D58C4AD4DAD82D0E00D709E170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3430e718bf169a889bb8592997060be43a91556c8c54e99d50f632fc9b35df6d
MD5 c66b38c67d739cf69f0921a396f0af20
SHA1 9db88beb842f011a2eb48d85af653d3d996ff60c
SHA512 66d264ff373de9dd0bd9e8bf33e277cf050dd56093bbb875e8aafec2d4074f5bbed90c63acfa11d6aa9d4e6469595dd1fe1ecb256399cb5fac2d74ff1d9843b2
SSDEEP 384:naIiFavqMg38NnP8TUNTUlIxBgPSY5eCzV20fHYVnp3v0uQ8XmEljny3Ra4VsrNZ:6Fayv3APwgGXY+Y//0UJjny3Ra/P
TLSH
T1B9C25C35DC69CDE7ACEA8FD9A75A7742DEE001A3D98C8AD4DAC42D0E00D709D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9eff65fb8315095ff7ced59d04b5503bdb1a19a5789f52240e34a7efd72305a0
MD5 e71022963d16a118afbf677298ba1548
SHA1 3a74f5f42f7dcca888ba640e000f3cf6a38292d9
SHA512 2d9d800813746ae2dbd18903148c411b9a09e3ee01851a9a216b147f1ec45371106ac49d7e62f21a93c86d300a35029bbfea3cf47402e3d9cdc93a43556c7ee3
SSDEEP 384:nsIiFavqMN38NLP8TUNTUlIRCagPSY57mCV20fHYVnp3v0uQ8XmEljnyq4grN1kf:IFay+3QPwgGc1+Y//0UJjnyqn4
TLSH
T147C24B35E869CDA7ECEA8FD5A71A7643EEF001A3C98C8AD4D6D81E0D00D719D270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\crs.pb
Size 251KB
SHA256 576d77d3085ff9156298e60dee868364cabab7911edf6f9a4d3ad5f351d5059f
MD5 3ef7a7be0ecfef355a5d5d6e77ebddfd
SHA1 5c6e47340a710019b97b1fd58624f714420b79f1
SHA512 812f5a4e1f572b7a012add71bc210281fd362f48ba5a863b2e5a7d7b6405dd08632dc39ce650a0d032f926d1e41acd8f1c84d5b60552ad9ac98ad6d2abb7f265
SSDEEP 6144:q6ik4li77VpRldVW+J2i/P66k8LyST+uUX:q6XnVpRN2GZQz
TLSH
T13C44AE9A0F3C3E11BFD2DEA466C8D9377D79B3E066A928172111C4E169927F07D8C42E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\ct_config.pb
Size 16KB
SHA256 dfc86083d2fa2463f12d1d096db6084c860cb8bfddc3d2cf8e818f65353241d6
MD5 85f3a17e7255717d8e9508b8081fd5fb
SHA1 9e24a4cfc81bb9f5fef0a4b69c5e6060930a076c
SHA512 5869837a49799d06e81d7406999b4d297eb6f759c556366e39a29b383a0f0ebfb1d15ada95c34c131dbc225ed1abeb695b08fd1c77e28d2ef5564d46ee9019f2
SSDEEP 384:BtomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:Bl5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T10172C8BFA1169F000383E558D6E157AAA12363DACCF3763DB1E1C005F5423E6A1A967B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\29.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 9314218dc6642ea1980d504ec45e23aa2b4e7775ef13f7c7121271dbd60b1df4
MD5 eb5319aebea02b8c51c77a2a2b981614
SHA1 64b3fed053dcd2c33c3eed422d8e4ac7eec5d77d
SHA512 f56990428a679d56bdb9d7957ede9d6365d585f0c74f548b1fce439e835580210628a21a7704aea53e1f2bc75de6c845100a5c7801f0b03e9299671f539b5c0f
SSDEEP 96:Jxk+yBjecaikDBwrBnzowGbMAy5z5tBT6c5MUfFwnIXq6g/8yy:A1IDCrBngQ5jlMUfFwnIl3/
TLSH
T1502204B37904F99390E7E0BE1041F59AE933436540ADF98A528C4A7635F1F0729BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-DE

