3b44f4ecaf1a9a6d86c0a6691035159d4156c7a14dfdca976aacafa1aa044c5d

Analysis

user interaction
yes
max time kernel
210s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/07/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LuaTools-win-Setup.exe
Size 10.9MB
Sample260705-m8hersfx2q
SHA256 3b44f4ecaf1a9a6d86c0a6691035159d4156c7a14dfdca976aacafa1aa044c5d
MD5 989b932bbe2a7147750152d9198c1133
SHA1 0fe08ade9baea244c6290f854f70985492bb20de
SHA512 cc3a53340f640296534865a9013e6780ce0ff64799a36b214c8fd1c1a5d260384c31df98c6753d3f7905aae572b4d85e229c69b55bd8af4c286ee642c7f66f3a
SSDEEP 196608:K4MyYGDTgG4J2a0040yF5NFNjPnN4Sw6qHn3ILn03t+6E4UqQmbyl:iJGngya60ojFNjfN4SwVI70bUqSl
TLSH
T1A5B60162FF02D0BBD48A01B5D43EB73DBA369E95872A85D34A99385CA8F1370581335F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Renames multiple (6115) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Downloads MZ/PE file 1 IoCs

flow	pid	Process
172	1852	chrome.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	LuaTools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	LuaTools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	LuaTools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	LuaTools.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Executes dropped EXE 26 IoCs

pid	Process
4152	LuaTools.exe
1648	LuaTools.exe
4204	LuaTools.exe
2268	LuaTools.exe
4648	SteamSetup.exe
3968	steamservice.exe
4228	Steam.exe
1800	steamservice.exe
11984	Steam.exe
12144	steam.exe
14028	Steam.exe
13988	steamsysinfo.exe
14128	steamwebhelper.exe
14056	steamwebhelper.exe
13824	steamservice.exe
13692	steamwebhelper.exe
13524	steamwebhelper.exe
13416	steamwebhelper.exe
12896	SteamServiceTmp.exe
12844	steamservice.exe
14676	gldriverquery64.exe
12640	steamwebhelper.exe
15576	gldriverquery.exe
15556	vulkandriverquery64.exe
15516	vulkandriverquery.exe
15224	steamwebhelper.exe

Loads dropped DLL 64 IoCs

pid	Process
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
11984	Steam.exe
4648	SteamSetup.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
13988	steamsysinfo.exe
13988	steamsysinfo.exe
13988	steamsysinfo.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14056	steamwebhelper.exe
14056	steamwebhelper.exe
14056	steamwebhelper.exe
14056	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13692	steamwebhelper.exe
13524	steamwebhelper.exe
13524	steamwebhelper.exe
13524	steamwebhelper.exe
13524	steamwebhelper.exe
13416	steamwebhelper.exe
13416	steamwebhelper.exe
13416	steamwebhelper.exe
13416	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_74B0F1158CF3BBDE3B65AF739E904359	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_74B0F1158CF3BBDE3B65AF739E904359	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	steamservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_mouse_scroll_down_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_button_circle_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\rebroadcast.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\btnDisRight.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_romanian.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_touchpad_click_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_button_steam_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_rt_click_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_080_input_0120.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\6696.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_dutch.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_rb_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamsysinfo.exe_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0415.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_l2_half_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_rtrackpad_down_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\flag_inactive_right.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_list_disabled.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_r_right_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_color_button_circle_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\7823.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\win32_win_min_hover.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_360_latam.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_button_select_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\submanagesecurityintro.res_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\steamui_turkish-json.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\overlay_brazilian.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\lgs_y2.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_swipe_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\xbox_p2_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\xbox_rt_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_360_finnish.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\hp_m1_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\SDL3.dll_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_l1_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_r5.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_l_down_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\switchpro_button_home_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\emailreminder_close.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\joyconpair_right_sr.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_cef_win64.zip.vz.442c00e4368af07d01d6265fb4e68f1ede6166b1_105994102	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_color_button_x.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_rt_soft_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\BlockCommunicationWarningDialog.res_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\libavcodec-62.dll_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\friendsui_polish-json.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steambootstrapper_portuguese.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_l2_soft_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_l_click_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_color_button_b_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_rfn_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0301.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\chkunselstd_sm.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\steamui_thai-json.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\vgui_sc_schinese.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_l_ring_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_060_vehicle_0130.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\licenses.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_swipe.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_button_b_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_outlined_button_square_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\client_login_bg_grid_china.jpg_	Steam.exe

Access Token Manipulation: Create Process with Token 1 TTPs 3 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
1800	steamservice.exe
13824	steamservice.exe
12844	steamservice.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LuaTools-win-Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1852	chrome.exe
8852	msedge.exe
13524	steamwebhelper.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Steam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Steam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Steam.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamservice.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	steamwebhelper.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	steamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	steamservice.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277233435642623"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe

Modifies registry class 55 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	steamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	steamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	steamservice.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	steamservice.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2084	LuaTools-win-Setup.exe
2084	LuaTools-win-Setup.exe
1648	LuaTools.exe
4204	LuaTools.exe
5104	chrome.exe
5104	chrome.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
4648	SteamSetup.exe
14028	Steam.exe
14028	Steam.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
12844	steamservice.exe
12844	steamservice.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe
14028	Steam.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
14028	Steam.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
8500	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	LuaTools.exe
Token: SeDebugPrivilege	1648	LuaTools.exe
Token: SeDebugPrivilege	4204	LuaTools.exe
Token: SeDebugPrivilege	2268	LuaTools.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeSecurityPrivilege	3968	steamservice.exe
Token: SeSecurityPrivilege	3968	steamservice.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe
Token: SeShutdownPrivilege	5104	chrome.exe
Token: SeCreatePagefilePrivilege	5104	chrome.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1648	LuaTools.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe

Suspicious use of SendNotifyMessage 47 IoCs

pid	Process
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
5104	chrome.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe
14128	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
14028	Steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 4152	2084	LuaTools-win-Setup.exe	86
PID 2084 wrote to memory of 1648	2084	LuaTools-win-Setup.exe	87
PID 5104 wrote to memory of 3068	5104	chrome.exe	113
PID 5104 wrote to memory of 4356	5104	chrome.exe	114
PID 5104 wrote to memory of 4356	5104	chrome.exe	114
PID 5104 wrote to memory of 1852	5104	chrome.exe	115
PID 5104 wrote to memory of 3956	5104	chrome.exe	116
PID 5104 wrote to memory of 3956	5104	chrome.exe	116
PID 5104 wrote to memory of 3768	5104	chrome.exe	118
PID 5104 wrote to memory of 3768	5104	chrome.exe	118
PID 5104 wrote to memory of 3460	5104	chrome.exe	119
PID 5104 wrote to memory of 3460	5104	chrome.exe	119
PID 5104 wrote to memory of 1044	5104	chrome.exe	120
PID 5104 wrote to memory of 1044	5104	chrome.exe	120
PID 5104 wrote to memory of 1948	5104	chrome.exe	122
PID 5104 wrote to memory of 1948	5104	chrome.exe	122
PID 5104 wrote to memory of 1556	5104	chrome.exe	123
PID 5104 wrote to memory of 1556	5104	chrome.exe	123
PID 5104 wrote to memory of 1140	5104	chrome.exe	124
PID 5104 wrote to memory of 1140	5104	chrome.exe	124
PID 5104 wrote to memory of 4076	5104	chrome.exe	125
PID 5104 wrote to memory of 1160	5104	chrome.exe	127
PID 5104 wrote to memory of 1160	5104	chrome.exe	127
PID 5104 wrote to memory of 3816	5104	chrome.exe	128
PID 5104 wrote to memory of 3816	5104	chrome.exe	128
PID 5104 wrote to memory of 4608	5104	chrome.exe	129
PID 5104 wrote to memory of 4608	5104	chrome.exe	129
PID 5104 wrote to memory of 4208	5104	chrome.exe	130
PID 5104 wrote to memory of 4208	5104	chrome.exe	130
PID 5104 wrote to memory of 4212	5104	chrome.exe	131
PID 5104 wrote to memory of 4648	5104	chrome.exe	132
PID 4648 wrote to memory of 3968	4648	SteamSetup.exe	134
PID 5104 wrote to memory of 3276	5104	chrome.exe	142
PID 5104 wrote to memory of 1800	5104	chrome.exe	143
PID 5104 wrote to memory of 4608	5104	chrome.exe	144
PID 4228 wrote to memory of 11984	4228	Steam.exe	145
PID 3288 wrote to memory of 8500	3288	msedge.exe	160
PID 8500 wrote to memory of 9204	8500	msedge.exe	161
PID 8500 wrote to memory of 8888	8500	msedge.exe	162
PID 8500 wrote to memory of 8888	8500	msedge.exe	162
PID 8500 wrote to memory of 8888	8500	msedge.exe	162
PID 8500 wrote to memory of 8852	8500	msedge.exe	163
PID 8500 wrote to memory of 8672	8500	msedge.exe	165
PID 8500 wrote to memory of 8672	8500	msedge.exe	165
PID 8500 wrote to memory of 8328	8500	msedge.exe	166
PID 8500 wrote to memory of 8328	8500	msedge.exe	166
PID 8500 wrote to memory of 8328	8500	msedge.exe	166
PID 11984 wrote to memory of 14028	11984	Steam.exe	169
PID 14028 wrote to memory of 13988	14028	Steam.exe	170
PID 14028 wrote to memory of 14128	14028	Steam.exe	172
PID 14128 wrote to memory of 14056	14128	steamwebhelper.exe	173
PID 14128 wrote to memory of 13692	14128	steamwebhelper.exe	175
PID 14128 wrote to memory of 13692	14128	steamwebhelper.exe	175
PID 14128 wrote to memory of 13524	14128	steamwebhelper.exe	176
PID 14128 wrote to memory of 13416	14128	steamwebhelper.exe	177
PID 14128 wrote to memory of 13416	14128	steamwebhelper.exe	177
PID 13824 wrote to memory of 12896	13824	steamservice.exe	179
PID 14028 wrote to memory of 14676	14028	Steam.exe	184
PID 14128 wrote to memory of 12640	14128	steamwebhelper.exe	186
PID 14128 wrote to memory of 12640	14128	steamwebhelper.exe	186
PID 14028 wrote to memory of 15576	14028	Steam.exe	187
PID 14028 wrote to memory of 15556	14028	Steam.exe	188
PID 14028 wrote to memory of 15516	14028	Steam.exe	190
PID 14128 wrote to memory of 15224	14128	steamwebhelper.exe	192

C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe
"C:\Users\Admin\AppData\Local\Temp\LuaTools-win-Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
  "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe" --veloapp-install 1.1.0
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
  "C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1648

C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
"C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
"C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffaa28cc728,0x7ffaa28cc734,0x7ffaa28cc740
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1808,i,12612493715440324571,3613750191314186163,262144 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1660,i,12965253543325376341,14063927448812506031,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,10999489051915334096,8424746229704420272,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,11653917213311047196,13959182983366960177,2097152 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3280,i,11844768714216851907,10128138055566184033,2097152 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4480,i,12924183341628851007,11339819932580166897,2097152 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4488 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,2015704739691351689,11143379131548717940,2097152 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4952,i,13971640261858793894,5324202060383379995,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5076,i,14412907735148171426,16360909107656625227,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,17943010395501710629,1449375712489853951,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5536,i,6180643803171654994,11727347020636932902,2097152 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3460,i,18303118264157088518,2055288823401557333,2097152 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3260,i,17893879185701574261,18092022025142820076,2097152 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=4804,i,7799562200833603605,13338527545582858560,2097152 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,857582296699502293,10031887777966758009,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4212
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3564,i,11304044355445711900,9265720190861459051,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3552,i,4104362807054211421,17140346246955471239,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,547504254367755473,3243619046927715478,524288 --field-trial-handle=2012,i,15933597760205129342,4849078080798644366,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4832

