Overview
overview
7Static
static
3st-setup-1.8.30.exe
windows10-2004-x64
7st-setup-1.8.30.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
1$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
1$PLUGINSDI...ec.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
1Core.dll
windows10-2004-x64
1Core.dll
windows11-ltsc_2024-x64
1Qt5Core.dll
windows10-2004-x64
1Qt5Core.dll
windows11-ltsc_2024-x64
1Qt5Gui.dll
windows10-2004-x64
1Qt5Gui.dll
windows11-ltsc_2024-x64
1Qt5Network.dll
windows10-2004-x64
1Qt5Network.dll
windows11-ltsc_2024-x64
1Qt5Svg.dll
windows10-2004-x64
1Qt5Svg.dll
windows11-ltsc_2024-x64
1Qt5Widgets.dll
windows10-2004-x64
1Qt5Widgets.dll
windows11-ltsc_2024-x64
1SteamTools.exe
windows10-2004-x64
1SteamTools.exe
windows11-ltsc_2024-x64
1imageformats/qico.dll
windows10-2004-x64
1imageformats/qico.dll
windows11-ltsc_2024-x64
1msvcp140.dll
windows10-2004-x64
1msvcp140.dll
windows11-ltsc_2024-x64
1msvcp140_1.dll
windows10-2004-x64
1msvcp140_1.dll
windows11-ltsc_2024-x64
1platforms/...ws.dll
windows10-2004-x64
1platforms/...ws.dll
windows11-ltsc_2024-x64
1vcruntime140.dll
windows10-2004-x64
1vcruntime140.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
29s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/07/2026, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
st-setup-1.8.30.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
st-setup-1.8.30.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Core.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Qt5Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Qt5Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Qt5Gui.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Qt5Gui.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Qt5Network.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Qt5Network.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Qt5Svg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Qt5Svg.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Qt5Widgets.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Qt5Widgets.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
SteamTools.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
SteamTools.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
imageformats/qico.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
imageformats/qico.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
msvcp140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
msvcp140.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
msvcp140_1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
msvcp140_1.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
platforms/qwindows.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
platforms/qwindows.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
vcruntime140.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
vcruntime140.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
General
- Target st-setup-1.8.30.exe
- Size 10.6MB
- Sample260713-vpm5xaev2w
- SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
- MD5 54cceb7c9c0c50a9d2f0b1b4f173eb33
- SHA1 ffc28139e6c2d2eeeb27bc39f2ab20e4b8b4c08e
- SHA512 41a589e7ea52d1a8730a4f12ef3db6e5738cb426f38483e8dc178e42d3ef58e1459cc61cccab800891f38fc9e6e3eccc76c46c2782108d084d91234b1f43b53d
- SSDEEP 196608:CW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7YD:7CDQaC28nl78Kg6zCWCdFs
- TLSH T1C0B633942474E24DE0BA0031EC61EF66DDF4B09A5B058A1E4299CB6577E4BE34C2FECD
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies file permissions 1 TTPs 2 IoCs
pid Process 4588 icacls.exe 3512 icacls.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 15 IoCs
