faa20648243b1248bd2c5249853f065abcbadebfcb02d905a448b64508da64c9

Analysis

user interaction
yes
max time kernel
333s
max time network
351s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamLegacySetup.exe
Size 270.4MB
Sample260823-edv4dasdrc
SHA256 faa20648243b1248bd2c5249853f065abcbadebfcb02d905a448b64508da64c9
MD5 d2d61894b8618442430dae9b1b750d40
SHA1 316677622f5e398af993e8e307f8c70d06f6009d
SHA512 9a7cc2908b06216ef51fd40716acc908c3c47b0b7ec2560d68379ae0f9cda66f3499080df9c0ce241c9205bfc0f4dff92b7890bafbfb62152222ee217498bc96
SSDEEP 6291456:XpDtsAKZzst/EUXxU9Qvjgqg16BiKVwrgSy0K6UwCVRU:5DaxzM/EUXG9iE1+VpSyB6UwKRU
TLSH
T1FFD833CF2BD40919CE1EB9B20ACF0122F2AF176451C5B32495F686FE5D70B296B131E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1144	steam.exe
3212	steamwebhelper.exe
4312	gldriverquery64.exe
440	gldriverquery.exe
5696	vulkandriverquery64.exe
3660	steamwebhelper.exe
4716	steamwebhelper.exe
3384	steamwebhelper.exe
5568	vulkandriverquery.exe
6012	steamwebhelper.exe
5856	steamwebhelper.exe

Loads dropped DLL 47 IoCs

pid	Process
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
3212	steamwebhelper.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
440	gldriverquery.exe
3212	steamwebhelper.exe
3212	steamwebhelper.exe
3212	steamwebhelper.exe
3660	steamwebhelper.exe
3660	steamwebhelper.exe
3660	steamwebhelper.exe
4716	steamwebhelper.exe
4716	steamwebhelper.exe
4716	steamwebhelper.exe
4716	steamwebhelper.exe
4716	steamwebhelper.exe
4716	steamwebhelper.exe
3384	steamwebhelper.exe
3384	steamwebhelper.exe
3384	steamwebhelper.exe
6012	steamwebhelper.exe
6012	steamwebhelper.exe
6012	steamwebhelper.exe
6012	steamwebhelper.exe
5856	steamwebhelper.exe
5856	steamwebhelper.exe
5856	steamwebhelper.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\osver.ini	SteamLegacySetup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\tenfoot\resource\layout\music\music_album_trackitem.xml	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\dark\xbox_button_logo.svg	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\light\shared_gyro_yaw.svg	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\graphics\chkUnselStd.tga	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\resource\layout\settingssubstreaming.layout	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\dark\ps5_trackpad_l_swipe_lg.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\dark\ps5_trackpad_left.svg	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\knockout\sc_button_steam_md.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\public\ssa\ssa_russian_bigpicture.html	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\steamui\images\controller\ghost_010_wpn_0506.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\knockout\ps5_trackpad_r_ring_sm.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\friends\itemreceivednotification.res	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\graphics\emailreminder_close_hover.tga	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\steam\cached\submanagesecurityunlock.res	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\knockout\ps5_trackpad_r_click_md.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\light\ps_dpad_right.svg	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\steam\cached\regionrestrictiondialog.res	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\steamui\images\controller\ghost_040_act_0060.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0413.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\layout\login\refreshlogin.xml	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-crt-multibyte-l1-1-0.dll	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\clientui\vr\icon_steam_vr.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\graphics\flag_inactive_top_hover.tga	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\steamui\images\controller\ghost_035_magic_0356.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\horizontal_gradient_mask.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\textinput\drop03.tga	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\graphics\mnuSepRight.tga	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\library\controller\api\pad_l_swipe.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\library\controller\binding_icons\ghost_050_menu_0309.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\layout\tips\controller_update_gyro.xml	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\SteamFossilizeVulkanLayer64.json	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\fossilize_engine_filters.json	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\dark\shared_gyro_roll_sm.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\light\ps4_trackpad.svg	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\graphics\[email protected]	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\localization\dualshock_4_finnish.txt	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\graphics\scrLeft.tga	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\locales\ml.pak	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\dark\ps5_button_create_md.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\resource\filter_clean_portuguese.txt.gz	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\library\controller\api\pad_l_dpad_w.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\library\controller\binding_icons\ghost_050_menu_0030.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\styles\music\music_filter_artists.css	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\steamui\images\controller\ghost_035_magic_0329.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\steamui\sounds\deck_ui_misc_10.wav	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\library\stream2.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\knockout\ps_button_mute_sm.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\knockout\shared_mouse_5_lg.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\light\ps4_trackpad_r_touch_md.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\layout\webbrowser\webbrowser.xml	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\dark\ps4_trackpad_r_swipe.svg	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\light\sc_touchpad.svg	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\resource\filter_banned_tchinese.txt.gz	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\library\icon_activate.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\dark\shared_gyro_pitch_md.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\light\ps4_r2_soft_sm.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_dp_dn.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\music\icon_queue_play.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\music\placeholder_albums.jpg	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\friends\loop_1.tga	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\graphics\osx_win_dis_new_dark.tga	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\steam\cached\steamshutdowndialog.res	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\tenfoot\resource\images\store\icon_controller_enabled.png	SteamLegacySetup.exe
File created	C:\Program Files (x86)\Steam\controller_base\images\api\knockout\switchpro_lstick_click_sm.png	SteamLegacySetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamLegacySetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{6E698622-DE7B-494E-9885-80FBA1CCA6AC}	steamwebhelper.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{6A074F2D-38AD-4C51-BAF5-B1C03FDEFE6E}	steamwebhelper.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	steam.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1144	steam.exe
1144	steam.exe
1144	steam.exe
1144	steam.exe
4716	steamwebhelper.exe
4716	steamwebhelper.exe
3384	steamwebhelper.exe
3384	steamwebhelper.exe
6012	steamwebhelper.exe
6012	steamwebhelper.exe
5856	steamwebhelper.exe
5856	steamwebhelper.exe
5856	steamwebhelper.exe
5856	steamwebhelper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1144	steam.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1144	steam.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3212	1144	steam.exe	91
PID 1144 wrote to memory of 4312	1144	steam.exe	94
PID 1144 wrote to memory of 440	1144	steam.exe	95
PID 1144 wrote to memory of 5696	1144	steam.exe	97
PID 3212 wrote to memory of 3660	3212	steamwebhelper.exe	99
PID 3212 wrote to memory of 4716	3212	steamwebhelper.exe	100
PID 3212 wrote to memory of 3384	3212	steamwebhelper.exe	101
PID 1144 wrote to memory of 5568	1144	steam.exe	102
PID 3212 wrote to memory of 6012	3212	steamwebhelper.exe	104
PID 3212 wrote to memory of 5856	3212	steamwebhelper.exe	106