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\steam.exe" -silent
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Program Files (x86)\Steam\Steam.exe
  "C:\Program Files (x86)\Steam\Steam.exe" -silent
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:11984
- - C:\Program Files (x86)\Steam\Steam.exe
    "C:\Program Files (x86)\Steam\Steam.exe" -silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:14028
  - - C:\Program Files (x86)\Steam\steamsysinfo.exe
      "C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1782866176 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\5EF5.tmp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:13988
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=14028" "-buildid=1782866176" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:14128
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1782866176 --initial-client-data=0x274,0x278,0x27c,0x270,0x280,0x7ffaa424aea0,0x7ffaa424aeac,0x7ffaa424aeb8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:14056
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,4789051267705196883,9974475978780695716,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1936 --mojo-platform-channel-handle=1928 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:13692
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2224,i,4789051267705196883,9974475978780695716,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2240 --mojo-platform-channel-handle=2236 /prefetch:3
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:13524
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2328,i,4789051267705196883,9974475978780695716,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2540 --mojo-platform-channel-handle=2536 /prefetch:8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:13416
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4064,i,4789051267705196883,9974475978780695716,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4084 --mojo-platform-channel-handle=4080 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:12640
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=4748,i,4789051267705196883,9974475978780695716,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5028 --mojo-platform-channel-handle=5024 /prefetch:8
        5⤵
        Executes dropped EXE
        
        PID:15224
  - - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
      .\bin\gldriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:14676
  - - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
      .\bin\gldriverquery.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:15576
  - - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
      .\bin\vulkandriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:15556
  - - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
      .\bin\vulkandriverquery.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:15516

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
PID:1800

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:12144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultabc080deh5a88h4a3ch9372ha34846e53c0f
1⤵
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultabc080deh5a88h4a3ch9372ha34846e53c0f --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:8500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7ffaa8e8c188,0x7ffaa8e8c194,0x7ffaa8e8c1a0
    3⤵
    PID:9204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,10186502379515096274,4811876579558778215,262144 --field-trial-handle=2040,i,5616386624975699153,117684715578723751,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
    3⤵
    PID:8888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,9656736007179581996,1645150498158637567,524288 --field-trial-handle=2040,i,5616386624975699153,117684715578723751,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
    3⤵
    - System Time Discovery
    PID:8852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,4883977723239614600,6549170278733813653,524288 --field-trial-handle=2040,i,5616386624975699153,117684715578723751,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:8672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,6551611785234864146,13576953961076558765,2097152 --field-trial-handle=2040,i,5616386624975699153,117684715578723751,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:2
    3⤵
    PID:8328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:8796

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:13824
- C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
  "C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update
  2⤵
  - Executes dropped EXE
  PID:12896

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:12844

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x3f4
1⤵
PID:14832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:15120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SteamService.dll

Path C:\Program Files (x86)\Common Files\Steam\SteamService.dll
Size 3.6MB
SHA256 6e8870c59fc89908fc64e25560d306ce3d6d3e420212a9a29b488d120d18f100
MD5 dca45388a84911af7186689fd225c6dc
SHA1 e57539fcd9f8fc59ad94ee0efb1ab35e914cb063
SHA512 2df1998ef66a5c7559462791950ef6c7ac0cb0a718ed0b9a754dc8d20318115edb093027de6b1597410f71ae77432cdab08f9660080df8a258b5a465c07e8222
SSDEEP 49152:YWpaIr8KjH/rGXfyjTdb+P9j76FGS20I7cSRL0+S096tPx3BVw9eJRTOxDQvpD7:YWpXnjH/sfydb+Vj7eGUIYW0+R6T3Bn
TLSH
T19206BF12FA42C172E49E02B5646F9B7E9D7DAA204739C4C3A7D42D699C301E33B3B356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamServiceTmp.exe

Path C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
Size 2.8MB
SHA256 26181987d137f76c514616a1ac52e806fc474f6afbeb0c10b2d33c939205bf92
MD5 09574ac126b2550098533af1d685aada
SHA1 3e4822c438bfb7a01d148a9b8fdeefb98c3093da
SHA512 49b8a220497cd26d999d48238313f0a2daddaac2f9756093182f51841003a10ffc0678e29895ed3a21149afb209eb2d0cf92c44b36a33e9fe10ec9e261bae6ad
SSDEEP 49152:e2v9HjNZZIpT1EQkGok4PetYsXqDWtrOtPLGH1GJ5DmWV9SCbJB5AQMW:e2vFBIpT0GX4WtKDW49GHEHmi
TLSH
T16FD5AE12FA4189B9E9D31174E2EF577A4A396F20033588C797D03FA958325D2BB3E385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuidsdk.dll

Path C:\Program Files (x86)\Common Files\Steam\cpuidsdk.dll
Size 3.4MB
SHA256 2c74ce7eae980c664760f0b0cf5e9852de9823e8a7b9dcdb4f6c30a5015755e8
MD5 a09978377657626e40cedea136bdb304
SHA1 a6c851a1c6c2a7158c8d9d17391904b56e954ad4
SHA512 593dc39fd2d3aba7bb8ae466a4362194c9df89abe0e3f49434b344aee738584fde4f3e6d21d239fc4bf7b86de167f8d7f2c9cd41c218be34397179910acb0fe6
SSDEEP 49152:hbK+rkFjWRrHH4PKjis2FSnT96gccjvQ/WnGvi4KS/g:l1kFXPKms2QnZ3KviN
TLSH
T131F56B51B3C89CF1D0AA0A3103ABAF194F79B7549B3886EF56D45D8D2D319C0BC3E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashhandler.dll

Path C:\Program Files (x86)\Common Files\Steam\crashhandler.dll
Size 400KB
SHA256 7cdc1d5d3c62f9e9639c82448e654bbb1b82e7d0d249b049c6b3714b28cbd1a0
MD5 8ea6e69b5749efc3284728dc25446d47
SHA1 326965e829acd872717a088b28233aefa6e64ff8
SHA512 0ce1a1454a407bc6a426f4eaa0b9f9838759b46c798aaa1d83ac10e0c579d7a233dab01cb2fcccd1af6a9fd2a9fbf4d48a7437073452ec5d40d52ba0754cf479
SSDEEP 6144:nrDdiG8LpFvEx/aMhnFujdYgD3X7lLM1lMRLyd6wB78mmkJAOfGZW08:rDdiG8LvvSpFujdYgDHcMRLJkJNGZw
TLSH
T106949E11F892C073D57E18306979EF6A5A3DB8601F68A4EBE3C40DEB4E706C1973971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.exe

Path C:\Program Files (x86)\Common Files\Steam\drivers.exe
Size 7.1MB
SHA256 06099ff2cd3c07315e1d47d1e6c1bb7caa6166c079af2265674f0dce3a2e8294
MD5 82b8c286771eed8a5fc8ca83028fa8e9
SHA1 84dda52b191f6acd70339d955e1edaab30ae1eab
SHA512 cf4f6dbd6f53fbef4c5e26569117f1dd38c15e947aeaa2cafc9b2bf2b11a2d9afb83caa3a3804d405b9b1b8d3c3da9d5f5d291a18942b0114ff5abebec9ce0fa
SSDEEP 196608:RNmxPFWJgzW11PDQhACcuFWJgzW11Pko+NbhACcX5:RNmKJeM1PDQhApJeM1PubhAp
TLSH
T16C7623657A050EBCEBF1B674EBDD532513A81D9502BB98CF13D03F893937D82B99A081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secure_desktop_capture.exe

Path C:\Program Files (x86)\Common Files\Steam\secure_desktop_capture.exe
Size 3.7MB
SHA256 666f294fa46fcd92c5fb4e391011705104082b9da2e011437d501b36e75a5e33
MD5 29bdf5e43b63bfef6440faaef8eedc43
SHA1 b40be088c522b7fd1a9eeb3c7066d880562bbb18
SHA512 361ff2609e5a247d62ff17a840bc95946d7ea18c48d5c4347bbfa27f31a4f2791a127890994f0c2a043b218e30db311b0851f0c7c4fe5b78d5d977ac14231125
SSDEEP 49152:PGtlq1aVwASOz5IU6iyaWkSyrZ12B+fti1oYvJWYWQaIhfCj89zd6Hekt6Tql8Bc:6++DHz1i1oYJvJC8ZGVhkbYmC
TLSH
T1D2067C16665901FCD5B7D138C6CA5627E7B17C0603B18BCB02E4BA661F33AE26E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service_default_Public_versions.vdf

Path C:\Program Files (x86)\Common Files\Steam\service_default_Public_versions.vdf
Size 808B
SHA256 6f9f3db4f4b8a98d921ffcb7414b2adae32f3803e592c06b9c7ec16b344e009a
MD5 099d293e4332f378d53075437e395662
SHA1 dda8ca4dff68e3d1469115540dd120a094e0f529
SHA512 6f7c076a139df168eb05c9a978ca225ec42f2b7cad5525e51be14997c104be205af1d33cae8eb8307c82ce25e933953e5aaacc8935353cbd8986a0b79e3625ff
TLSH
T1AA01491FD183FCFB45640B6A5B8B98F6472E149BACC76C433D41105D91F9838651561D
MD5 SHA1 SHA512 TLSH

Submit Download

service_log.txt

Path C:\Program Files (x86)\Common Files\Steam\service_log.txt
Size 597B
SHA256 8cd967229cdf1c4de3b97d76bdb3a63ba4d61dbefe7959144892f05e7ef8ca6c
MD5 d5f02e61e9c6e78aebbd4f166f31bc16
SHA1 490d1a7d79048a472f89a85e1942fd1e52947768
SHA512 c61bb84ee6caf614d629f9a93a414602fb5782ee08cde45f1ad6d467d36923d4e9cd3aacdafa23f1d48fb080ebc458a5bf1fecfaf477bb06c909b3828f2e8fd0
TLSH
T198F0A93A49D9C3FF341221806B9561026FF68D2B25C5611C2264DA05B784D4CBB40DE8
MD5 SHA1 SHA512 TLSH

Submit Download

service_minimum_versions.vdf

Path C:\Program Files (x86)\Common Files\Steam\service_minimum_versions.vdf
Size 727B
SHA256 a75ecb06d45017d2289ec27dac9f418c6ef82a9352e012670a0c67161c25c52c
MD5 47ea8d10c7c8e5ab9259a6b164a9e2d3
SHA1 cdaedb2b5d5b937930eef504de997592e95f487d
SHA512 8b85dffebf9e21e436d48292fb3bce54e01b1470bc1fc7dabbee2233743c7025cd7c59523ffa1d0f1ca50d2b1edf7bb18787aa4df61d7dfec155323ae0eb1ccf
TLSH
T1DA01DC1FBCC2A8BA2BB2465B8BF78CCE6F780906549A3CC05D840C4893E8E1C1709045
MD5 SHA1 SHA512 TLSH

Submit Download

steamerrorreporter.exe

Path C:\Program Files (x86)\Common Files\Steam\steamerrorreporter.exe
Size 691KB
SHA256 ae57dd7b7f3c140625533df0bd614dfc4c8408d91db652ac4cba45daf72741a6
MD5 adb12c3aae35e268507946c3ec6f6873
SHA1 73b1b3dc13bd6214025aca508491f5d58eba0108
SHA512 5641f252771fa07ade23a02855af6ba35c8ba23c32536210edff09542b7343d876be18768d88c4efd8cd9e185c5cbd85c74945b096c5e98c4eb0719d822c2664
SSDEEP 12288:fX+v2auF7fLXh1oyx3UG8Nwghm5oprCdo:fX+87Toc3UG7ghmSwdo
TLSH
T1C9E429607901497DEBF07A34EBED937513A92D51073758CF23D03F8A3932AC2AA7A156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamxboxutil64.exe

Path C:\Program Files (x86)\Common Files\Steam\steamxboxutil64.exe
Size 751KB
SHA256 82b1da408da1be33da6893f66ff8156cc6923cb5c7f7aa2cc988f6dae414b882
MD5 eb973e607fc9868b96ee036ba8fe83dd
SHA1 507d2c2267e23a987ff99d2c7bffc1ee268fd189
SHA512 c5fc4901e289b7c23f1c9c998885ed9ead63160c336e5c75c9ed40987f38ba9294643c79ab6b095a3ef04759c5d4201e0481eb7d7753fe0a8627a49201c7ee53
SSDEEP 6144:CLL0z+/CS76mOUvTcU0KQAfngWLPhyJyJYqLu0s4Mq4QJWuLbvER0u+GIIIIIIIx:CLL0zqCS76STcK7dtJk0sN5AAm5j
TLSH
T142F4296466050AFCEAF1B638DBCE5211D3B13D52023795CF13D47F8A3E33A52AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Steam.exe