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.84\Part-DE
Size 305KB
SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
MD5 fa08e85d713ad46803e924d443e4bf7e
SHA1 bbcce20f5ce73be4b34cf5c43d6f71bb4ae2c5ff
SHA512 884314e04cab57c9907f90525a4fea7710fdff5e47db4500c03d4dc6c5491a3f4df4868620a2a1817444ee75bfc913e79f9a414e3a68108deb7abab700ae9f85
SSDEEP 6144:7FjHKfRBie5M0SPtVRY7od0x6qNgKWIescUHVTl1dKcJEtmmt4l843NWKOb2P5+S:5T41N/IuscpL1Kxa
TLSH
T10264C693296AFAB12A320E7D600A1C4C5322F111C2C7DDD9F775C98DD1E468BBAC16F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.4.17.1\typosquatting_list.pb
Size 1.6MB
SHA256 805d8d74e6a3b6b2fe689e200868d7fa4781089d5f6fc830487ed1b5a9017049
MD5 acc4a11e2e7ba213daa0f5e73300f694
SHA1 979463888ec0a9931499a9b1bf6cdedd9bee0872
SHA512 cd81ae9130a4df9ff95932ab57a6f8410aaf6fc0df0979f0d54c2d8332f0c15dc860d0e59d3d6b32e2b14c47a89179c79f935f75498634fe7cb904f3374db907
SSDEEP 12288:1Po6kw86Bm53N/m9hb0dleifKXYXHX0Wi5QIQ6E7JOPo1oQSc9paunY:1PZq9+9hbHifKXYXHX0WwQIw7VSj
TLSH
T1C985B5F9DFC00194DAB8112D20BE71D8081412A540E5EFEAFE7C855F2BC6AC977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 eea547a3290b249b885c2af9d9524d9898a43134877ff5a00c492f3a0e2a81b7
MD5 237a77c3747bde12a6daf5dffbf956fd
SHA1 8ad5d10eb303ff9793f4218a8c917c5d67ef0850
SHA512 c3e3a24c21ed4fe98dc2a8aa779da0a1f39bd25620b91c662d3c7ed687fe5e0799aaaa8e285571cf39944a2afad9551fed9d1026866726035cb693cd5cfe43c8
TLSH
T1FE5163E08C7D16D1E1BE1A7FB09B78FCC4ECC625F4A8307D2858E9980A7A619648547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25aeae6d0f3c70a3cf6dc9e9911a1992428df1bbf548ad7a56fba9affdf8cdc2
MD5 360757c3c42aa97506addceae9acb4f0
SHA1 83256812a1f7eb4a421f9d497b5569e3a99093a3
SHA512 177243ceb12707b121d9d975af484d7c1f5044a6bf9d8a938cddb1cec5df5c59cb529e8a86557772a4bcbc80ab6fa028e47dcfd4a6379f6bca33d465c6326c6a
TLSH
T1975151E08C7C56D1E1BE0A7FA05B78FCC4ECC625F5A8307D2858E9980A7A619608547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 dade3a27eb13ad33bdee39f15c31ef01e578783fb1645a5d22d5c216ed2a0f6b
MD5 bdac1165fa86ddeb1f980fe8c3182f4a
SHA1 a6ceec551a77ca8ec8841d1fd642ce5cdd0f0228
SHA512 2cef610929514093be5a54739634cddb8b074f99dd05ece34f31471e8226d1eb0aa0c1a796a673b44412db78e14a56b79db1700ced2445f76e2637f1c236866c
TLSH
T1685172D08C7D1AD0D0BE0A7EA49B38FC84ECC625F4A4307D2864EA880E7E61D648583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c513df9a5042813f69845bebf39e59325d77bf1502e10b07eae19e9f11b07952
MD5 caa74ffd102caef52027b7a467b22f14
SHA1 1ca92bd9716c2e33f5cde53938511d260988cbea
SHA512 2a682d44247aa606f54a3f30bed816d6cbc788f2001ccfca04765beeabaefbfa04b0b7e86b1861ad8dd79de49738562d3ec460b6bb368d16c8545a139590c18a
TLSH
T1465163D18C7D5AD1D4BD0A7EA09B78FC84ECC625F4A4347D2868E9980A7EA1D648183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 929a4e77ece3104c193de5101fdfbf2a20f8793c284518b95539ff588c3d0daf
MD5 fb374e4df1706fe238e40ea483471f2f
SHA1 c3418f883da93a7eec843192869fb0fd94b9c399
SHA512 aaf72a661d75707fe15fc5bc4a942b5059145762fbe52fd0ec73e8fee309a107bab916a51149dc3485b2431e879d9093256e83c92ff52abbe013eb389522957d