C:\Users\Admin\AppData\Local\Temp\SteamLegacySetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamLegacySetup.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:760

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe" -cef-disable-sandbox
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
  "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=1144" "-buildid=0" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-composer-mode=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" --enable-media-stream --enable-smooth-scrolling --enable-direct-write --no-sandbox "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=0 --initial-client-data=0x3d0,0x3d4,0x3d8,0x3ac,0x3dc,0x7ffd36c9f070,0x7ffd36c9f080,0x7ffd36c9f090
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:3660
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1676,14737046052847096911,10082190028384311109,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --no-sandbox --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=0 --steamid=0 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1668 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:4716
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1676,14737046052847096911,10082190028384311109,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --lang=en-US --service-sandbox-type=network --no-sandbox --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=0 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1956 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3384
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --no-sandbox --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --field-trial-handle=1676,14737046052847096911,10082190028384311109,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --enable-blink-features=ResizeObserver,Worklet,AudioWorklet --disable-blink-features=Badging --lang=en-US --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --buildid=0 --steamid=0 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2416 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:6012
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --field-trial-handle=1676,14737046052847096911,10082190028384311109,131072 --enable-features=CastMediaRouteProvider --disable-features=SameSiteByDefaultCookies --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --no-sandbox --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --product-version="Valve Steam Client" --lang=en-US --buildid=0 --steamid=0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5856
- C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
  .\bin\gldriverquery64.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Program Files (x86)\Steam\bin\gldriverquery.exe
  .\bin\gldriverquery.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:440
- C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
  .\bin\vulkandriverquery64.exe
  2⤵
  - Executes dropped EXE
  PID:5696
- C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
  .\bin\vulkandriverquery.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC
1⤵
PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SDL2.dll

Path C:\Program Files (x86)\Steam\SDL2.dll
Size 1.2MB
SHA256 4728bef368097c1373178b79f90c2a579210e2ad6f6d0d93597d6d21fbc1d847
MD5 7debbaee9b6d3579dd2ac4c11a8d7dc6
SHA1 64903b80678d676dd6fd45ab2e94f0626a05c608
SHA512 7cab5ff481b73cb773db521dc232f4cff1e8619adc1b16616c7152b41e06a339e02cf63682cce99ae525ce5d39af761adb30a5e77d28b24250062499650aa263
SSDEEP 24576:bJ4cb6LXwQghFwnIrrm2oxnQt7W2E9Yc9UA0xdnD:bWQfzwnIrrm67W2Eic9UA0xF
TLSH
T10E456D11B7934119ECD501BBC2BFBF61197EB22823FA01F77F9818E919111E2663876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDL2.dll

Path C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\SDL2.dll
Size 1.4MB
SHA256 7ebf9e3df49742363f5628e8bee3e7c08b554b6c839402996155178ac989f126
MD5 2f249b0f412ca38a79e0972f745ab6b8
SHA1 96234266496d21d6004f06297ee93a101a503447
SHA512 cba9d909700f49d4f4dd9e3634ab23a98629f9c6ace21cb40e8d08b7d342ab385beed61afd1bd3e7fa1871c2a5eded11d97fa7d868d9f59960172b01e9a89140
SSDEEP 24576:qf9ka7kF6KztQyTjmOlZRgfivbJSl0M9aDRS1z:qWa7kF6Kzt5v7bRYl0McVSh
TLSH
T110658F0EB3A604ADC92B40B5C2876717E376745823E157DB2B544BE92F33BD02A3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamwebhelper.exe

Path C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
Size 6.1MB
SHA256 e40f650166709de8ee69126367e1d3437ba8567885b11aa84313a863a525a7ee
MD5 8b2c69fd523e2f2e53f57fb0e2c692cb
SHA1 7885ff4592a4728658c7e1037433cc2a0a88e886
SHA512 01c8ccac2a314912aef30f80e59edc17b08ce4c93d83102b98367c9c5a1d79abe6fa0db5b0adb0bec814ba99689cfa7747f255b9d26fbc15437c884a90f3f0f8
SSDEEP 98304:GpFGIx9r+VSO8cI0qvY6qKS7MS4ggMNBFq:x8ZkSO8cI0qA6qKS4MjFq
TLSH
T17D567C17A2A810ECD4BAD13CCA56D517F7B27C162371ABCF02A196661F37AE05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromehtml.dll

Path C:\Program Files (x86)\Steam\bin\chromehtml.dll
Size 1.2MB
SHA256 da1d8e6fc81ab3bd3b52b6e39ac060058451ec36678518853935d6522f89846b
MD5 ad2268d7b54c57bd275206065d8cf6d8
SHA1 9a6a7629e491c5aecc9a6c456f5d2df3c636881c
SHA512 441e07161841a0d3512aad380e0d10e7a6db553d7b8ef3ce57667cc7ffafafc9d47f481c7a74e0901ec69d24cfde08fddb8d7a9ab49df94b99e1f871fbb59c4b
SSDEEP 24576:QWv8WCh8YjFdea46oUvQGQu7rmkab+0/mw7:QQEF7mkab+0/ma
TLSH
T1BA557C217656C031E8EE027168BC7BBE349C5925077445D7B7C82E5AAA302E37F32B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filesystem_stdio.dll