description ioc Process File created C:\Program Files\SteamTools\SteamTools.exe st-setup-1.8.30.exe File opened for modification C:\Program Files\SteamTools\SteamTools.exe st-setup-1.8.30.exe File created C:\Program Files\SteamTools\Core.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\Qt5Gui.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\imageformats\qico.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\Qt5Network.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\msvcp140.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\vcruntime140.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\vcruntime140_1.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\Uninstall.exe st-setup-1.8.30.exe File created C:\Program Files\SteamTools\Qt5Core.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\Qt5Svg.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\Qt5Widgets.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\msvcp140_1.dll st-setup-1.8.30.exe File created C:\Program Files\SteamTools\platforms\qwindows.dll st-setup-1.8.30.exe - Executes dropped EXE 1 IoCs
pid Process 716 SteamTools.exe - Loads dropped DLL 21 IoCs
pid Process 5588 st-setup-1.8.30.exe 5588 st-setup-1.8.30.exe 5588 st-setup-1.8.30.exe 5588 st-setup-1.8.30.exe 5588 st-setup-1.8.30.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 716 SteamTools.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe - Suspicious use of SendNotifyMessage 6 IoCs
pid Process 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1068 explorer.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe 716 SteamTools.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5588 wrote to memory of 4588 5588 st-setup-1.8.30.exe 87 PID 5588 wrote to memory of 3512 5588 st-setup-1.8.30.exe 89 PID 5588 wrote to memory of 4812 5588 st-setup-1.8.30.exe 92 PID 1068 wrote to memory of 716 1068 explorer.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe"C:\Users\Admin\AppData\Local\Temp\st-setup-1.8.30.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Windows\SYSTEM32\icacls.exeicacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T2⤵
- Modifies file permissions
PID:4588
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"2⤵
- Modifies file permissions
PID:3512
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"2⤵PID:4812
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files\SteamTools\SteamTools.exe"C:\Program Files\SteamTools\SteamTools.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:716
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\SteamTools\Core.dll
- Size 657KB
- SHA256 0efd139f4201aea356b6baddb159534badfeb388bb7dd54ee9d614f166cc64a2
- MD5 a0f3f5d8aedd622aaebc9251e10c15ed
- SHA1 271d2c2362f979d47b79acee65cc4ef7b152343e
- SHA512 5788813567c26c8a70f6a4369085790a49c44c02a706d7b5bcec68b98ba773598840bd57068aef34fa4c0a25ee5305ce7293335921e33fd25f92c664eb4dd72f
- SSDEEP 12288:JuigyYF+iXvJAarykqB4YbiKxXiVncYNCdJqgmVKcfK12:Ju7LciXBAaTe4JKxXiBREdJNma0
- TLSH T17DE48E56B3F400B9D5A7C138CA534517E7B3B4551320ABDB07A09ABA2F23BE1673E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\Qt5Core.dll
- Size 5.7MB
- SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
- MD5 817520432a42efa345b2d97f5c24510e
- SHA1 fea7b9c61569d7e76af5effd726b7ff6147961e5
- SHA512 8673b26ec5421fce8e23adf720de5690673bb4ce6116cb44ebcc61bbbef12c0ad286dfd675edbed5d8d000efd7609c81aae4533180cf4ec9cd5316e7028f7441
- SSDEEP 98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
- TLSH T1BA569C47B6A70160D0B6C27CC9A7821BE6B3781287228ADF425CA70A5F777F1293F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\Qt5Gui.dll
- Size 6.7MB
- SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
- MD5 47307a1e2e9987ab422f09771d590ff1