Path C:\Program Files (x86)\Steam\Steam.exe
Size 4.2MB
SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
MD5 33bcb1c8975a4063a134a72803e0ca16
SHA1 ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65
SHA512 13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49
SSDEEP 98304:7JeV/ztZBe91oiImuUiK9N9EGQKF9lSHbr7aw:1S/hwkmg4EpbrOw
TLSH
T1C516BF62BB41C071F9C201B964BE9F7A497DAE204775C0D397D43E6A88311D32B3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 16KB
SHA256 1a68a4ed86b4d5aaaef41c0646121f50f34f9dbb165241e7a362327a542f6eab
MD5 b57e8af86f13eba6be51e64d6bf2eace
SHA1 2c5a80139fa1509d2dbd4c5ecc0c34c60b3bb636
SHA512 788c829efb261bc2781f7994333bee26108946d0d967e563b15a13a363c054ea100893f2eb87abd698a2cce26f75ec4279c5a15b3c3b180b414e8a69508af8c7
SSDEEP 48:Pl9XN2Fq2Gq2o3qD4Kz0Z5OigLbeFUqI8wZSbct3BZFZSa8wigc43VOPCeHzOkUB:Pl9yPa5Bz0pDPMUCYPMUC/njVrr
TLSH
T1E1725B4B692C80AF13555A6D12E6A0DE129C427F6A58D1F3B7E21B1B7108F1DB1FC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 1KB
SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
MD5 a2ec2e91c3ef8c42e22c4887d032b333
SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3
TLSH
T1A121002E2BBB491FCE0E0C7BC18FB9A0543FB15C39C314C4BEA4489E7D20E11506DA14
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf~RFe5b7eb2.TMP

Path C:\Program Files (x86)\Steam\config\config.vdf~RFe5b7eb2.TMP
Size 1KB
SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
MD5 6e6a2b18264504cc084caa3ad0bfc6ae
SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679
TLSH
T1FA119E5C6BB7490FCF1E0877C28FB955582FB08D79C354D8BFA448997E10E22106ED15
MD5 SHA1 SHA512 TLSH

Submit Download

btnOvrOffBottom.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOffBottom.tga_
Size 444B
SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
MD5 89cb2bc5ccdab01b0653d4dbb3d6a062
SHA1 afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9
SHA512 e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653
TLSH
T1CFF004040C400137C744757DDCD7C5CD77D4F4301540014C57D0307504D5041D1F44D0
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 6KB
SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
MD5 5a5715177822e69c98aab578421ae78f
SHA1 175ea27d6ef6df27fae93a724c94b2c770f78205
SHA512 b11d05dff7f9ce55c2b30de82709f5aa9b410734e1b88a6879e3489394a5b36a27389022de0a741a16f70d0639439d4f75942c3fd604567d63b9ec229d86b331
SSDEEP 48:dfnnnW6kQhYvc072yybS7WWjsHannnffw:Xr
TLSH
T161E12E6C226CC9DA805BB8F0CA19CBF804060EC9E85E11DFA0D73E8CFE38C8AE431500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_localfiles.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_
Size 14KB
SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
MD5 c4e538289a4c12da96cec77e7a3e36d8
SHA1 12d57144c0e79edbabc8033a9bf22b1720299f2f
SHA512 db3eac8c05b7277a6ab9974c682b20350705fcf616040204bab053d98cf193c2d6fc416eb571ca67f7e53bda59ccaddc0351bf60310a64dba2d83fd9aa539ab1
SSDEEP 384:1MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMrMMMMMMMMMMMMMMMMMMMMMMMMMMMMM0MY:ABTA
TLSH
T157626B16A05E37CE310A055AD1256DA3FA2021F58355346F30FBDE1668702B71AEEFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 15KB
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
TLSH
T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 92KB
SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
MD5 323181f4e9013b8b341897abd322e56c
SHA1 85e2e4a5d38c515185415bd4aa8d24f32d428fa2
SHA512 24fc5c82e25f2ee689b0888c6905f13ae74037e8db06a39b247d525071c858e8a284600dc5e33f006a2657d04c0b045c146c2af0951c7ecdceec34082a95d004
SSDEEP 192:JjJzVPBVK2A54RrjK/MQqLVWT5qOuIToER2zrpIEl:Jd5FjKkQqLVWT5qOu+tR2znl
TLSH
T1719359726F6CFC49BC94C88EE14132D065725AE7804B2551F8B4EE30E1E7ED72E9A94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_button_news_mousedown.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_
Size 20KB
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
SSDEEP 48:X77qTxcazfhjZRRRRRRRRRRRRRRRRRRRKFvJJJhmAr:X774zmvJJJhmu
TLSH
T18F9209380E706CCE81CE9A27AB348AD2A9D2DC6F36632E348653350FC1948543EA734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tabStdBottom.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdBottom.tga_
Size 48B
SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
MD5 bd64c051ae2410eef96839a3cb7297f7
SHA1 95a5b0455d69127fe50e396153c795d9914ce0d4
SHA512 ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793
MD5 SHA1 SHA512

Submit Download

steam_cloudsync.ico_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync.ico_
Size 47KB
SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
MD5 da277b7a17374bde018ffab02015238b
SHA1 ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd
SHA512 5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53
SSDEEP 768:CHjkEJqa7vWVw70BCDiSfUpWy46032U/C0Tz+3TaZeYJqF3D7RTB6F0SBS6:CDlJdvIw72ILUsyi9/CQ+34eY4zBCph
TLSH
T19F237CBEA78A557DC9A0473840CAEA7C433A6EC5E0A7C2C751D07F5B5C35643BE0E1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_cloudsync_posix.tga_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync_posix.tga_
Size 64KB
SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
MD5 be3a210738638c4f33aa7e01cb475e26
SHA1 02276a10cd77cfd57e4c796c45d69d526f8420bd
SHA512 6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb
SSDEEP 1536:fQF+zt5w33333333333333333W3333333333333333333DkqbbbbbbCm/b77vBQT:d5bbbbbbCm/b77MquuamizaWraS2Dz7o
TLSH
T165535F64EB112ABC9EF1BF05A6EA967813165D42113BCCFA168D7F4231F3A319DC6D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_tray.tga_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_tray.tga_
Size 1KB
SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
MD5 7ecf5b072a3c49209af4710481dff5c9
SHA1 6b49560eb27b2d7cd169c066208d4fd3a4863f3b
SHA512 ec9ed9d824471655a48b48324a023a7231560810f6403f0ded04af35b51dde4dcd244bd4147570ac9c5cf0c841af33caaf8de7d60cf20f6fcbedbd1717d6d262
TLSH
T12D1163C2ACCD1788DB12C53807E6E6021C320C1608B66EC9B4277356097B43CAAF649B
MD5 SHA1 SHA512 TLSH

Submit Download

filter_clean_bulgarian.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_
Size 23B
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
MD5 SHA1 SHA512

Submit Download

filter_clean_schinese.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_schinese.txt.gz_
Size 33B
SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
MD5 dd542d7ca2128ef0e7c3411b5ab9e8d3
SHA1 0a98ce0efdb5fd75d3c697f06f3c084d5882dc49
SHA512 0d0c1801d0bdf69d2010b0e26ce0a156fa50baaa0370330bdcdb879cbd09a6146d7bc89de2d5ea6f3615123a60e1be87def44c07f92de24615974e3cae2cab85
MD5 SHA1 SHA512