Path C:\Program Files (x86)\Steam\bin\filesystem_stdio.dll
Size 192KB
SHA256 ae90e7be0436a83d8a9e4aefb2ec3a6f7faf904cadbb26448b08eb4e888302c8
MD5 14941c0c8847b9bd9d8cd1d257a103bc
SHA1 8812221ec5d9e939082af4483f4dd37eb67f746b
SHA512 34e216936ff19a922c90b4e68d5ea3070d265cb47deaceee3538edbfc8a904c0f66ee793d2a1e6fc0f801297c4c4309fe06171d2e4138cb1ace4de672127ac0a
SSDEEP 3072:7NgfoV69k0/OBEh7+4Ov0dHCb/j++QFETYclThHFCE6JSmFhxbDI0dAHcVzkwEum:7N4smkUJ7+4z0bjo+YwThBmFHf1FwQO
TLSH
T1FB148D657881C032D47719304978DAB14E3EFA320FE8D5F76798053A5F302E16A76EAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamservice.dll

Path C:\Program Files (x86)\Steam\bin\steamservice.dll
Size 3.2MB
SHA256 2585fd39675631a41260ae42d0b9fd294d757686fd0f72f5717e467120e9b29a
MD5 7c456d7d539af614d9d38149a1833f71
SHA1 f8733c49383c7c05cd5fc8aab61184e2020a235f
SHA512 314dfee3c734dce0c096dc8c12b62c1ca6e62611b235f9942f4eecaf8878e2f3ee727f67e3be2f775ae2866eb68618f278950487d293c4027a985c5a35d70d50
SSDEEP 98304:km1f/ZJ6N0ZGG+jqGZ102zSO4gUFfj189:tJZt+Gs020Fb0
TLSH
T1F0F5BE22BB42C072E8DE01B5647AAB7E1D7DA9244335C5D3DBE42D6A88311D3373B396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vgui2_s.dll

Path C:\Program Files (x86)\Steam\bin\vgui2_s.dll
Size 820KB
SHA256 ff51f082ffe93060a4178ae856cca4e3e299b33522744ce5ce67b2278c961a64
MD5 c310274cacaff257ef43a6eba8f073ec
SHA1 22909130f863b84f9b2fdf0d65ce9dd16d87533e
SHA512 b568813b05b4d45f4c5fecb7369d0da7ec8d997e07e75bfa799e69b9017cd08a94e16aa4ff98ec0e77046f39ddf498932e48f7b9c0b90361d6aa44ee807a2cfe
SSDEEP 12288:YecqDT3hH26bCQnG56MKAQi5/KXTQ/brNT7jsOjyvvkeHJPxLSW4COSpKRxECDfj:YADF5bAY4T7RynfPIHLSpKRxt8IyE
TLSH
T1DF05AE22B542C073E8F10070E5BCFEA4496DAF2507B5D6F7A3D83D6A1B785D22A35293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashhandler.dll

Path C:\Program Files (x86)\Steam\crashhandler.dll
Size 369KB
SHA256 10bc506a154fef354053f58ea8266a8d49a5d3a5de35079ea362c3325c1fb3c1
MD5 68b14e61efc553d2e4556092972b04af
SHA1 6a3a6afca7d5dc89252b27717be371be1e0568ba
SHA512 e04aaa608c94e3aa6c7c08ca25060c7414aff78fa6d748b72ef4b8bde0729dc59f01c38d15cb4814232174f32ea22828388defe458f5dc66ed60f91b4a4ff7d3
SSDEEP 6144:Sygm0+mCJaH1M9FH06m8IYmis0MVh+3f831U8KnW+Kg8fH0/5cq/bVx4gLNrAOEA:mr+7O1AHgYrs0MVh+3fe1jKnW+eQVx4c
TLSH
T15784AE11F492C033D5BE14303978EB761A7D79600F6599EFE3C81D6A4F342C2A636A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]

Path C:\Program Files (x86)\Steam\graphics\[email protected]
Size 15KB
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
TLSH
T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_button_news_mousedown.tga

Path C:\Program Files (x86)\Steam\graphics\icon_button_news_mousedown.tga
Size 20KB
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
SSDEEP 48:X77qTxcazfhjZRRRRRRRRRRRRRRRRRRRKFvJJJhmAr:X774zmvJJJhmu
TLSH
T18F9209380E706CCE81CE9A27AB348AD2A9D2DC6F36632E348653350FC1948543EA734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icui18n.dll

Path C:\Program Files (x86)\Steam\icui18n.dll
Size 1.5MB
SHA256 3334b44ea1eb888dbc240c80c78e0f78040ff1f6d458ca69357bc22db776b1f5
MD5 ab189439d2c625793b4ab4eb15641687
SHA1 f0f9b0cd1aa1a054787b5d1182ac8d8fc27b6431
SHA512 99fa56159bd64a3d4b48a384f0c2f42bd0b599e1b60b8ad6c81c69524f1be8a9104ac35a78793a8dee607f0c5ef94a3a1681be97d0e30fdd513a753c38274109
SSDEEP 24576:KIcG1+2n/9KNkywVApimsEw7ToMkXUrauEjR7i:KlsMNwV6iEMkXhVi
TLSH
T1FA757D23FB12C122DDA911759D6C796A645CED342B78C2D3B38C2B1A2AF15D31B3931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icuuc.dll