- SHA1 0dfc3a947e56c749a75f921f4a850a3dcbf04248
- SHA512 21b1c133334c7ca7bbbe4f00a689c580ff80005749da1aa453cceb293f1ad99f459ca954f54e93b249d406aea038ad3d44d667899b73014f884afdbd9c461c14
- SSDEEP 49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
- TLSH T13966178672596262C977E27D8B4F052EE1F3B85283428BC744558B880F737EA1B7FE11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\Qt5Network.dll
- Size 1.3MB
- SHA256 4ef341ae9302e793878020f0740b09b0f31cb380408a697f75c69fdbd20fc7a1
- MD5 3569693d5bae82854de1d88f86c33184
- SHA1 1a6084acfd2aa4d32cedfb7d9023f60eb14e1771
- SHA512 e5eff4a79e1bdae28a6ca0da116245a9919023560750fc4a087cdcd0ab969c2f0eeec63bbec2cd5222d6824a01dd27d2a8e6684a48202ea733f9bb2fab048b32
- SSDEEP 24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
- TLSH T168556C67B3A142E1D56AC139CA5BCA03E672700087665BEF1279CF592F737E2263E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\Qt5Svg.dll
- Size 322KB
- SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
- MD5 03761f923e52a7269a6e3a7452f6be93
- SHA1 2ce53c424336bcc8047e10fa79ce9bce14059c50
- SHA512 de0ff8ebffc62af279e239722e6eedd0b46bc213e21d0a687572bfb92ae1a1e4219322233224ca8b7211ffef52d26cb9fe171d175d2390e3b3e6710bbda010cb
- SSDEEP 6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
- TLSH T1B0642957F3120896D927D27CCA9B8916E6B334100363DBDF022A8A5A7F237E17A7D750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\Qt5Widgets.dll
- Size 5.2MB
- SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
- MD5 4cd1f8fdcd617932db131c3688845ea8
- SHA1 b090ed884b07d2d98747141aefd25590b8b254f9
- SHA512 7d47d2661bf8fac937f0d168036652b7cfe0d749b571d9773a5446c512c58ee6bb081fec817181a90f4543ebc2367c7f8881ff7f80908aa48a7f6bb261f1d199
- SSDEEP 49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
- TLSH T179466B87B3A50185C16BD23CCA8B8613D6B2B04447639BCF256A8F592F737E12E7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\SteamTools.exe
- Size 1.7MB
- SHA256 992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa
- MD5 9ab2a4fa1b4da8db2e102c0fcba6e5f0
- SHA1 a1b85c90f9f3717570448bab83d9ba103cb31a13
- SHA512 acd2445a4351e9a1e04caa574631ae8480386d411adbd7b74af24085c85fcdc487f0f90432e496b3fe47258d6bf21a74c1f9f001b006ad4912c4e432129eadbb
- SSDEEP 24576:X5vF+/wYyf1jXjBHT0SMSnVpcZuphOH7q9r/bWYAo3P:5F+/wYU1jtIKKZupaqhz0E
- TLSH T1BF857D0BB278C1FDD067C179C51A9A0BDA717446172196DF22908AA53F33BE21E7F368
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\imageformats\qico.dll
- Size 37KB
- SHA256 1982a635db9652304131c9c6ff9a693e70241600d2ef22b354962aa37997de0b
- MD5 a9abd4329ca364d4f430eddcb471be59
- SHA1 c00a629419509929507a05aebb706562c837e337
- SHA512 004ea8ae07c1a18b0b461a069409e4061d90401c8555dd23dbf164a08e96732f7126305134bfaf8b65b0406315f218e05b5f0f00bedb840fb993d648ce996756
- SSDEEP 768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
- TLSH T1BA038D67E72904C6E227CB39D1524A27FA31F5219B92CBCF526686590F237C23D7C398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\msvcp140.dll
- Size 612KB
- SHA256 86881a7054532019291c162f0a8177980c1c2b45490f7e88543f22915d08d9ff
- MD5 ba72c2f6f465926980adc2fb7f8b3490
- SHA1 63de0e3c14d0f45c1edab1c3ecd4adfb78ee8cdd
- SHA512 05136a8dde4359efd112341b12e0545accc8d018e4fa7495b071197833a0227bd50879d7753b61582505b8e2286f845604008bd2020e689e148037a9ef7d7474
- SSDEEP 12288:lOpw3ob/5jh6lN0RXhsdufjqDZZX/t5xTOKGmm75s79s8gywMQEKZm+jWodEEVo+:r3ob/5jh6lN0RXhsdufjqDZZX/t5xTOh
- TLSH T173D41A27AB5905B4E052E378A1C78711D7F1BC058322E3C782A6E27D2F673D5AB3B650
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\msvcp140_1.dll
- Size 30KB
- SHA256 af589d441cd97638b1a0b9192a4014c52b64b35ecf5437caa65f27b3583e07aa
- MD5 18a6c1a3d630dfcbc227082d5b06681a
- SHA1 6634a25660e5843cf7fba6dc09b9dfcb698432a5