Submit Download

game_details_header_green.tga_

Path C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_green.tga_
Size 2.1MB
SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
MD5 1ed17a7d11da47608f99d98a8d249e6f
SHA1 ea3d9e0de541be2a346e93e63286f0265ac302fc
SHA512 e423be766c3d615dee6f3ed8b0b7bb5735ec13617a93f6f5403a3e7c4c379b9ab87e9fd5f0c9fa9338f656e321488d0aba895ac9f77da413e27473b2218b9ac7
SSDEEP 49152:q3m8TZFdk4Sd9DM8CsBALhExgBrPzkpRkQhbCh6:fDM8o6xgBnkkH6
TLSH
T1EEA54B0FF4A936693DC1EB9E11B1F1F438EA07534182DA93BDD79B4960C2C84A741B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 02c02417b9351be79d7b9d9b25b5e44ad51c9aa75d92bee005891f320bc3d98c
MD5 08cb551649fc13bb492034b050674b4f
SHA1 de2e7072576cdae3ce05e8539c700c425f8706f4
SHA512 180e5735e57a5ccbb8c2a6c37ccb15e290682231e7cdf169dd4b83db350972b15601c7d6fbfacebf2eca995e4a0b6b26faa073edbb62158dd12a65f94243b65c
TLSH
T115E02B9AC821EC271CFD572E60604A47DB50235727A0845B373D8208CFB5677028595C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 bf18f87beeb50ade0c4579233d7437061ca63c297bb41da2416e53535bf27d28
MD5 fd09592d1f3a8d84c27310a1a2ee158b
SHA1 d54a79d4f9846686b2ef5abb5988b16729c98690
SHA512 e1e7b4d6c5e31f3bc03408be9d6a4261e85c5005e7183029e8725b133cb812912467bf54933720ed50d44f57719c342384093fccd6fc7af03bedfac380868deb
TLSH
T1C941E8B5F4D9BE02CFE09579C0B90DCCE2825ADB43502FFB22DD8D5DE46B0E10459948
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 16bfd9d429f98d1b077d711d921db523e780222c86acc3b447061922a4de2b03
MD5 8e3314da7b17a33039f3a5c0d4830c84
SHA1 c2cc2e13a8b278960702f9a6a80e284631dadc99
SHA512 f9f4d7fc749f4bbcd190a3356bae6580059fae566e53d7ce4cd57e24dac7bc9bffb4675c1b6b941501820869c8b9f2f4a5c58a0e9b4861a54deba990e8457aa5
SSDEEP 3:MsEllllkEthXllkl2zEkl0cP:/M/xT02zn0u
TLSH
T1D544040C7FC01D4DD50010304111C350C370D4140D115F43345104135CC55C50C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3a6832409fddf4b9da50e8a07b8e4594a0da91c487cc12b2ceb4e1ea918f6b36
MD5 6714abc770cf17713b7271ffd733719c
SHA1 e103dd18b1536d1e3a73c8b50c2e008a10a24711
SHA512 ad974e35034bd5b510e85120a75170c88244b145717b5107a56315cd2d6cfa00a56ab1c9b2c681302af9da0c4fa348434b8848cb5f9df637057a208c0c9ddff9
SSDEEP 192:Dq/QnWrVaI4gr58lXAY44ENP2aPgfPFN/IgomrjK:Dq/QnWrVaI4gr58lXAY44ENeaIfdN/If
TLSH
T157D1AAFBC3E4856D890156F8AB156E2FCE291A14432C3C66C8D9BE1B93E2871E21534F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 dae3ee2b04323ecbda27af64c4f0e04e391eb22d511d713e219b734e394a0775
MD5 871d14dcc5fffb198a14a9a88c04dff0
SHA1 497b6d5f991af422b0acaed63da4e46494d9a00c
SHA512 00ead75ccdc7965eba9abe1c8e7d86c87ce32290a0f335c6619b3203254a52d295492be28b34b15f35da3c4bcf9c7241ac9984fc9ccbd5af4f3572a55cfc34ad
TLSH
T114115CA797EB795B206D05EF4E08B80A69B2B43402416CE1CA97536CA0D65F70B19166
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 f058efdc30f30c0b2f2bf8ef9f6dc55fd27da7bbe5ab9cd04acf92c47092d779
MD5 3215b09bd58ddec090a3ce3656965aa3
SHA1 2c8330e4342a89bee495f87c3311c899b492372a
SHA512 e8e77c6c8272457601e44e21027654aa1dfad25a1c63c8e0a0d3c6a5d96b6fb4081bafb743c66437b5186ae99206d78222722d87cfc81605927da8e90984ad4d
SSDEEP 192:oRVcBzDOgFSP8adhIv7ApAPRp2GYKg9qHsb+WNy2Uui4Ts2cNtkw4a4PUaVyIsnH:oRVmzD/C2kUXqkwyFt2GYa4PT8
TLSH
T16E52D52FED14693BACDAC329F9127723D7F5242522942E84EAF88A1C16DB5CD221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bcf41af72444ba5318390191b7a951ebed2b95d5a1a01affeaec897d5ef8987f
MD5 ecaca7a13aa2e5ef45444a429c07ec2e
SHA1 ebf27cf0682805cc7bae4d40d3bef672f792a45c
SHA512 09ba07b98a42fe06afe5598da460c70160f11ac270aa68a0cd8a4f62a1fd81fc686997b4ba4b3d6021c42f9d26f35fb408ac24ec1826a2210c1388fe738bd1ed
SSDEEP 192:oRVcBzxOgFSP8adhIv7ApAPRp2GYKC9qHsb+WNy2Uui4Ts2cNtkw4a4PUaVyIsnH:oRVmzx/C2kUXMkwyFt2GYa4PT8
TLSH
T19152D52FED14693BACDAC329F9127723D7F5242522D42E84EAFC8A1C16DB5CD221711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
MD5 28aca1b912d001e337a9e715a111a353
SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
TLSH
T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 ff26b5a203c1cefbd583a61db26b21b759a8a644cd0a3f6f12805a3aa9789ec2
MD5 0aea6677d880c1446a1b48b2dbee4134
SHA1 bfcfee392451685a03ce1a254623daa873b92445
SHA512 784a1f0dd5db03387a77c82387fc0b12e7251697633f025fa9c36c20bf06365967876ad22b3b0d7bab94e702b7dfe5fa8940604e96015f340bfc34332dab29f7
TLSH
T180B0120480025581C04602F0626614C872245F109B0A2F1183E46932CC352738414050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf7e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59bf7e.TMP
Size 96B
SHA256 e78b96f7fd1311805d5ef776aeda7d06fcaa396c3b9d2241ee9d5e320acc46b2
MD5 6abc9fc8987b8bb1f8e5e36b835eb5fe
SHA1 092e4ff64307c0bd3e8f4641a6ac40462fe1b71e
SHA512 8ba18701d8fd8487c87ebc3009f1fedb80b12950b4a6806bf9ed450ad4ad93fac4ae71205fc1d7d363b9eb1af51abed6eec0f92c1e38950410d0489e138a979c
TLSH
T1A4B0220CC0032202C00203B02CE080C83220EF20CA030202A2E02A33CC20A3208203B2
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 483aa704c45f718857154eaf189a002f9ea24069b59be4af78f6cdca8673bb33
MD5 280614b05688271b1bffa3a9aec9e82a
SHA1 3ac03296be392616719d98c962c3f489693cfc46
SHA512 3ece2cc7005ad3966b9abd7a9c4a04b24d162a026181683fe445d182e98e51dda70329f5964c671d86830f36669a3d5c59aa1ce90dea8de458975f94695a1af6
SSDEEP 6144:7oJLf2kPVZRUW0u6aCJxm7Rkm1tYpBeh2BAoj:7o9lPPRUW0u6aCu9oBGcAoj
TLSH
T1FC341213BDB368355CB4D767B0CF1E1628F31EE76928F84489F84A0463E6BC94A05738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 ec1f8b6695135d97363c3dbfa01382950a43b1035387e4e9d8f8617e2cfac31a
MD5 99efff597b79ebd213575f64616646ca
SHA1 1d2c504aadc19977506022e6da4d5efe34e04073
SHA512 35176da70439c66ff0d343557888323f5691c02b8905462c6a3ea755e85fef09f7df8f7f232b59254e4f7a4c7545557b31f4e5710de0f8f9a86fff584b8c9eec
SSDEEP 6144:moJLf2kPVZRUW0u6aCJxm7Rkm1tYpBeh2BAoj:mo9lPPRUW0u6aCu9oBGcAoj
TLSH
T1B9341213BDB768355CB4D767B0CF1E1628F31EE76928F84485F84A0463E6BC94A05738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 92dd5c3768a82f5f4c78f3ff6eadd8f52a4e27cf37c5a879f0ac15dd8bbc04a3
MD5 9c1a9386b971cc7eb4f578f4bb4e6414
SHA1 c3255b459fe17d8a4ab4e4b46893d9b0aa9ca503
SHA512 3e619aa505b31e63c280415c2be782d1f0931bd6bc486f1df4ff5c1f66dd2a76c19922a6d9b49a763624492a90eb09c58d2da52b4f3c3ad03cf1cdf28752bcb9
SSDEEP 6144:YoJLf2kPVZRUW0u6aCJxm7Rkm1tYpBeh2BAoj:Yo9lPPRUW0u6aCu9oBGcAoj
TLSH
T16E341213BDB768355CB4D767B0CF1E2628F31EE76928F84485F84A0463E6BC94A05738
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 417dcd9c102d904c0a11ab947dd1afeb777135d6fce58cc33557bd99dc86fc87
MD5 5dcc47f682b79f20697a5bf07facf250
SHA1 8fd4e4eb02477cc3665247d08484656901f878cb
SHA512 dce4b0c7aeff8158fc56f19e0cfa436af64e6883500e1545dcc7323868801a7a9a0b8935f4d0f23a6b25ae0079c619e78d7e60cd0f4a39ff9db0e4bd83498cfa
SSDEEP 3072:AKGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:am7Rkm1tYpBeh2BAog
TLSH
T196C3023B5D75E83B5CB5A74EB48E0B1E2EF149A6C930DE92C8D85A0437F97CD0A44A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.Mvvm.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\CommunityToolkit.Mvvm.dll
Size 143KB
SHA256 19b2144fed9600d58a742a5a4a5fd7b10d4d0d2c2e79f5d8019307cf5657044f
MD5 c5aba3e739e682a6727f33e7c89f1f3b
SHA1 2c656c3c24e66aea61bda770f146d8ccff5c868f
SHA512 fd7269021e7064742b1bd2b361d90ba5f848ba9f275f1b1b7a1459b231d4f012fa1bfe37cb0c01f524356e6bbc8a91f7eaddc91202b7fd498b6fa016b3a8659c
SSDEEP 3072:TSieaCkJBmT1YhqlgBE6KZogn10iAj+QPuzO/:TRVxmYe6+n10iV2
TLSH
T1AFE39E1273E85A33E6FF1B75B4F0808A8F72D707ED26E34D958D82920963BC059517BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaTools.deps.json

Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.deps.json
Size 36KB
SHA256 ffecde88f746ad3bb09e5caa552a5eace7640d88f2f48794342414327348c496
MD5 5225291e2f0e68ae8807c4d25b9b90ab
SHA1 19443ffc61d847b0613d156638523617512e0330
SHA512 384a0cba862b0f88e120b2a16dd1e7a520bdfb533dcd5d596cfd4c47d0d7170cdcd6f489d6ebb24d2a764fbb4dc97d238bb34cf97d452305fda4da323ef54efb
SSDEEP 192:CTrWrHwIIqoZoqsZuNTj6uTVZECYIh23RCzV4oFby98ZWjdIyfnNfekS3:CTcHwIIq/MpRYIh23RCh4oFbyfxIyf3S
TLSH
T1F2F28A26E8585E234976B7A6FD784991FA35432F3004684A7CFC294CCF76BAA5093F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaTools.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.dll
Size 736KB
SHA256 80428fbd1145a412ee496a3f6262fb4cac105c76a7a968dfd68c8f4a9e8ffb34
MD5 47d8cbd03d888476badbfc66e130cb47
SHA1 f2e677033862e39831d0219b624664eb1fb8f2ef
SHA512 93c5adcccaedbd0d82f516a47bbe933d334a0810bddf7d3fa328e47c89f83bab6beac96425aabb06991fd386bfd5c06c8c909602e4d8528f041a1f70e189325f
SSDEEP 12288:GcAofdlxFtfmAbWrKJFx7gMnUfHHIWS6+qHOZC:V1lT93diIWP
TLSH
T18DF4496122B185B8E4AFBFB69421546D86F5EF427047E33E0C5778FCE8FA3928581253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaTools.exe

Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.exe
Size 242KB
SHA256 0031f20a61bab74a594c6867f1a3c8442e1cdeca5917b9db46f0b7dfcec1b37a
MD5 e87805f5028a11c26108dcb78fd64109
SHA1 af483b7810b6906b9b315dc2c2eb1fc52df2e995
SHA512 94dce739cc73b330c8ee898bc1278e011b1d6490b3e9652a216f5e9f04d959036af612f20d603c662e1896134d362ce73491e6ad397786c23366e4447575cdc9
SSDEEP 3072:Z+f4nYTC3LwjBzaQhlG4a7qWdCXcXxuZjwxmBynIyBF:Z+f4nKvaQhcF7qIBxuZjwUByIg
TLSH
T1A8340936729501B4E09BB2B846610445E7F5BF601323D3FB1E53B5BECEF92829DAA740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LuaTools.runtimeconfig.json