Path C:\Program Files (x86)\Steam\icuuc.dll
Size 1.1MB
SHA256 3bc5f41b88f04deb7865cee3a4fc10c4cd08da2e812a18cebf30ee4dc5316be6
MD5 79c7511f2958974aa9ebea764b735e13
SHA1 5d76f43060b66aad705d2ccf08fec32e2421ea84
SHA512 869f430e5a09a917847296799d2950f7b531bcced47e7897c9d9b8af435868482ea0881532f7032bd8aefa9e29f21d2e8926a5f840ed53d9440773fc427d7ed7
SSDEEP 24576:QUy93uuHhuHJ1yesAHbpu1/+FmvHF+cFzz5Zf/fF6FN:Q39+uHhuHHHbp+mk5j6FN
TLSH
T1DD456C23FA43C122E6DF5176A97F3F25247C9C208B3585E3B6CC0A252AB61D2177D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libavcodec-58.dll

Path C:\Program Files (x86)\Steam\libavcodec-58.dll
Size 4.2MB
SHA256 6d938b15b1d911538ebadaee45ac089a3a08636adc098bd174d445289aeec314
MD5 37ed5037b4cef56bb5697dd575f3e62e
SHA1 e4c46939def4b18368aa1e51de7f5254c0f9cfb1
SHA512 480c13b5b9a27cd8c49a3643f1151f9eba03e9f81aabd485f90e36cfd349f9b0c112699d4e4131cca0f74f3f4cf928033f892ddfba15d9bee9d2d3203cc1b977
SSDEEP 98304:mK8tLRSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwl:L8tLvVhDdx6DjasxIX9G/vH/QFeAkNH
TLSH
T17E16BF50A3626271D89B4CB186FEADE3643C163A532987FB92D80D769970DC23739F07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libavformat-58.dll

Path C:\Program Files (x86)\Steam\libavformat-58.dll
Size 1.2MB
SHA256 90bba8a7ca740511126555950b358925d1adbcbb4dc816e02331ccb26dc8ce71
MD5 956b17a1e7508007823de8970cbcaacf
SHA1 8c90b4d09c41e672e3ca5cb5a8c74c7ff957cf35
SHA512 e5b8b9a43d101d2e415079128a24acca1138e8839d5da4f0ddaeadf1a62abc253026f5931303c66b33d9780d6adb792f4b84a90ae2ae738c66f8ffa0b01be5cc
SSDEEP 24576:9jMpqVP7wmNk/gs0WMj/1QI0x+kqHF69VP1IJVG6XEi4TYjX:9jr5E//c/1QIQoHFbj4TY7
TLSH
T1B245AD21FD818021EDE611FA42FCBA765D7C52B4072490C766C86AF8EB345D27A3672F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libavresample-4.dll

Path C:\Program Files (x86)\Steam\libavresample-4.dll
Size 578KB
SHA256 ace27729a5aff07bb6c39f8a353c76433a99a537f6329822ad825c7cdbb3e881
MD5 1adc683960fe451f144fc016ab2868d4
SHA1 913e16871f57b20e05265b7e196988cddc7bccd0
SHA512 843cb7b8fec023f78e3414682022d84fceaca8939c9afd8e71007663cb93d819e4daa6cf1f5d8d2b09add3dce616e8bd6495855a66cf0e9ec4c65a5ef07103e0
SSDEEP 12288:8x+MaYfcKToINMyVZBJm5QsW8NnN5yPcaNs1+gzPzjRxeZTERc5vqSSW:X3zjRkvqpW
TLSH
T165C49F60B4C282B1FCD620FF42FC7632051CA8E11364A9D362894BF9ED646D67737D6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libavutil-56.dll

Path C:\Program Files (x86)\Steam\libavutil-56.dll
Size 1.2MB
SHA256 ca62354a786840608657622c8a77ec7191e0a62fea92c3507e05753f8b3f77ca
MD5 8073fcc89965725b55d8326f509ccc4a
SHA1 929fa816bfedd08232b8ebe8b26216516914fc80
SHA512 6b567959a92f145e715db6d1b9954a321d6bcda49d132b3645bf2b51ee245c3638ee5688a4ef3a2b65776b0f0388f816c2e903355fe27c18a1207ccae0e9dbd1
SSDEEP 24576:teNaqLQN99oBo9BmGTeW51eh2Q9GvpOb467JB75tS:teNJC9ko9BmGTKP44LNo
TLSH
T13C55AE11BD808126ECE620B953FCBA73152CA6B4077859E35A881FF9DD702D17A33B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libswscale-5.dll

Path C:\Program Files (x86)\Steam\libswscale-5.dll
Size 1020KB
SHA256 448c46bd95c791b648d5edf8f73e46550df23db55b73e0473eeaefd6611fef74
MD5 5d713a62b0940905dd2ca1785fd86fa4
SHA1 32eba8b089dbaba93adade36c2ea277e79b437e5
SHA512 96289a639901f49f3d5f56c3688dd69eca7be1030f1f151a17e2115176ecb7dee0a8595b289f882d369232cae554c4176d0ed497000fa33f0db0a6ea294fffc1
SSDEEP 12288:HcW0HokcbNV32s/COIiQ6RiCOadDmG/MOVMN5zzA+94MHrXD5fua0L2zRbxAVJfe:8VIkcboAVJFAA8/tGilOq/0mgFiX
TLSH
T12E258DD164428299DCF022B5C3FDF729462CA1560B28C9F788CC4EF59A24AD27673F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_english.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt
Size 4KB
SHA256 2eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0
MD5 2fe6613e267857982d7df4368c9827ec
SHA1 d520c7427b283e3ff167b850ab15352e46d328d3
SHA512 cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4
SSDEEP 96:hSlb0IG997a8ICgARZ2pyUBnXPz5dc6LzIIivI/BxkHLs06J:8lHmbICgAr2hJc6LkIiQ/DOLsVJ
TLSH
T1D381BE6E072A71F185B1E57C760E0AD3998871BBA3220D5816DEC21C1F9711B63FB361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_list.txt