TLSH
T1C75172E04C7D1AD0E0BD0A7FB49B38FCC4ECC625F4A4307D2854E9980A7A61D648587F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8ab04fd2256226cb9315741513c799ef99d607b526734057e254c1377c9bd959
MD5 2cc5505c878635064f1f1d40b9d3a3f4
SHA1 0199e450728a6d73f3504a01905d1faa29ce6948
SHA512 9bcb881fc4f5a47ba4bdddcbfdb61774ab4b2531a94b6623c405d4540ae279c1900632db4ba52a6c9df57cc499cecc1d9394622ad8f9b280a84db6ebc86aa650
TLSH
T19D5161E04C7D26D0E1BD0A7FB05B78FCC0ECC625F5A4317D2858EA980A7A61DA48147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9130d8dbabe5de8013df24fff5f06b166e31e0299177a06e9e0d4659673fbe7e
MD5 09ab9af38b713cafbf27fe6d07c659ba
SHA1 20e61302d2a90561f1808df1cfc7dd6891196783
SHA512 9e04b5b65cfed554f68207ca5826e100195c3428329584e8623cbabb4aafc18443a9cf7e7dc51b95432c20468092dc8e3db4054b1eaf427f3636f7283e24450f
TLSH
T11D5174E04C7D1AD0E1BE1A7FB49B38FCC4ECC625F4A4347D2864E9980A7A619648547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 040ac7cd6de29aa3f80d338bbd09423f76b9c3d5eac94f5bccb816de83db7ee0
MD5 5ca95989c7f1b71f53ab93539f6e7639
SHA1 d01b38b1ea3f9f6f99804d01dd581edaec8f8fbb
SHA512 bb1655374278e2f6d6546c949f59b4bdcfbaba144d8bab9a07bdf6c0e593869e625b07dd28d249fdc3666385c4b508f75c576d50377210b74a0e06e04444b88d
TLSH
T1A0516FE04C3C1AD0E1BD1E6FB05B78FCC1E8C621F964753D2858EA980A3A61E608187F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy5919.tmp\System.dll
Size 12KB
SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
MD5 67fc1324e53b1f3854557f23b0c22654
SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
TLSH
T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsy5919.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy5919.tmp\nsDialogs.dll
Size 10KB
SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
MD5 b9cf10930a5144fdda9479613ee3c84b
SHA1 5110556ff6ed1559c73cdd444f6e2408db570653
SHA512 bb9947763fea6915e90e662438d1247678576ff944f9918dcbb0c93d669f8a0dd7dd60db95f53e52faf1e0d3d627789cbcd6196441113556acaa6711b6b6f350
SSDEEP 192:VvvwccHJBa8oStSigfl6dblJDBUorNuCjLUoaTOt37Eezqm:VvvwVPa8oStSTUDiorNRjwoT7EeWm
TLSH
T15C22E85BFAA4D2EEC4974136D5BB5B06CBB170125692DA4E0B3096897F233433A2D74C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy5919.tmp\nsExec.dll
Size 6KB
SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
MD5 cf0cac49c427a501d7806033941a6da1
SHA1 92acf906cc962b7e4c4138aac8ecec67c9629b4a
SHA512 7ad31611d7c0657d70318c16c781b7da793c8a19e4dfafcc90abcd4c8eb0dbad3aacf643b558b573502e50f504bb9f384b4df95f0db840e68763f03a7d8e85d6
SSDEEP 96:wC66T7ItPQcwPbfTA3Ck3lKYHxFYSdt4RTUR+4nz:dT7+EEjje4
TLSH
T15CD1CA2AA7C102A8C82F51F0A93F4A07EBA5308125785A3F2A688C0E4F53AF1737C745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1085799203\edge_checkout_page_validator.js
Size 990KB
SHA256 217a62797b59bdfc667227a422876ccd0f782b2ea41d33fc93c36a6a0db35b09
MD5 80cc733f42616192c044a04fc5abcf81
SHA1 1bf191a0a41ffbe64d3d92c4100421282edb02bb
SHA512 8b521e98dbb71462a19e6c783aaf62dca949befa830bacff12d0c13b3edc38e676b8cc70cd5af98dcd06fb50191747e37cde6e0779bc27515d65751af1487b42