Path C:\Users\Admin\AppData\Local\LuaTools\current\LuaTools.runtimeconfig.json
Size 582B
SHA256 545cf61b0e7c5672e3da3db0945c85b28c2dc3d453c649b793c6271b26cab521
MD5 94bcc836acb02ebf70b1d9ac60c3da3e
SHA1 4fd7b7c1f8a3aed280b05fa7fb92e5d2812b0e2c
SHA512 59b239488a5d2179afc695ff7d4674cdcf684d1444d5df0d4931435c7df0e0f40cd2715a249f720aa442b5150e25748c343bc7c3c63ea8ccb27c74347f19d7ff
TLSH
T187F05969C9142DB708B977BED226D082FA30532B01141D9A75FC180C2F776A25111F89
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Extensions.Configuration.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Abstractions.dll
Size 26KB
SHA256 3700bf75d75ceef47ebd6df7df9bafb9f7b7dcf22fc537f227db72ccf74c476d
MD5 6f48fbe8c1d66121fb930d01cee4cc95
SHA1 1cc8d8afaec01f6e967818a484fd7aa509624ecd
SHA512 3fe0dba909f19ea448ccf6e3874db0b6709737b215107f7b86fe35c3b911b200ca37dde2f1377f258fd265caa09f93af49ea5b239b05db5c3442f48c5571942d
SSDEEP 384:o9WZMDYtid3v9TaTG/FwEzRjz6rMwTbFmDWsjINWJlNgoR9zFiXS:0WZMDYk5pdO/09zl
TLSH
T19BC25B1653AC9333DDFB2F71F9A1C4952E3997E6A801DA19689E700809777C09B3372E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Binder.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Binder.dll
Size 41KB
SHA256 efc13893ebfa02cc7e49ac13cfef68517c4441a33210d67956e7488b8e6b277d
MD5 2290f7d234bcbf93459adb8bb0745275
SHA1 e5f4067e40be7685d35d7cad76ef7768e53b078d
SHA512 7ffbedde32c75599a7c9f5ffda297f5a7f58699b05f7b42248ef28b0bafbf33ec9bd4fa27afbd6dc8f97b7d4ad61fb43cacc19e96fdc536429efd0a494c01baa
SSDEEP 768:DsjeqKLvg51cjLTwE6ry/v1rt4m37oX9z/5Y8:DsqxL451qUE6ry1Wm37+zhY8
TLSH
T1B1134C1793EC872AE9FF0B707471A4224FB6BB917926D6195C89A05C1D377C08A3236F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.CommandLine.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.CommandLine.dll
Size 23KB
SHA256 a1c8c9728b0dc64dcd975f82d013a1b7bc0c0133e46a94f29044f16cad6072b6
MD5 584eda713ab7795fac1645ef6f3352dc
SHA1 231d179d15e5caac7de89cb8ad71b9d0db1f82f5
SHA512 07f7baa9912b3e17239a601e33d40b329788c3cfc47d03626a0ea0c4f1766a3a9184f4c354715136878ea444287d1ffa6ff97e5cdb11020019babfb5dd9e1db2
SSDEEP 384:/fym2RBaP8ckJt+KAW9BmnWElNhtIscmeR9zlQQR:/amEEYRAvtI7N9zh
TLSH
T110B24B6693FC8317FDFB0E71A6F1D5512E39ABD76811E62A145EA0080D737C08B72729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.EnvironmentVariables.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.EnvironmentVariables.dll
Size 21KB
SHA256 bbb26aacd4ba67351d3740106bbcc5544827d98d91b48109362988147ae7963e
MD5 177dcffd43ac45b58a0c42b2c7b99c0c
SHA1 f61334d03d1050174a90c300c19fa29c39517e64
SHA512 3ef3aac0bdd86d7401d363f8d4d4771e79402c1459c9c5e5f1f178b4300cc9fc67b18d8af2c2d1f742f3a22f556efe5f554336db2e6126ab536344d1cbe65581
SSDEEP 384:v/dUEK0NrbQObCWU+JeWDlNBki+R9zd17/:v/UmfNxE9zj7/
TLSH
T181A24B8197FCD106F9F77FB4D9F9C9662C35F7D21862953A006DA00B0867B848B91B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.FileExtensions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.FileExtensions.dll
Size 26KB
SHA256 1830c601c1b155c54fbd3a6844453dae87af14eafe763942939d06905035130f
MD5 ee6d71766d2811851d8dd808384b5d83
SHA1 dc1a15ffbe9e406484572c21a2e94052099b1461
SHA512 bbf23f5c8c1059d48e04b965fba41921fb5346117c46792b218e07ed123be5ff1397781a8ddc68bfac44a0a9333442015dec3e67385a9a65633a6fb93f207dfb
SSDEEP 384:SNHfs86q0/ALi2iTFwLsdYyOiaXAzpkLqWqKl6WYlNorgFbR9zBTV9:Sk92/VyOOpkL3/A9zD9
TLSH
T1E5C25C62C7BC4213C9BB1E71A9F0E5022E35A7975C10E66B59DDE00D1DB73C08E62B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.Json.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.Json.dll
Size 25KB
SHA256 e106f8bc13df7168294b95a6cdbceaba47b8eb7e562940eb4ef038db6fb1f2d0
MD5 e0a403e5af381beb4a47945fb5155ca7
SHA1 31b3051b7622207f803333e799461f9182319fb3
SHA512 0828841a0305e043f2df522b8d34c822d13964d870f08e1af0c461dd22a957088b0c44e2a24e877e87aff91a3dcf09f71b225e3e83982fcd0c80473606babaac
SSDEEP 384:5iemM0/vv+cFsbTRo9ge1lgzWkWR2W4lN4eFbR9zBOViT:5iMCzFsjfGG9zCW
TLSH
T117C25B6257FC4213E9BF1F319AF5C9412E39E796A811E71E15ADB00808B77C48E7272A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.UserSecrets.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.UserSecrets.dll
Size 24KB
SHA256 a310bcdd868dafc0efce5b03a68cd7af5d4fa0d06509ed4b5c51ddc1758e9791
MD5 249b5a3d38956616eb522a7c7214d0cc
SHA1 1b39211cf7978386ce9589eb88983deee137c3e4
SHA512 03d7b1eceadca05b35a14a3183ddb406d971fe61c217ffddd9d2ac9c187f9ad2cc6cece04c9332096b1396397e0b2398002ea4d3e8d0ec26e8e6a4d5246b3bf0
SSDEEP 384:o88CyOBc4Rm15FApdE1wEDW9ytCWjlNy2jR9zGGhyL:o8ByURi40uw9zwL
TLSH
T1C4B24C52D7FC4332FABA0E73F9B5E4452E38BBD65C11A61D109DA009187BBC48B32769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Configuration.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Configuration.dll
Size 42KB
SHA256 7a883c57d00808ca9b5d11bfaa2c5d21f714ed7560e781d7313d65b09b88b6c9
MD5 3970d9bf37ecb6cff7a394bdd25ee78f
SHA1 054b4622b962ae25446888ddf5ec823e340ff662
SHA512 950d50379cf9fe0fc8216a1f786b4c0322eecdeb390098e8bf855dc40c6901de1da110ddd48650ade001f009a815e8151ba72872381a16c6b2e96167d7fc427e
SSDEEP 768:LnxYrISYXrpu4dAn9RY5Pd9Lgg4vScADpDgOlfe9zb:LnxYrISQpu4v5/cANDKzb
TLSH
T153135B52536C8B17D6BE1B73F8E4992A2F71D2476815F30D9C9EB09908AB7C04B12737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 63KB
SHA256 c2a34d5259e6d6c0af43d9b926454105e80e7657dfed901d845100db254de89b
MD5 8db369e1139ba14a6208ea8df983ad0a
SHA1 62e77416f1f25a91c3a5140e3635414af1b8202e
SHA512 ef872d41c7775a81bb2dcbde47637cca29b4b810f2671826de042129e9907aeb2dff02a1ab684425cfaf7b2f48abc6e9a4f2261a4bb4c15bab70eba556f93633
SSDEEP 768:z0dv145TiKK8sfK8wUcrioA085JW14e2KSpYzRTzPdH9zJ:z0P45TiK3sfK81c52W+eHSpYztzldzJ
TLSH
T127533CDD37FCD373FBAE5B722A7390C09A35BA531401E70EA98550EA0892BC88551DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.DependencyInjection.dll
Size 92KB
SHA256 4d7fb7b6a171047984a8316b1a355c65e33350c343f4e0ea2f1233be457eb7e5
MD5 7835c72d7fd691ebda152797eaf1bcec
SHA1 8816449c02b9424b7058842f161772fc489cbd86
SHA512 aad53dfdc5ee860b2a6d23c961005609f2ebb02fe3913750a08f31c81d9526e2dead96d4f233c12764e8bf51b6449ada833bca9129e6b77b3cdae6c3b6f86fd7
SSDEEP 1536:hrzFViiQfeQJFi5+2H2SOETeFRdRV6ZTzzIYn1Y6zQ:xFUiQfeQe/9eT6Tzzx+6U
TLSH
T159935C3963FC8F21EAFF1A75947141054BB6AB4A3403E31E1E94A0AD1AE3FC547713A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.Abstractions.dll
Size 29KB
SHA256 0a9e51f2d4861367908fa058da82b4a0deb6f85f6ba11d3c90b01c848b1fcdac
MD5 436f31765e8a25707ef3770a4880cd5e
SHA1 a0d63c5d8cc9f1644d85667136c73d7c337872b1
SHA512 9d5c163d8453e5784a79f8708d67f9304f0183a61b7ec2e54e0d4d772aa79c5f7afc726dfadec753e24be4a7743380a4bdfb39f01ad1f2a22edce64386c34243
SSDEEP 384:MLdH4vpxJv3H1yPNdc+bXimUVG+KWOXcRWVlNq1wGjR9zGGW:4dH4v9/yVurn159z2
TLSH
T132D26D41A7BC9325DEBB1E31BAA1C4023B36C3576811E7664EC8910D1977BD49A33B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Diagnostics.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Diagnostics.dll
Size 34KB
SHA256 0842e20c25240aca53809e005776eb88f53a61128c632c4c6fa8685b9f66c4b7
MD5 f14e4787e1accf6c01d433eaa0e30dfd
SHA1 3cc40e3e4c0645cbc8fec59e9bf59673f458029b
SHA512 f0d6cc32446f4cda8cbec48e8e5413ed3b8ec7bcdb8fb710013993feade52317438c44cb180394a6f71eb6164b9cbe170d6d284ae61a71a1d5da3ab5ec50b373
SSDEEP 768:lY4wbeDJl88xZZcfqnfBTdqdgWO7N9zal:lsClF/e+yOWyvzal
TLSH
T15CF24A56A7EC9322D9BF1E75AEF086061F39C7836411FB692DEC90990D777C08722329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileProviders.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Abstractions.dll
Size 21KB
SHA256 02f38beb848fa01fcc55f0cf3982ca01e1a5aeba95933131a197ef602a130763
MD5 3aa27844975c473aa34256bf9bcc8b6d
SHA1 16f9a31d79dd248c034ed092d40dc6c385ebee65
SHA512 95ae823dd74af65dd3c9ba60e676d8110a6293297a0a6cf53aeafc5faeb12431538d83d46adb0abab8833b12458eca29f3dd9a3314d72c3a72f99928bdb9f442
SSDEEP 384:N3tt2JeSlo+MVdUJtFEWsHMhWGalNFGoR9zFiJn/oq:Ne5GQfr09zQ/1
TLSH
T164A27D26D7BC8363CEFA5E3069A4C9476D3DD3DB4C05E51A1589E1081AF3BC48732B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileProviders.Physical.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileProviders.Physical.dll
Size 43KB
SHA256 e6073f96262a3c468c5024564fa02df0f36234242b392c8b658b81bb1b9d968a
MD5 887259a796ae6590749fa3f0d78b0cd9
SHA1 6ab7d026ff5fc8fc0d92b51f29e492d8b33f8c5c
SHA512 41e7ba5f26060b03430f3da154ca8cd691bb287008e78661706cb449bfa3d3310342dd6e408a213df7c1366ecf89e8d0598d4dbfcd8c1d54039957e8a5c2edaa
SSDEEP 768:+kjPlCVm7Ej8zP5usGppdtUqISA3SngVE419z4Qt:+kJCVm7EihusMpdtUxSqSgVE4Hz4+
TLSH
T181137D2193BC4307CDEE4BB16DF0E4460734F3D72502F75A0D98B19A29A77C84B626BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.FileSystemGlobbing.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.FileSystemGlobbing.dll
Size 45KB
SHA256 965a5347b125d232361dd08027ab263ed1d042b0240ec4a4f29b7a0bfd74bb28
MD5 39743aeab0c21850ec0a8e7830ad4370
SHA1 c897d4dcf3bf039cf766f940f117701a0c5b1eab
SHA512 a79f377a64bea1c532aed4ce33abe17af9e888a4c89434a2310af7e6e3845333fd5116f0b1475db06f9c09d243f09b50ac5245d10dcac0e99a56a48a68f832a5
SSDEEP 768:7rw185npIg65BZLzI1Vp3aPolwgYakfn8OmVSfem0TgvJKMd9zH:7r/pkB58LaP4wgYaOYVSWpgvJKM/zH
TLSH
T108234A8066AC8223CABE17B8B8F4D4524B75C6B7B412FB474ECDA9481CB37C41A61777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.Abstractions.dll
Size 51KB
SHA256 57c2528e1f2b3872976661686af9bcbd0612de7ee6b4ef4cfe92b746b27aa1b7
MD5 c32f6f4402d1c5a9fcd2fff1e20a859b
SHA1 3732c98212eec17ff92759599fe91cafd1a8d711
SHA512 4bd18b34de2e0135a8e00616384033609fbb25804457cbd6cf3d363d7f2e3c7d4aec0e9f99e4a75b3abc87b8dde5ee0e6903dcf3afab80d962cfef02c7532a32
SSDEEP 768:3dfIvk8cUbjKbhY6Om4e+X9CzJ65Mo7tKoV2nwsyQQZt164yCmi3FbFi/Up2cK5J:5+k7UbjKbhY1TbUcKo+bozqrH
TLSH
T12933B14163F81615FAFB3F34ADF891258A3ABE66B834F62C064945DD09B2B80C971737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Hosting.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Hosting.dll
Size 69KB
SHA256 ca135e4b48abc2effdb6fdf085837966c35f3a8a305744429009dde946d633c8
MD5 14ffa2d36a6d50f71e904f5d0deef146
SHA1 63c60db8fd1a63be05ecafe119d61fe6d86bcb1f
SHA512 09d1ca0be3b43235f97f5739bb5e443adb04c0d34ad6499f7c50dbc64eff351e0b803ab0f8968bbe9589a88eb41765597b9b9b3fa623f6841ab98b6e4d66f9ab
SSDEEP 768:mHcMciLWJeEHq8SMj9db9KKjoDpxdDozzCF95dnbOCify7MYzWUAKCf9zPcx:mHTfEKjkdbMK6PM8nbOKVWUAKozPQ
TLSH
T15A634B8363AC4713DAEF1AB9E8B465691A35DB576414F70E5C8CB0D90CE3BC44E2272B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Abstractions.dll
Size 64KB
SHA256 4ad4a3b2bed7f5f293f83cc2c46169b93a9863b89428f693a4f17863704f47aa
MD5 a5cab35625e1f365a9181f4e059023b5