Path C:\Program Files (x86)\Steam\public\url_list.txt
Size 23KB
SHA256 3de86973b3454fe7a05039a17a5a16be7f98b5a73e102ea21bd37ed9b39c061e
MD5 ee7ad78e6daec9adbf9694d224fda087
SHA1 056ebfde950e843baeb42ff4b86e79482210d815
SHA512 3224fbb9b69977575b8353248968d7f26b91989fa1b1d250c934a1f9b8aa477d53a15beab3cd706101ebec243932f114b5d365f5ba112b0defe6e576b5711ec8
SSDEEP 384:WYIVAVIUXYbHKFFCU790nEc389KCfJCWZPgZbEgHyItLLQP+kaxzQ99sQEt7H8z/:WYIVAVIUXYbHKFFCU790nEc389KCfJCy
TLSH
T1F2B27AAF0F8BAC7B9B9ABB8DBF3190AE9B0913C75E8B5C0478780A5C6552354C524D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_banned_english.txt.gz

Path C:\Program Files (x86)\Steam\resource\filter_banned_english.txt.gz
Size 581B
SHA256 32ad4d40318875d10f22a603fdc0060df96a509350b2f5bfcbe443347a3530b8
MD5 a72e7b507c816b592e402335e936d58d
SHA1 0a20f6c3268910b3b4ddbe239110a6a6760935f7
SHA512 ebc26a0a7f27811a850e45b805ed37edea0480228402b7cdea9ea09b5e743ab6fbdc453f52197132f904102922ae65e07b942e934817da54a96c736e272c2184
TLSH
T1D1F0413D0829F5C4D0547A3376B6B4E9483F629D3EE6FE0E488A14C09A250E09FC9A0E
MD5 SHA1 SHA512 TLSH

Submit Download

filter_banned_german.txt.gz

Path C:\Program Files (x86)\Steam\resource\filter_banned_german.txt.gz
Size 357B
SHA256 d9e7fd2b1122bf2c0164bffe5e078f17bd139edc9da2caca8d94cf3e6a5a3006
MD5 c8621cf4f497af89836ea88cf2f6cd6b
SHA1 085f105a50a1f2a3e426d1272fd7af7c04f44ae9
SHA512 9ac1be16e688aac32aabcfe7b1e70eaf354351586e540d3d5c703529226825b01e570a64f9e949368486c411582cf7a5e6af2b3be3f8b3cb552cf09aa29270a7
TLSH
T154E078504C30725EFD5835376DC3B3D1549A1ECD17563057D3505103ED5DB1DE51E115
MD5 SHA1 SHA512 TLSH

Submit Download

filter_clean_bulgarian.txt.gz

Path C:\Program Files (x86)\Steam\resource\filter_clean_bulgarian.txt.gz
Size 23B
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
MD5 SHA1 SHA512

Submit Download

filter_clean_english.txt.gz

Path C:\Program Files (x86)\Steam\resource\filter_clean_english.txt.gz
Size 125KB
SHA256 d8e1dad1e01f768e500b3f0404296c2c46ce6d04b3e2208eb4c95694cad8c825
MD5 7645eb850981448acdb3f4ea2c6c65bf
SHA1 f6f87a31d10ddcfc4fd2defaf1c581978a4d17ea
SHA512 777cc63db9fdc15b3c1219a71e18d9a7af5970833151c2461224b6e761653fae441890324604299977984f458b9d1a6ca916e4b2530077c78c507f654731a77f
SSDEEP 3072:99JxeLJD8tQ8Oxe3iOyk2De9LCHIHLtebu/zyX2ZGlTbPArJ4ebFOkZqvAQZM:9QLatQHxe3Bb2a9LDHLtsayX2Z+YrJ4i
TLSH
T106C312BDE1F1CDFDB1969BFB43479D3D8F6A11F89035108B46568868A0EE01AB4807CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_clean_german.txt.gz

Path C:\Program Files (x86)\Steam\resource\filter_clean_german.txt.gz
Size 148KB
SHA256 e14dd48c8a9eea5d9085c8d741a6e437dda7e5fe298d38657303230c54918a9b
MD5 bae46f4df54b26ff96d283db6536fa69
SHA1 a2c54c83bc38725d8c59474b76a74241ab4247fe
SHA512 221728d6315d6ca367ef162ea6b76e906991d4f82b0ff633276553e56a7429fcd438683b87971ad0c60f33049943261b20bb7e08031fb504e1cce8d67821dd72
SSDEEP 3072:a3z2Y65oTSJE4Z3w+dxV0WxVV6nvjhBrrFRg4frMZDkGshOHWO9oFB0kXmaT:q2Yd0Z33V0WrInLrrNCYGiKW
TLSH
T12CE313F3EF115602EA8D3630669C8FACF5872DB54CECC606507ABC11872D3066926ADB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

filter_profanity_english.txt.gz

Path C:\Program Files (x86)\Steam\resource\filter_profanity_english.txt.gz
Size 747B
SHA256 741ed2d4a8ddb27527aa04633961eaf071200d292334d3547bfaa3c6a84ecff6
MD5 54736a5ba8f4a395c3e44bd306e20a66
SHA1 8118bd0d0fd9dd3ade32de7af5f646154fffaa04
SHA512 a9abddef8d80f21591d04187d49545fb6250f98b6fe71dac5947047af424b716f4ae901346d0fbd96a32387d992e9929eb517f3d0cd0f4d1ae63fb52f81a1ab4
TLSH
T1B901BAD3150D5FCB678D191EB6ABC619154E494C130EB4FEC0CC76734C1ED2BA192324
MD5 SHA1 SHA512 TLSH