- SHA512 5716e41de4f2ed7fee286c898411d99e11392f60df91b2423539c51016a7b9a12945087e6d1a47256c084ceb06556334ef03e34a8647d704582abe5745292581
- SSDEEP 384:NlKX7EGOdlBJkQhnlVI/GD2Wcg53Wco+F0GftpBjLHc4HRN7hlI5e368:nKoBJkQhlVl3v+ixBIe68
- TLSH T132D25B86FB6C8983E8535C7092A5CE83BC3DF3C25B21965B1265E29D1CE37D0AB34619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\platforms\qwindows.dll
- Size 1.4MB
- SHA256 3333ba244c97264e3bd19db5953efa80a6e47aaced9d337ac3287ec718162b85
- MD5 4931fcd0e86c4d4f83128dc74e01eaad
- SHA1 ac1d0242d36896d4dda53b95812f11692e87d8df
- SHA512 0396bccda43856950afe4e7b16e0f95d4d48b87473dc90cf029e6ddfd0777e1192c307cfe424eae6fb61c1b479f0ba1ef1e4269a69c843311a37252cf817d84d
- SSDEEP 24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
- TLSH T1D4658C57A3B54299C26BC23DC64B8B17D6B1701503219BCF01A98E597F23BE3277EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\vcruntime140.dll
- Size 83KB
- SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
- MD5 0c583614eb8ffb4c8c2d9e9880220f1d
- SHA1 0b7fca03a971a0d3b0776698b51f62bca5043e4d
- SHA512 79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
- SSDEEP 1536:ikqwmvKrSgB91BDJ25Tg/G0G5r4Gt7qNBPS9DH6ecboHjPxu+dBsi6:i3CuavtckJSVqNBPSUecboHjPx/O
- TLSH T15A838C4567E802B6E06B9130C0E28E47FB76B485877047DF037A56AE1F53BE18B3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\SteamTools\vcruntime140_1.dll
- Size 43KB
- SHA256 3b792da47040c3b3e0804cdc5153eef4e802b6975963029d8dc360cb824a7b62
- MD5 3b22b2ec303b0721827dd768c87df6ed
- SHA1 86f8af095cf7368ccbff2d0fd6d33586145acd2b
- SHA512 79db774980ee132797f7e7dbc0e055b724d8fbf0e4917523b285f918730adfff81022cc6f5e15469b011d55501fd7b085bc070e9ecdfb75c05f4d6622a7f2475
- SSDEEP 384:GRiuauREnUUWU55vZvS05fJjPg2h1RWmbzA+XfAXxy85xH0f9lWrGKWVQRpBj0HP:DJnUUV7xPg4RdPvv2DHkR+W+1CP
- TLSH T1F6135B54977C8486E56B85B0C4A2CF27FE39F6925710928F0B65D29C2E537C0E73D21E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss485B.tmp\System.dll
- Size 12KB
- SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
- MD5 67fc1324e53b1f3854557f23b0c22654
- SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
- SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
- SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
- TLSH T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss485B.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
- MD5 3614a4be6b610f1daf6c801574f161fe
- SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
- SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
- SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
- TLSH T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss485B.tmp\nsDialogs.dll
- Size 10KB
- SHA256 abd16682aa1531229e5aa727dda379050f66bd788c12fe61a38551f96dfcacb5
- MD5 b9cf10930a5144fdda9479613ee3c84b
- SHA1 5110556ff6ed1559c73cdd444f6e2408db570653
- SHA512 bb9947763fea6915e90e662438d1247678576ff944f9918dcbb0c93d669f8a0dd7dd60db95f53e52faf1e0d3d627789cbcd6196441113556acaa6711b6b6f350
- SSDEEP 192:VvvwccHJBa8oStSigfl6dblJDBUorNuCjLUoaTOt37Eezqm:VvvwVPa8oStSTUDiorNRjwoT7EeWm
- TLSH T15C22E85BFAA4D2EEC4974136D5BB5B06CBB170125692DA4E0B3096897F233433A2D74C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nss485B.tmp\nsExec.dll
- Size 6KB
- SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
- MD5 cf0cac49c427a501d7806033941a6da1
- SHA1 92acf906cc962b7e4c4138aac8ecec67c9629b4a
- SHA512 7ad31611d7c0657d70318c16c781b7da793c8a19e4dfafcc90abcd4c8eb0dbad3aacf643b558b573502e50f504bb9f384b4df95f0db840e68763f03a7d8e85d6
- SSDEEP 96:wC66T7ItPQcwPbfTA3Ck3lKYHxFYSdt4RTUR+4nz:dT7+EEjje4
- TLSH T15CD1CA2AA7C102A8C82F51F0A93F4A07EBA5308125785A3F2A688C0E4F53AF1737C745
- MD5 SHA1 SHA512 SSDEEP TLSH