SHA1 1f8fcaaf8a0c512e3d33aa7caa0b452227459eed
SHA512 1fb963e563d774df6ad87fe5b7a09fcf0eae1413c270d4b01022e94a00057fc917919b3f4f6e03bb45ac47286dafe763d40ecd50d3ecc2ae91ba122c5579531a
SSDEEP 768:vRU98PjrdTukvp6wV1XxMyVYB0wwbru2OkJB7ix+WTqoU8/Aj29zg4Q:JTTxvcwTWBkbru2b7OZTNU8/2Cz9Q
TLSH
T1C4537D05ABEC4377CBBE4EB9F89096410F35C2472547E79B2CCCD125A92BBD44E213A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Configuration.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Configuration.dll
Size 26KB
SHA256 ed0a70f939dc8779ee85802e926f138e284828ac14d44831ca68fdcd14450b5b
MD5 477d8b5d7ab4c9b2bc918ef5daa8b45e
SHA1 7486ff87665335aa215bd589d19b98f546215eb4
SHA512 2ece4726195ea57acef015ee2b10435a50af5eb39d7d2af01d13f74cb9c6b6d1ceef4a232f81914bcb115ef52bb47641e833aabe4d19c8933cc286f2312f0883
SSDEEP 384:SPntTUFG4562BbpdL62S5p2X/ckWxsmzU7RWJlNdki+R9zdq:YtTJQj220gkU7H9zU
TLSH
T13CC25C6697A88326E9FB0F71EDF0D9453E35D7925811FB1D189EB00804BB3C4872273A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Console.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Console.dll
Size 73KB
SHA256 84ca5528a45074f18ae4234956de55d238a65be39f914f88293732dfd3889a35
MD5 cace87a409706f20b3ee8060cb9f0a16
SHA1 e7c60278a72a6ad5cfdd80191c09d91abeaadbbf
SHA512 ed21c6547c2df2cdf61c3070254bd6439a30d5674523823d303a0a96e40cdb64a91c887ab4133ead3d8a48716f7679bb6b2c67b22461d9ffef48249a5e5e0019
SSDEEP 1536:31SU9VTLpoGSWZdHPIcKPmUwzF9U8o/T//+Fv/HENqyvzM:lSU9VfpoX+JFKPmUZT/WFv/kkso
TLSH
T135736B1A5BEC831AD9BF5FB8FC7091015B35EB53B803EBAB5D88A0AC08677C54512763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.Debug.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.Debug.dll
Size 19KB
SHA256 ec47584ec7344dbe9b3ec5740cf493a8dbf346e467d6855e24be33555db11983
MD5 b1d351bf2b284e0969f1bcf9d6be1b58
SHA1 64fab26c768c8b610df90baad8e03e7759309f6e
SHA512 98df861cf32cf09a00688626d706b36ea9a4c3b5bcf76f3675039e43268a82cb6632c05066b361440c5f88806cfad0955af1bd4f9d0373dd796b369084a6c385
SSDEEP 192:zVfPfwSGE5QJusuqgQJ9j578mDAqWJIxVMW0WF+GBTBWseaAWDiz5j4HsX01k9zM:Rfafu42mDAqWJIxVMWJlNVIR9zeZ
TLSH
T149924D528BB84206DDAA5F30EFA5DA42793DD3979511DA2B05D8D1090C93BC4973262E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.EventLog.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventLog.dll
Size 24KB
SHA256 f70b8392447817a4d44acd5785e0bc029a2844d5445e05b98d95b237443339db
MD5 8210308568d5ef15f758ad21fee0517e
SHA1 e0fdd76a63aff7195b38976882e88701bb6fda57
SHA512 5decf964bfe472c2083bf093709da87a4577fffa9a22f9db757a9c3beaa83005a26599cf2297c9619522b3b7682af8a279dd5dcd5168808722b3d78c71814644
SSDEEP 384:0cqdNcIPJ51NsMsOBZgmVfVej+yUvW2rgFW0lN4tR9zj4O:VqPPUEZ9kUEAP9zMO
TLSH
T19EB25E429A6C431BDCAD4A71EFB5CD42397CE7C76812DA260E9CF1490C637D48B21B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.EventSource.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.EventSource.dll
Size 33KB
SHA256 665d5316f601ed6dd9daa6d7534610ca3a7aa40e4d117c079ffb118ea2179b2d
MD5 b251f77d47b8ae95b7e6c48caec4921d
SHA1 e04dfe931564d2b0bd967dcadb4d0f807743775f
SHA512 a1e85b95d9e65f4274a6b6dee8c5fac60a0890f8b521c271458c515d0860e48dc96a91bde318e0c89a080e12a29d690ee7ab99c8a3242dd3ed6b10b7c5b1bd43
SSDEEP 384:YJ3OpOC26rT++tIwa7Pmq8JKUNFUDeHQiXA40zKeGIGJyF7fg12Pahfv0mvoW3gU:YIV2mqJUNFoOXpycpvmQlfe9zq
TLSH
T128F25C71D39C830BDCDD1E34A6B8D982153BC79B7921EB4E5E88E0880973785972376E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Logging.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Logging.dll
Size 49KB
SHA256 48bd4a0d323e0ae85fa0469779bb13e92c4600b0a49dad6bcb891047c5e17caf
MD5 eaf823ed830e1f448cbe8e1ad95a76e1
SHA1 6539c17f608ad3691e96c23bbc3bb3b55ae34b37
SHA512 67a3d77da957aaa0fe4f4434c054f51886528640603d4e027d5f298e322964ca1061d40f99ac9169df45f9a4f656d050f4d3dd2c0b0c4a7ffb5d20d84bda2735
SSDEEP 1536:uwkwf/Pqv0KvNDmBRZlDl9PQ8izqu0PpKzZ:Dkg/WCXiz0BKF
TLSH
T1D9335C6147EC8763DAAE0E38F5E4D5545B76D76B6012EB536ECCB0A90C7378087202BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.ConfigurationExtensions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.ConfigurationExtensions.dll
Size 21KB
SHA256 3057894505e37852ac77ba70007a6b075980be4da9c3afcdb7a37e62750bda1b
MD5 8ed48fb1ee04b8180c8a021b8c9289d8
SHA1 4e4be474d90b13edf1365307809edab6ddfb066d
SHA512 ec0f2d7c3b75698fea8bbfb3c38771a358934a69aa25739ffe52939ecc25309c741aceade75c3b96eca4f778c7edaa33bda4180de993f3dc99b5ebef27548273
SSDEEP 384:ty1JDVIqRW7eGpX7SOxYWV4lEdzWzAr0WClNetR9zjrT:tnBR4lEdv1P9zfT
TLSH
T14CA23A528B5C4223DDFB5E71DEE585923D34E78A5911DE2A02DEE1480CA3BC8DE3172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Options.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Options.dll
Size 62KB
SHA256 4e767f3c0bf37199a83b8697fc9431d907fe39b5f2763f83381865c89ea6545d
MD5 6d0db347c73a12d13b4207aeef1bad55
SHA1 7d8afb9e7aee839f6c03d6a8ef6ef6791523e741
SHA512 e1db3fb8a552c64c2030e3724c39930c1f9ff749817fcb2aa2286217a13b333bd73c55dda764fbbfcb2076b473b7aaa93f6e56b30fa704b400b689e73c76f3c2
SSDEEP 768:WpWO5uXespQkuvhuVyI4vrKilRrtsyQYGiuxseJyvmpqsS7WdP7NszuatX9z/p:WAGghwMII4TpsyVOuvBBSBouczx
TLSH
T169536A2297CC9712CAFF9671B4ADA4520E35C35A3A03B79B52CDF0D81C773A18A65633
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.Primitives.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Microsoft.Extensions.Primitives.dll
Size 42KB
SHA256 b5e8630df19605fec639873b86bdff6f9d424db88d181bb36a0bd641558c18ca
MD5 b252147211deb74a9d91401c4387b6dc
SHA1 e237368996fdb43315f2360d1f374cfe9a0d54f9
SHA512 05ae2266296a182ee4fa267e947f4a7cd1d4d6787c4b4c1fbc3ead253ad6dfbfc2d26409fed457186579fc9540e83f2d1ccc15c78c3cff1af2deb3a88d54e137
SSDEEP 768:6PNon+YcgKF/1WfRzT3YWkLzZuORP6eNbOP7yW5yKyqLuiM+30XuIh7N9zu1X:6Gvcg61WfkFuoPzNbOP7yVKHLuiM+3Jl
TLSH
T1E3135B05B39C8333CFFE9E75B5A1C4152638D3A6B522EB6B60C8A0741D637C4477266B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.DiagnosticSource.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Diagnostics.DiagnosticSource.dll
Size 187KB
SHA256 d28e247dc8b6af02968b65fe6aae25c2ee689d2007268375d63347aeac0bea6b
MD5 f287490a129140fa1bd94a7247f49b37
SHA1 9892801cd4b7fda18461cab464a1b00e18f52217
SHA512 a467c7855af63771138b95a62e9b541f81de9e1d44519dd68a1c894167cdbb5566392d196f75ebc88c4e9b4c0587ab280d4a1ff44309d7522efa6738f60e3d13
SSDEEP 3072:TRQdeGkopxoribSSiKQ7Rt2wS6XkzvYaLKlllWFBx21nRlviQYVPXx:eeGkopx0igKQlty6XlabBxq7vzYV5
TLSH
T184148D2073EC4B26DFEF1B39F470C45607F2DA4BB54BEB886A85A4EC1853BD1460126B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Pipelines.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.IO.Pipelines.dll
Size 75KB
SHA256 a3c80d0bb52e0f5afc73638cfe5dc25e3470e5fdc0311745aebc8a4d4cfcba35
MD5 726b6639602ff3b58d037f99b3aa7279
SHA1 ac1b1635a3219b436b094ba633743fa32339a974
SHA512 12d4b0930694d5e13edd1c715891b931f2e9e692e48bdfac35675cc3d589fe58704e6f4b66fffef0615a4204b67b009671523f810a81bcf5a6a1c167c5b38134
SSDEEP 1536:LvXUpt0U320mvAnfAWF/G4bgN0xmR9ewEcXYzIkCRwy4PzJ7:90monoWNG4bgN0xmR9ewEcXmIkCCy4Pp
TLSH
T1DC735C6843EC8717EBCE1ABDA17145230FF2DA666A13F74A944CA89924D77C006263F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Security.Cryptography.ProtectedData.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Security.Cryptography.ProtectedData.dll
Size 37KB
SHA256 ce7f4b80de12f227ac637915470c5b6b6a5d716456835caaa0b1600c3cbdcb6c
MD5 1f39c7f724597435feed4c6e8207b235
SHA1 cbe9a23badf76bad2ef913cdfe31d86c954d19d6
SHA512 f9b33dc2d34b5a1f5dbe1840685f85104a3e2be109c270314cbecd6d0c6a4e3f84a5be5ec8ec417f27ec7b571515bc578380bf8de4172790ddc7ddc8117c29ba
SSDEEP 768:y8I8P2QLEx7FiC7YccT3zoCaw2Lw09zaJ:yiP2DF1SjoS2LwczaJ
TLSH
T194036C21A7A8937BDE5B4974B931E00A783C8E498012BB3DD5C9614815F2BC59F32FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Encodings.Web.dll
Size 64KB
SHA256 8839f3cdeabd22f5952c4673367ea41c921aeb0ea26e18fb23906e2cac08298b
MD5 6c8c3061f7f55a28ff30bcf3ee7da75b
SHA1 90e54da4dd85e168d294d61b1e42480e9280bbb0
SHA512 9b715a5594d298e68bbb5db933bf2719b0b4b7ec2807e256981dec73339fe4d7c2e416b9aa856035f61209b2a83e9b6f0903ec28b15a4837f43866f3ab908d62
SSDEEP 1536:0jLlBxsNNJM4PMZSFdmTa7/hQ98av9Yzm:mBudv3/211Y6
TLSH
T1DB535B11B7C8E51ED75D06306CE080B0A7F4AFDB5126E6C71C957A0E27B3BC86B1929B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\System.Text.Json.dll
Size 660KB
SHA256 bb53577c13ab01f397585e4bb642a1a89f1af91b70eb385c7c05b82b9b912605
MD5 e1134858b6a45565531cb3c3a1a26df4
SHA1 8c7986c744b9bb668f1bbb37934528ac38dd0bd0
SHA512 dd4c350ab441df58e08bfd208cfad384f47a676300f9b5811bb7be14b81bea9ce18debceefcc4ae68aa488551348f20feb8ae09b4d2220dc84a401e1e4f21e5d
SSDEEP 12288:jC7e+aoa/8Jbxfap97o6WEuy68/aUI5ABlr9ZHqdKC7vZzhYQ:xoa/8Jbxfaf7o6WEupX5ABlnK8Q
TLSH
T134E45C10B3E84B2FDADF433AF0F040058BBAE46AA75AD74B150854E92CC3BD19E556B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Velopack.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Velopack.dll
Size 261KB
SHA256 b35698f5f66978d7bfd0ab12a2a2899f05912d9a1890d5e64c2dce9bacf2662f
MD5 2c29bf1bcfe53f779a9f7d785601dc8a
SHA1 21d134bb5661ebbb4819500aaf829ccfa024a9b4
SHA512 3acfa65169390a7f9af8ac66dfa9684405bcfcc4e61fc04df80ee3bfa25bea4bc8a41defd7fb9290890285172a97f663d95774a59e274fbcd1f8b5f44d533692
SSDEEP 6144:qo0g6Hxg1smn4oGalxcB+KQwCyknZylyZ8Sru:qLgAiWHoq9CykclyZz
TLSH
T17A445B0037F48716E2FF6F79FCB0600686B5FA07B8AAE75D0A8458ED1D633509950BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.Abstractions.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.Abstractions.dll
Size 7KB
SHA256 f504e30e37a74936ac14f14de4ac43c291cb3964eda71cdcdd61f27cf15cb9cf
MD5 eca262214bd112cc4a0a225df5f43210
SHA1 275987463805d018677c1e093d072a05ffda92a3
SHA512 099fc0c607af839d933b0007b37739897b67adb07ce309f5926da845b857b36b640c1d60ac002a405db73fbaaa793ecb0f54fd1e647c838d3188d80f51d0b843
SSDEEP 96:vClxi89zX2ekdeDm4mgWoQdBTHUhMDADUlYpijY39SOkX1hHN:vClFDc05mgWoQH0hMDADcke09KXDH
TLSH
T1F5E19221F3A88332CDF74777E8BA52845730F652EA578A3F199A510E5C2A0591E32B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wpf.Ui.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\Wpf.Ui.dll
Size 6.3MB
SHA256 3466432f74d1d1224a55f71b8dec7b2913039e01ee32b7304fd9668fb76b797d
MD5 17b530002d305ce72b8c40a1c6ecd70c
SHA1 0be2703f9866699c4e7497f62141abc1b31ff57e
SHA512 3dea4eafa04fd6a9381921eb98526386319906153007e6b159e7437a32d6fb235ddd5d0434d13b58bc41a6f535aa718d29bcd43d101701b810c793b2358e1d4d
SSDEEP 98304:89xe/+FOvSmaRf+UcDN9NppBLxAHDfyLrZl:89xz8N9Npp
TLSH
T131666C5E17ED0D36C3B3837A8DB073222DA9196A1142AB834F4EDF2D446A2C4CDF559B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Diagnostics.EventLog.dll