Submit Download

filter_profanity_french.txt.gz

Path C:\Program Files (x86)\Steam\resource\filter_profanity_french.txt.gz
Size 499B
SHA256 2a1c8f6da7fc08c1bd042e65cc40dc72ec72a3b9b677fa7d02026ea5b941fdde
MD5 1f55931b5d0d05dd9398d96263d88a36
SHA1 bc0de7654e990649fe3be54b734beb9b89033b23
SHA512 8dd343c05a270d1c0fd91899da2dee2aa328190a06a7cc25047c276693b13df235f8ee5cc43eb3219c2cdfc829ae0abe4552cb97aac30133403c4692e908db63
TLSH
T140F00E8C394F6181F450E8F01E7B35A33116730173410409A9CC643297E0D62335F9F5
MD5 SHA1 SHA512 TLSH

Submit Download

filter_profanity_german.txt.gz

Path C:\Program Files (x86)\Steam\resource\filter_profanity_german.txt.gz
Size 407B
SHA256 e3a88c731f26074c22bb1989e92553a85c2a18c51559ce39e314dd48950d8fc5
MD5 8bfc5b057586059b445bd936160c4965
SHA1 ea8fac642061080616abfe3a357f8f64b919d81e
SHA512 1c4eb3424f2a39a811ebff6a8c7e7eb6067628eabcae180cfb28d67ca0fa457189b5025274cb9c5f4ad73614f8f338c4512041f92d98b1ae2561425e4fc3aec7
TLSH
T1C7E0F199B28C6735E002F135364D52C06BD4F603F240501B6BE6BDF90D7682FE66194A
MD5 SHA1 SHA512 TLSH

Submit Download

steam.cfg

Path C:\Program Files (x86)\Steam\steam.cfg
Size 66B
SHA256 78264d718910cd63c1ad51f65f49fd48beb0b4615cdc3831b3c45f86d2ce58bf
MD5 b2d6748cad31a9256f9b839058cef0c0
SHA1 3542d95bf1189039844ba86f2d21b756a94568bd
SHA512 69c51f35a5b27c7aad23cdc14202ea40dc621f06af7adbf3e1fb1662dc10a422610084bfcecb16c3ab371b9b26268b2435fc96ccb2218263ee6bad1f2656779d
TLSH
T1A7A0220E00E030A8CE00AA2E23082E88030308388300083C03C2200C8E8FE8033CFB80
MD5 SHA1 SHA512 TLSH

Submit Download

steam.exe

Path C:\Program Files (x86)\Steam\steam.exe
Size 4.0MB
SHA256 48690fe327c139008163a0357781de0d86320ebd87eb5fde0095c5b3957aa8be
MD5 5a19698fb09729abff3102773232a5f8
SHA1 93077000812c06b8d7bc610243d3eb5e36f008db
SHA512 f23e06e21136bbf9dd55f97ce7d52e35edee761a5e4bf3cd7fdbcc70376c0ecc5afaaeba2b120c36aff7a833d458c94717189cbd694bc67e50ffb313f84259b0
SSDEEP 98304:DIvtjtQo3X9K+5AsLzLsE0eoYGjVqOS8V4gDR7Er:sltVg+NKYG3lRAr
TLSH
T1AE16BF62BB01C071E9C20275587EAB7A597EAE204735C4C3E7D43D6A88316D33B3B796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamclient.dll

Path C:\Program Files (x86)\Steam\steamclient.dll
Size 18.0MB
SHA256 ca3fa32e261782bb7fc9effcc1b0ad0ec3d58a53b75e1699f30a2cf68475ce63
MD5 f09372b94c77dd7fc027184f1fe8240d
SHA1 fffdadea91f5841db3bb798f67c53223ab6b6a13
SHA512 cea5216a6ba2f2c8e236265fe83286951842c42257c464fc16ac3addc3911d585b75f6a57cc27072110e0be3422608863abb110a52cb838affdd4670b9250fb6
SSDEEP 393216:y9OavXy+2oAtO5dsrFN0aaJZuO94lBhfsewWnRHz:kOMyppkT9KmewoZz
TLSH
T108179E22B705C261F8F10276A8FD7BBD25AEDA210338A1D366C41D598A705E37F3536B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamui.dll

Path C:\Program Files (x86)\Steam\steamui.dll
Size 12.9MB
SHA256 06e102b0872be23bd0df002c6543573c5f9ccaf88d934ceec52cb772f892b3e3
MD5 30856b9e4569e8d26b35a693bf580f0a
SHA1 0f8c87336f9eb06e548d017ed0d0541b0d1fc84a
SHA512 f752f9fc44cb4398721c72dd6308f475ec6f2e952b9714b2344e899d3f00471a0c1223218b5a4366bfb21534dde5cf1335b3edc08fcaa4e61b11c0085b09e407
SSDEEP 196608:ll7jdhixzpeg0dtS8dfPDiuRRh3ll2JXrz:ll72zILS8dTpRn3lyX
TLSH
T13ED69E13B500C224E8E342B999BFBF789C6D9A540738C1C372D03E5A85755E33A7E7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drop06.tga

Path C:\Program Files (x86)\Steam\tenfoot\resource\images\textinput\drop06.tga
Size 244KB
SHA256 996cd2d01542cec922c384708dcbfc8aee8773333ebda9a398f0236675f129b1
MD5 c7afc24e396da59a4ef402ddd2ccbceb
SHA1 dafbca40f8420fdf6c426fa6a3f0f6a43fb493d9
SHA512 013ff1f14b8c7214c88e42cf5d270324f4bbac6bf6b5eafa7dadf8d658c0eaa97a52f326df62867dab7926e8edbcb5bac89a0e675c57de5558f78b1bce313ef2
SSDEEP 12:7pkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk1:2
TLSH
T1AF34E9385C58D28CAD76835D30F24EEC8E851FDF29BDD78212775F5444D0E086B8A91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tier0_s.dll