SSDEEP 24576:cs4emRApsqvGzkJUAKjKQmwzErmdJt3LPafik0BwrpiU8LRKLRzMEiJsfaGx1huq:cs4emRAqqvGzkJUAKjKQmwzErmdJt3LC
TLSH
T128253C84E1E2253466D74CB960B7D2C4B9DC04583399F1E4FA6C588ADB0FD4723F6A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1085799203\manifest.json
Size 146B
SHA256 d864d826358b5a17c17818c4beb06143f6059377079f0a576764e29f92635145
MD5 154bf0b4087ebebf71107f7c67bdf6aa
SHA1 85886e83753ef9a232bc6a85ecdd90daef3ccb07
SHA512 a388593c464894b76fa730bca7fd4f27246883174f12ef4d53648efccbe9fed6d570ff6217106618cbdd2a35ca9ef260301bc476abf18213a29e973b5e6837d7
TLSH
T1BCC09B73C931AC7115750BD849F59B45EB74574BF511B0563B34018D0B3D5B550607D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1268736783\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1562110714\manifest.json
Size 102B
SHA256 0b11bc370854bd2e625deb04fdfc53ba444e4af63ba831f9de785b44464b59b9
MD5 271bc950e4220b8345b16f5906fb1c9b
SHA1 8b35e3d7ac8aae625e65f3b37d7362b1d2e958d2
SHA512 43412498abc311473210735232214d8272a4e637cd5c1cc234e79f2636f1a3c7260c6c9e6035efca68dc30c6c3f50de479fff69f527b773b17548dfff9cd0107
TLSH
T180B01224EC10F8B3040503BC086CC3D063272F032C4079180DE19F84E80DDDBE071528
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1719655591\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1719655591\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_1865911349\manifest.json
Size 52B
SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
MD5 152537f005b8875f68b1af4ac41c46f1
SHA1 70f529940adc1404721cbc1542c65eee289216ff
SHA512 bfcf5e9523b9268e1b0a546b5786498b1decc624ab1ba4fdd89e2e92edacd20800d731fef37c98aef45c64268d267b97d09f78124167685dd152bacd620dc9d0
TLSH
T1D0900260053491171AC10E546570F8859391661955850D1D0545154806A546CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_665310047\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_735659521\manifest.json
Size 118B
SHA256 69e4e1c13d13f15e8066d6d7e984a96a08d3b2a2ae33fbb218b1e0de5b8d1aed
MD5 4687681b420a5c580fe40870ed6af32c
SHA1 1aa40f91b2ed8c5ea38cb30b81c87a9ac7e21e6f
SHA512 5ced299552785894df9aa86f0cb5d9c057cf73753f81112ef91a8b8dbc6147913e39c27b6327613bc41c447ed230fbbc74881db79853d38e365685132e618762
TLSH
T170B092B00C1AA43B22C09320ECA0668683F84218E8421B1A098036481F882B880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1848_768338586\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

memory/888-459-0x0000013A82050000-0x0000013A820BF000-memory.dmp

Download

memory/888-85-0x0000013A82050000-0x0000013A820BF000-memory.dmp

Download

memory/888-82-0x00007FFF37810000-0x00007FFF37D51000-memory.dmp

Download

memory/1664-895-0x000001358A6F0000-0x000001358A75F000-memory.dmp

Download

memory/1664-894-0x00007FFF37810000-0x00007FFF37D51000-memory.dmp

Download

memory/4856-18-0x00007FFF4EC20000-0x00007FFF4EC27000-memory.dmp

Download

memory/4856-16-0x00007FFF4EC25000-0x00007FFF4EC26000-memory.dmp

Download

memory/6040-323-0x0000028888910000-0x0000028888CCB000-memory.dmp

Download

memory/6040-324-0x000002888A860000-0x000002888A8CF000-memory.dmp

Download