Path C:\Users\Admin\AppData\Local\LuaTools\current\runtimes\win\lib\net8.0\System.Diagnostics.EventLog.dll
Size 171KB
SHA256 59fb8f95e34b4dbc41422e801ca9456da5ab70508d773e42e2ce1c60de38a88f
MD5 6781d2fc53d3682151ccf369d797d673
SHA1 7862a6bc28ee617abeb8d70c00da380ef914072b
SHA512 fc6070ad003a38c69944990b26507821a8c867f5a4683a0464e47a9efb201fcf5b0afb1ec60359b32e412edf521771ca4829b19e7a2b3d75d1d3082a5521bcfc
SSDEEP 3072:RfT/zCfxCsREbOAvoFY8ZHPfu65kt+EIx/LJQYyaQUoj9:p7zXsRIOAwhHPfF5ktyrfy
TLSH
T139045C7573EC4B1EE7FE1B38F4B011258736B996A93BE72D458448ED09637C08A207A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sq.version

Path C:\Users\Admin\AppData\Local\LuaTools\current\sq.version
Size 534B
SHA256 a03c6f0ccf21ae821e2908074c4b127b7f85a251b29914372f6e2d764f50154f
MD5 d7ef836539831fbffd7c5b548677f6de
SHA1 198b8d35ec3e5d76a391fc4caac727978a0d6e1d
SHA512 41426ed0793d6cce8afef5c2f2ef11b4376b540de9c1100d8c60b6f7fac57315758a5aeb83b431453a452ec00788e3870ce11da2db84d69ffdcdbb8a471e7593
TLSH
T189F02B85A942D64645931E9565E54104B3EB7EAF34C948D0E8C88CEC238D2EEDC2FD55
MD5 SHA1 SHA512 TLSH

Submit Download

.betaId

Path C:\Users\Admin\AppData\Local\LuaTools\packages\.betaId
Size 35B
SHA256 47d759e038478384828e370a2d6196eb3ae87ac9fad7f4471981750da85888c5
MD5 7d963d6eefc3dedd8ec4548cd6bc9a92
SHA1 c9f0bb71615ccb1ea989017c1325db6563d106fb
SHA512 c7ad8b85e59d7cead06d3a1a5978c78e7032e7354798b93c196bfc0e0af48161402ca30e5eb80810df1475b35a50b79f465022200844b1fa93fdb429400300cf
MD5 SHA1 SHA512