Path C:\Program Files (x86)\Steam\tier0_s.dll
Size 336KB
SHA256 2a6d27bc04cdc7ba5d3d82279d3d5d5e9d250d16ffb6a2375b83b4b69657561b
MD5 0003f5d48bc5e517879e97a98e63a578
SHA1 29c39567ea293af5e5190d679dd9d1062fe4a96a
SHA512 fb20216a6954c2dc1be315ad5a739e8548d6c986caa7752b493a856ace72fbe839c5fbb40743cdabc13096435eb50b3dbda277f125ccfe4616465891b69522fa
SSDEEP 6144:pF/FHZx4Aaki60UqK6xhu3dJx8wva2uerILY1BOWp944g5UDKwg6B:xHZeAaki1zu3dJx8wvzueWm44gSeb6B
TLSH
T14474AE12F841C033E4F11575C878DB65197DA5260BBBC9EFA3881A7E0E262D39736B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8.dll

Path C:\Program Files (x86)\Steam\v8.dll
Size 4.7MB
SHA256 da42f5ac7490ca17306596619b1b92c314bc8101e4ac8fc3c3cf81f529ffdfaa
MD5 7b4acbf9ee05b7f6c8626b76bac4b7ee
SHA1 8e527d4ea3b3628c1d27e258647231a7e02470b8
SHA512 04882d492246632f9ee04948e67a9266ed5f2d9b8fe81f355c007f89e4e3ab8b6425f9fd64559a5069e50f801747c778a596e64759b12eae9c28f31fad279953
SSDEEP 98304:C9qkTDkXgahL+wTpimzw6kwyj3zvya7gZ:bkuhLJkmzjkwyj3u7Z
TLSH
T1AB369E21BA51C53AC4EB12B185AE9B6EA42D83590B3C50D3B3CC4DB52B71AD32F35B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

video.dll

Path C:\Program Files (x86)\Steam\video.dll
Size 3.5MB
SHA256 14dc424d79696085be9499bcdb0e96824dc50e71d2b221667e038999a0ff274c
MD5 d820046459d718bef715ac963468ca85
SHA1 fe32accdfb721557f54611e3cf3a2598377a9f05
SHA512 3048d606008f394f4b24aa7abc761d9ff73c84077e61f2ea6cac910ace53506992e7d3585fa5c0dc21cafcf3e2f0ef2f1c4124449535e1b08d913163e64aa270
SSDEEP 98304:FPaygzNe19Vhq/JPBk3G3/lY4gz4svoOSn:hrgwrVWGawroBn
TLSH
T1F906BF22BA42C072E5DE01B5A47E9B7E4D7D6A144334C5D3DBD4296A98301E33B3F3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vstdlib_s.dll

Path C:\Program Files (x86)\Steam\vstdlib_s.dll
Size 529KB
SHA256 a64d26a17e0cf16a88361fca759899d569c25df57e54acdc0bbf83e70b0d2ae5
MD5 a44d5dd8acf4b1b3d574a2f245d169d8
SHA1 186df3c6981c84cc291ec419ae88908f7e0b1210
SHA512 83f3c6980b44288bce85e743d928349561f706ac7fe2ebcbe3baba91a1a1d46ce3f73c0cc3f69108d2f52801ba0c783a5f5b00bb49e73dcf44ef1faf848b0f88
SSDEEP 6144:eeXFBXyE6Qrntl19vlu883Rm0z6NJLgDBL69iOmQL2R3El7aPX+C6:LwGnL19vt83Rmm6NsXql7k+C6
TLSH
T1B6B4AE22BCA1C073EAF11430947CEE61093C6D201B76E5F777A835B6EE301D26A7576A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 b4bd4adc867f23419c50ac89f0b7d68272ab6eedc9c82c14399f0b306c9a5d3a
MD5 1f5533bd86bd5a10a7b5961848848edd
SHA1 c3d3059360472d08049b3f5188e6a0b6b330d1be
SHA512 56fbeb85e7fc069d480072f2790d0381bd2065ecef3553e4d9242d2cd6f3be4bbf2245ef1f936e4a9f0857f3d17195b2ba246bc8945e877ececdb07bf7d7882b
TLSH
T11CC04C501D9C0704CBA04DB5B3D6CE923570C9D715270F0D1EBC81BD65253F14779170
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c11ab.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe5c11ab.TMP
Size 48B
SHA256 ecd9c5c36bb8e95ee2605ec4648e8338afd4ace07ab6f96a5efe263f3e0983a3
MD5 498ad0d1e75eff1d11917734741d14ff
SHA1 eff0a70450164bad8933c3d837a7e3c7192dd005
SHA512 f525f24d5f9c7d1724a05634ec076f23482e4507938a0055dde7d6f52d32a2213bcf99695bda88d3840e814ca0315dbf4af9c1c25bda1f74026703d0b05c166a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

steamui_english.txt

Path \??\c:\program files (x86)\steam\public\steamui_english.txt
Size 324KB
SHA256 ca9822cbf9e5719dafb731e052823f83d51c452448ee8bbb4a1fae2f4e97972a
MD5 b5b3d03ef0b594189bbd4132718aebc6
SHA1 1b103e917c2b9b2f9fb77debaf4177315540b301
SHA512 3097845e05defdce04cabe9546c7b777c75748c56fa3b6a6d5b40a2351e39e88a37d9710a80d10c019d0c12e5fbfdf8db3171a9c20a13b57d9af13209ce590c9
SSDEEP 3072:3s2AGKsFWPC9sPA7owaXbzTdLwvdoQgNOaAX+72IncLTLuDF:JAs5sh7ds9gR8O
TLSH
T1FC64092BC71251BE96FEC656FC0E9577AA2DC1DF13017C0538E8910C2357B85B27BA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