Submit Download

LuaTools-1.1.0-full.nupkg

Path C:\Users\Admin\AppData\Local\LuaTools\packages\LuaTools-1.1.0-full.nupkg
Size 6.5MB
SHA256 fcef9e966686de12cd1824c6bfa0bd2c056b9d90803b97dd70e2b3d0a8369d92
MD5 fcef8b4aae4ae34becc8d0781c3e5155
SHA1 73b1e54e2feb09291d51f99e56983744656b1261
SHA512 349e1c4a3e68759f161293e70686ae4136d862e507eef54faf6a2b2264169e77cb36535a632b95054bb0c002429e3f3ff62f8da9d955466fa4e73c5f5ea64e87
SSDEEP 196608:tJ2a0040yF5NFNjPnN4Sw6qHn3ILn03t+6E4UqQmbyl:ea60ojFNjfN4SwVI70bUqSl
TLSH
T1AB66331E875C57AAC55BE6B0423C09DF8783766E539137AE423833C3AECE7B9D214285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a64f9876be8f6f541313f5fa74124eabd93ffe0360482ff44172b296b8c2a798
MD5 164a439346803dfafdacc927c09c3f0f
SHA1 75c99fa4ce0f149c98fbd00afbbf8a1fd371b38c
SHA512 043ef5639e843cc12c4565773756d3a13b502f490dc77446a02c18ab575c24dca99fd9c33c36356cd5049a0910585a7f1443944861ee10dc12f3008d5f992df8
SSDEEP 96:sa2YZiEDWCxCscmCb9JaRlZdHW+i046W6hfuH9EOx+WVoMfm+uecpYQjrK+gG264:sxsu9s7ma3DrpMHW6+WNGYzsxhg7J
TLSH
T164F1B9436E28687B4CCBE21DBA257F43E2F5402266D51D4CEBFC8A5C059B6CD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 722c068b9fbdd87aa3d41adeb28769da4035411138ab1ffa9fbc08e24139d2a9
MD5 68cff1d01dc7b509b4288d112cc85e24
SHA1 5829de106d8cac71757113e1228b47302786a8d6
SHA512 495464af8b83569197c101d5577f7066f6e11924ecf49857a868213042ae8084853aeb9338fda2150a54d60a0de2991a94707d17d8848c137878cafb926252e7
SSDEEP 768:gqk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYS7XroygYk:gqk7u70WvqiEau1jai5LA37Eyk
TLSH
T1D4C2E93B744CCB7E4F801E9DAC566F973E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 0d28bfa6a8b89d374b39f19cb93b5a5ebb67a62523d9df2194024964998ed5a8
MD5 191d48666872efddcc23f33ad0fb8d2a
SHA1 e3a5dd75a364fb75e20c18b78240f92801d87c76
SHA512 bcec74ae257e1c2c275be3d0bb3bcd8950caccfd75f0eca20835d8cdeb8e454b6fe522dead694be0ec880b4748a271d30fd49c7cb5021f8037b38ecbd6829a25
SSDEEP 192:zDsNNV4BbQQmiUyW03aGBPKK7+FdG29p9hFC1SJrUWNipq/UUO:zDsNNVebQ83Mdtp5CEJrTi5UO
TLSH
T108122935A8B99C3B99A2B145F48737539FE8107BED846F44F6E89B0C01D739C2B17816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ee027228e463ef2cee4d0da34d07eb4a557855d4f7f606082080a18630de8c5a
MD5 0394fd0ac1a3f666bce77948568bf785
SHA1 33751eaaca2a9b0b8026977b9c4adf62b3e9ef7d
SHA512 0b8ee78a69da96b2da78190e198786b541c68a216768e820f425d7b9af0e197f4d13f0a8f2ea13de56c1230f79db12ecd55bfa68a55eda836c126de4bc549988
SSDEEP 192:MONY64BAQmiUyd1/W5GBPKK7+FdG29poaDIUxU6:MONY6eACxWLdtpRHU6
TLSH
T180021A35ACB86C7B9EB2AE45F58637175FE8113BE6801B44EAE85B0C01D774C2303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 016b0c76304f8bedc8fba4367c9841f5d10683848da466bb64ef58ff14e24784
MD5 257e1d6d7436bb6a1a51935659367c47
SHA1 1bbc4d26cec6f22da7316c642445d7fa92e8284c
SHA512 da15f1c8121d524c2a9bd1ee53690156d820f63ebef9399f672185c314100a3ea194aa6be1639ec68656d15b686f789b9b5eca01212c99776ba95945d3ae443b
SSDEEP 192:7ON864BDQmiUy+/35GBPKK7+FdG29p9hFC1SJrUWwbq/UU6:7ON86e1n3Ldtp5CEJrqfU6
TLSH
T1E8121930A8B9AC2B5992B105F8C737439FE8107BED859F44F2E89B0C01D775C2B1A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 c0d699412d70ad73ed98f6d2a2c091dde034ce2a571ae40b7e6eb48e38670253
MD5 700387a8d850693d5b12b1ed572f9d88
SHA1 13cd428635e03a5104aa1d41b71dd19b194ed5ba
SHA512 5f37d7c5ee095d52c2a96fd66b8f8b1d88ea0a719d3bf2188fb7a79ec06d0ebad45525bb07179252f23c3ab5590d1339a529b480b86db505d74880625e0ef82d
SSDEEP 192:zDsNNV4BbQQmiUyF03aGBPKK7+FdG29p9hFC1SJrUWNipq/UUO:zDsNNVebQb3Mdtp5CEJrTi5UO
TLSH
T199122934A8B99C3B59A2B145F88B37539FE8107BED846F44F6E89B0C01D739C2B17816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61fe95f0-8ee0-4c30-8523-9c7f35d8a80f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\61fe95f0-8ee0-4c30-8523-9c7f35d8a80f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 d6042d29beb35e613054d813f5f24ba05aca5dc0a24fab65239e0d5d720e16a5
MD5 813c874b9ee8b1f2860d076ba85ec533
SHA1 3281c6aa76bc3b47d7056c3179c2c35efb755fd8
SHA512 21322a0666c5c6c6ae9b5f27833f6e53220e18ae328e5c1631ca29b8fc206462b9294250b9c0596f9236805c6aeab266a9d08a2dba87840ba72e95f521eccd79
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 2baa752e23284bc04a024a9bf0731007203ad365af2d95244952e2cceddc6744
MD5 b431b9eb0afb7313f866b675f84d4ca7
SHA1 000987f13e1ba2b17c9f8a80697cc956ff1544c1
SHA512 8777c199211b6386a7cd83e5c2d02e3c95f6bc23cb8cd29ed646517c3a0a0c8ade78de4d2fafbb3c154179b31901df35a3cab1512ec0506b862f6d571347300c
TLSH
T101E01766FFA44CE0CB004132E1C19A84F67941642983DEEA41A2033C2CFABE4F901006
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 7KB
SHA256 170b9d97c0cd2574493672b95e11745cedc77dcf5a14a89457e30434d00b8637
MD5 e74d69a3de66a6d0a2c80bc1c2fb533e
SHA1 b5adeddb8de1bfe8315b2abe774e680040179e28
SHA512 dd89972d5d6590ebc5845ebe5f2d4482f57e7e11c0a6f81cfdce22a09794c112743ad26fc91e9811c302616965bab8237063e10061434ff030615696bdde186c
SSDEEP 96:ro70HYGsJVie2EN6ZFX7/x+hHMSm+tpae2pY211CXv2MMAy8yIsnIejhAhgtS:rmyfefCXV++wpCpY21kfPM6yIsnDjwgQ
TLSH
T1F5F1740A6C58AA7F4CC6D718FD267B47E3F5143135A03948E6F88A1C28DB6DD2227917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5baf76.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5baf76.TMP
Size 7KB
SHA256 d69aae77d9e49b1edc30e098b38044313e8fce9d82923f52ac73f11437ffa464
MD5 99e773f17d3b539857dfe41a92cf875c
SHA1 a8a2a8ef1a6aa5744db7cae229dbd32d6911f958
SHA512 e10eb58ca591ff0ee8fe4653781b0aa9708d880a7c2be628f8a1fd5e08b8d86cf2c532f55260d18210b634c2ccd0d0a4d856083a1704f82f6e212336087c9da1
SSDEEP 96:ro70HYGsJcie2EN6ZFX7/x+hHMSm+tpae2pY211CXv2MMAy8yIsnIejhAhgtB:rmySefCXV++wpCpY21kfPM6yIsnDjwgf
TLSH
T17FE1734A6C586A7F4CC6E719FD263B47E3F5143135A43948E7F88A1C24DB6DC2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 1KB
SHA256 142b84f06ee1ce96ed05af2d7aee66328db8687af526bc5003f67f7bd36cbb6e
MD5 8db7a0b1efe51ca7b0bdb16e8d61f720
SHA1 269accb54cfe5674f1e60c66caa016cd1200c6b8
SHA512 d536379bb76c3511e1b5fcf307fd2674b6e0248731191d1cdaadf6c9dfaeb5ec5c5db953f548ac4569f324a4a26a91f8f459dd5ff4a84b9e31955707c9a63f74
TLSH
T122116533F4A40A66F9B65965B75B67034E35513AD0298F8CB2DE470A03F39D8D117C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 f872ffa02cb3e5a0ff86ddce6f370dc41716e5185eb65c038bf71bd829cdf705
MD5 8ade7659ad2f759bc3a8da9e5fecee2a
SHA1 4f5781c7ef488a94807507fc31940faf86921f6d
SHA512 ecd6e6d5b22eb49393282f489638c42dc80005871a307812bd5eb2931b4491fe71adad877aa4609448b11ceace4d00329badcccbb967e366bbb21fa8add4a28d
TLSH
T162517632E4A8897795B7C491BA073703CEB86126F5606B98E1EE0B0C02F75E81302C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 5d6f907fb98b318dbb3264482119b5e898e0a333f80c3a4da915c0d928fd2dee
MD5 7b33f7f2ea0eed99b9a9da29855c17e4
SHA1 4e42b1bcc9352cc1860529d2829066a91986fb2b
SHA512 5c31e1a5a7eeec0b4f3d294d34290882205e9e3bf370080bb6e0ede9751359eb6997a62a275b7062585722ec9c2a4e36709dfa082403c68c3f4cd48312305151
TLSH
T124518832E4A8897795B7C491BA073703DEB96166F5606B98E1EE0B1C03E75E81342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5b602d.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5b602d.TMP
Size 890B
SHA256 7585b23b20f300169d48c63f0aac46831c45e9956faf51def7a5b281d2cfbbbf
MD5 fb33cecde3c974dfd93c518be17d40f3
SHA1 0d247d35ef6216106742dda1ebf2e86a21a9c1f1
SHA512 001cf69affcfcc8f7a4475759d2ca68beb24b71a3a95d6676495f5ab525fef3de8cdb9bd476f065f0a7320a07b64ac4a7b7a80eb4d47e50bf2355117b3dd76c2
TLSH
T152111633D8900E65F9B55465B79B67035D39513AC0194F4CB2EE430602F36A9D516C76
MD5 SHA1 SHA512 TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbC4CF.tmp\StdUtils.dll
Size 110KB
SHA256 c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376
MD5 db11ab4828b429a987e7682e495c1810
SHA1 29c2c2069c4975c90789dc6d3677b4b650196561
SHA512 460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88
SSDEEP 1536:cyy+HcFWrX52XWcS15c4DBVOw/bEQvWt6uouMw5m0mhdBu4NpBTvO7Fvo6mVS6oz:fy+8ozImcSNd1YHbMbCk/S
TLSH
T1CDB32B527174345EE0E60A7C275F2373847E2728AB3898DF43A3458EC7752E2A0F5B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbC4CF.tmp\System.dll
Size 22KB
SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
MD5 a36fbe922ffac9cd85a845d7a813f391
SHA1 f656a613a723cc1b449034d73551b4fcdf0dcf1a
SHA512 1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b
SSDEEP 384:V8QIl975eXqlWBrz7YLOlE/NyQH38E9VF6IYinAM+oZ5a1TN:VgPgrfYLO+rMEpYinAMxZG
TLSH
T198B29D6346105CB2DD478834B4C9B936AF7536439AE0CAD39396C1119F607C37EBC267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsbC4CF.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbC4CF.tmp\nsDialogs.dll
Size 20KB
SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
MD5 4e5bc4458afa770636f2806ee0a1e999
SHA1 76dcc64af867526f776ab9225e7f4fe076487765
SHA512 b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162
SSDEEP 384:ABSzm+t18pZ0WAg0RhIFgnGNyQH38E9VF6IYinAM+oZfNRoZk:NupZ/Ag0/T8MEpYinAMxZ7oW
TLSH
T11EA26CA385542C33CE874E3635D8653EDBB9731664808CC25326C24197A439B7FB83AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbC4CF.tmp\nsExec.dll
Size 17KB
SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
MD5 2095af18c696968208315d4328a2b7fe
SHA1 b1b0e70c03724b2941e92c5098cc1fc0f2b51568
SHA512 60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5
SSDEEP 384:PbGgezxEqoyGgmkNFNyQH38E9VF6IYinAM+oZhc3iMy8:T31yGLkbMEpYinAMxZAy8
TLSH
T1DE826CB749802C66CD4F8D7039D4A83A5BB9BA531BE0C1D2535BC2518B917C2FFE82A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsbC4CF.tmp\nsProcess.dll
Size 15KB
SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
MD5 08072dc900ca0626e8c079b2c5bcfcf3
SHA1 35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA512 8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c
SSDEEP 192:WUl64IGsjDNyQDbnPvy2sE9jBF6IYiYF8pA5K+oZ7W76OCwy9GUe:5ZsNyQH38E9VF6IYinAM+oZYsBe
TLSH
T1E0726BB38A582C21DE4B4D3171D4853AAEB9AA571AC0C1D3634BC1518BC1BC7BBF82F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

velopack_LuaTools.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_LuaTools.log
Size 2KB
SHA256 b8b902160b331c844c9cbbd2244b6dbda5b7c9744a781d330ab6a6622570c68a
MD5 4d047618b352143d019918c202a4a8bf
SHA1 030ef7e242224b10f0d3c3f8dc611496b5b3fac5
SHA512 ecb9b66daec69a55b62426602e0c86d11745bf78297385c47cfc3fd372b220669fa307a255a395d2c20175388a74dddf1ce9b605f68b5c631c262fb952fcb6b5
TLSH
T12241CD1AEB11A2F7F85A1397A1F2F1970AE517583B83768B0C024B04E68563D37C6F0A
MD5 SHA1 SHA512 TLSH

Submit Download

velopack_LuaTools.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_LuaTools.log
Size 3KB
SHA256 5f7d0a97d588b79fda3aaf63fe0e86c39e72c0d952877067b3b671cc96ca38dd
MD5 cbbe2f2aa12a963ddd6d9b1c7ea9dd10
SHA1 bb91478fdea775d7037486a27c83d9782751605f
SHA512 64b5a0aabc73858f715d163069c696ee446a6ff1778fbfaec905b82ea634bca88b1d9a8925a409b9551ef00a28a8cc24ade90384fb06542c1b22b9428a98003d
TLSH
T18A61CD19EB11A1E7F46B1747A1F2F1960AE517593BC3768708128704F68663D37C6B0A
MD5 SHA1 SHA512 TLSH

Submit Download

velopack_LuaTools.log

Path C:\Users\Admin\AppData\Local\velopack\velopack_LuaTools.log
Size 1KB
SHA256 4877503406b4a81d8964fb3c84d461040860485e2eb5d7acb385d686632934bf
MD5 68e46fc527e5401789148ccad3cd506e
SHA1 1d54ea2b79d1b7d695a1a16db6aa04a28416a3ed
SHA512 86bf173a09e0d6e01856c03232997b441475c2f98c4374676c2203ab76293d6d4dd67126f55c17bd76dd1e7ab01dfda5467648d4e500c1e66368aaefd0681cd8
TLSH
T157316919EA5161F7E846174BA1F2F1D70AE91B5D3B83768B0C024704AA8967C37CAF1A
MD5 SHA1 SHA512 TLSH

Submit Download

cache.json

Path C:\Users\Admin\AppData\Roaming\LuaToolsGui\cache.json
Size 471B
SHA256 ebd7ff652cb29311dc6de0975fe1c9f8d7571e20592f7d25a8f73613ebfddbae
MD5 8882e10c8568f2a21bad7ac687be154c
SHA1 47de48435069c2bb968c9ea169a22b5a25bbf8da
SHA512 caf97930fe96141822331ccc54ec2cf0e619a0ce1899e267e36521f126d05bf22ccc2d334322bfe524c027c0eb7214ea0ea0f109cab2fb3b7acc5313c3039c7b
TLSH
T1AEF0E5B10A6A1EE132FDF61905654367CA896B8321201CAB33BB55440F3212503CDB25
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 370104.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 370104.crdownload
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
TLSH
T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4228-7249-0x0000000000B80000-0x0000000001032000-memory.dmp

Download

memory/11984-14001-0x0000000000260000-0x0000000000769000-memory.dmp

Download

memory/13416-14052-0x00007FFAC4750000-0x00007FFAC4751000-memory.dmp

Download

memory/13416-14053-0x00007FFAC4CD0000-0x00007FFAC4CD1000-memory.dmp

Download

memory/14028-14314-0x0000018CA1C90000-0x0000018CA1E94000-memory.dmp

Download

memory/14028-14364-0x0000018CA1C90000-0x0000018CA1E94000-memory.dmp

Download