overlay_english.txt

Path \??\c:\program files (x86)\steam\resource\overlay_english.txt
Size 16KB
SHA256 029544b2a54e03abb2e220a09a123cf4812c4981ca08ad3c8f74683f4aaacdb1
MD5 1622ddd3e84e3dec20ea3ec1eea12a1b
SHA1 ed1060cd80eea8ca6f6c17599e37243a3b21c40c
SHA512 f0b7942534f96df87962e2b6e3e55ae8bc059d1250e34967dd8604244169d664d99ce528911dd3d893159b9f4fe998ee07103ca5533315a64244e8dfb50228f3
SSDEEP 384:vIFUc0GvQ7zzCRBF0KoSqsdKYvSwp7L9l2TRNXwun6ihwvkqBofX0PMK:tXsHqsd/9gByvzBV
TLSH
T1C37295BAB9C387FDC1EBE217EC0BA8AAAB3E7DD612125DD1348C801B1654F84B357544
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

platform_english.txt

Path \??\c:\program files (x86)\steam\resource\platform_english.txt
Size 4KB
SHA256 3df67625eba668e08a120f14dd2772e128b54085775c89c19bd7ca177ee44a5c
MD5 f9918686d321a9553e394c08e63263ab
SHA1 ad3c1dd56e58adbd4f2c882c95a0d3704941c232
SHA512 e5e1225168abeab7d2ccb73aef39e632f4ec3554ef42770cd25c248466b6efff0c4c922d4182b64eb46a88eee9c555f54e0b9528dea939aef675d0e30709e0c2
SSDEEP 96:lKOlLF/hkKwHEnINWK7+iGbq9aT6eyeXhekAy:lKOlLF/+zEnINbIoeyghek9
TLSH
T18A816356834A483B059ACA09EC86992BB768D06F03127D1928B8657D74E7D8FF39324B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamscheme.res

Path \??\c:\program files (x86)\steam\resource\steamscheme.res
Size 14KB
SHA256 426637a8db294e65c09fa7bbd35f8b6d2dd56257ac361c9d1a6d5c3107452b3f
MD5 7630798988e2ffe88057508118bf024a
SHA1 b44bc1aecaca33c4b0589fe23049c9e2a191ee36
SHA512 38dde4100fe3203c46497c0d220da8e2c30d158368280643d940d092b9198407d2b06115123cdd95d67dc70d4ae0fba71d6e7e52eec5491de0f09d36ac78ced0
SSDEEP 384:GSv1EcdedMcYdIdgdidcdzpdyNYdqd7uqycdDdFd1dZdZnfqu4++uNuRORta2no:QU
TLSH
T10362F097730F01DE67A2965F5436CCC12F8ED074216EA8EAF60E386DDA94B72107A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam.styles

Path \??\c:\program files (x86)\steam\resource\styles\steam.styles
Size 76KB
SHA256 53cfcb692e4a96d5c35ffec9a1dc8e2eb01d1e721678b3f21bde94fd93ef56db
MD5 6268b452112696a9f6c8c651fc8d8f71
SHA1 2e5a8a9fcedca0f602a201e9d0c8bd11f2ccc522
SHA512 4b256be6441264e64c9f1c54373ce41826127a1e082a2fb580fd403225f8f79f235f92fb6a7a6235c24bc93d24421dfa175ad469b4eb0206f02752b264bdaa65
SSDEEP 1536:ZZWKpNegMOt3MOZHLMocjfxyT/O0+cVXUSigBBFpuvuUWA4nhoWLe8vUljuGOUfM:ZZWKpNegMOt3MOZHLMhjfxyT/O0+cVX9
TLSH
T12F731F08F60A649BA77B965FBA339CC6EF4E803361059ACCBB2D014D1FB4157425CB9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vgui_english.txt

Path \??\c:\program files (x86)\steam\resource\vgui_english.txt
Size 9KB
SHA256 258ff292ed478040493f7ac2827ef2dc7978790ef37abe5c0a0e805155165d7b
MD5 eb6dabc4380f91d7c898e5aedbd5b354
SHA1 01cca7464b09de119f24731a685cbe5d21fdfe88
SHA512 4bd5b66a704098d333899ea476f779eab2e0e05da896ff8580061cb4ec2de2766a79ace44ee3f4b954708a171668f859c4fe23aef352dc2942bde801612691a1
SSDEEP 192:lXCReNkidFdpoudoP2/iHQu5uWc1IabNvllaDuZ+F9b9uV2gH:tweyyRo0YKKCvllaDuZ+HBuVv
TLSH
T1C2122E1B802B45CD4E5FDEAC371F2D1A812882F1201A1EEA9DED864F17DDA18313E5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamui_postlogon_english.txt

Path \??\c:\program files (x86)\steam\steam\cached\steamui_postlogon_english.txt
Size 3KB
SHA256 cd97f377fdd459117ad2ac663f49c65965dfc5d0105b24de52c12087b03df6ee
MD5 96f145782261ab045711491ad91aee4d
SHA1 9a0c73f4f1621ada2bffab9ad042a8eb93711243
SHA512 58a0d3502b487121015e75563daefa8aeade19c361a2f15019e10689eedf0bc9ace895786268ff7ff3493d175bd60b9d184456a2ca99643eee66a07846635367
TLSH
T15681A79BC28121690ADB11213FAB39E7EB59C8AC37450C59744D432D835D9A6E33F9A4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1144-8065-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8101-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8147-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8143-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8139-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-7979-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8077-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8081-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8085-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8091-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8095-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8059-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8105-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8109-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8113-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8117-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8121-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8125-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8131-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/1144-8135-0x000000006FAC0000-0x0000000070D0A000-memory.dmp

Download

memory/3212-7992-0x0000028AB1630000-0x0000028AB16D8000-memory.dmp

Download

memory/4716-8061-0x000001A6BD060000-0x000001A6BD108000-memory.dmp

Download

memory/6012-8064-0x000001B66CCB0000-0x000001B66CD58000-memory.dmp

Download