Windows Analysis Report
SteamSetup.exe

Overview

General Information

Sample name: SteamSetup.exe
Analysis ID: 1558928
MD5: 1b34108b77b984e227bbad718d89594a
SHA1: a75f5432e2ce39dc6c3f190d8d35ee2475a0ae6b
SHA256: 3f27a1a005beb7b1032bf9aef9fe5128ee1cccc332de862717b42d0b7f9c1f34
Tags: exeuser-J_Jancelewicz
Infos:

Detection

Score: 24
Range: 0 - 100
Whitelisted: false
Confidence: 20%

Signatures

Connects to many ports of the same IP (likely port scanning)
Yara detected Generic Downloader
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Detected TCP or UDP traffic on non-standard ports
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files

Classification

Uses 32bit PE files
Source: SteamSetup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{97C23183-77ED-457C-90C7-3FA73E699316}_is1 Jump to behavior
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:52303 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.254.199.184:443 -> 192.168.2.4:52571 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.254.199.184:443 -> 192.168.2.4:52572 version: TLS 1.2
Source: unknown HTTPS traffic detected: 155.133.253.36:443 -> 192.168.2.4:52573 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.254.192.98:443 -> 192.168.2.4:52574 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.254.192.99:443 -> 192.168.2.4:52575 version: TLS 1.2
Source: unknown HTTPS traffic detected: 155.133.253.52:443 -> 192.168.2.4:52576 version: TLS 1.2
Source: SteamSetup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: /_/artifacts/obj/WindowsFormsIntegration/x64/Release/net8.0/WindowsFormsIntegration.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Resources.Reader/Release/net8.0-windows/System.Resources.Reader.pdbSHA256 source: is-JT9R1.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdb source: is-OL3NB.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb source: is-M7PK8.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: is-LFOPB.tmp.1.dr
Source: Binary string: System.ComponentModel.ni.pdb source: is-RT9LP.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.ZipFile\Release\net8.0-windows\System.IO.Compression.ZipFile.pdb source: is-G8384.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Metadata\Release\net8.0\System.Reflection.Metadata.pdb source: is-SELO9.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Emit.Lightweight\Release\net8.0\System.Reflection.Emit.Lightweight.pdb source: is-8Q6ES.tmp.1.dr
Source: Binary string: PresentationFramework.Luna.ni.pdb source: is-0QI8B.tmp.1.dr
Source: Binary string: System.Threading.AccessControl.ni.pdb source: is-6E0AB.tmp.1.dr
Source: Binary string: /_/artifacts/obj/UIAutomationClientSideProviders/x64/Release/net8.0/UIAutomationClientSideProviders.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdbSHA256 source: is-E704A.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XDocument\Release\net8.0\System.Xml.XDocument.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdbSHA256& source: is-J5Q53.tmp.1.dr
Source: Binary string: System.Reflection.Metadata.ni.pdb source: is-SELO9.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml.Linq/Release/net8.0-windows/System.Xml.Linq.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Windows.Input.Manipulations/x64/Release/net8.0/System.Windows.Input.Manipulations.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdbSHA256> source: is-C8Q0I.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdb source: is-9VBVU.tmp.1.dr
Source: Binary string: System.Windows.Input.Manipulations.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XDocument\Release\net8.0\System.Xml.XDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp, is-2TVF9.tmp.1.dr
Source: Binary string: System.Xaml.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Web/Release/net8.0-windows/System.Web.pdb source: is-8SOAE.tmp.1.dr
Source: Binary string: System.Text.Json.ni.pdb source: is-LFOPB.tmp.1.dr
Source: Binary string: System.Linq.ni.pdb source: is-9VBVU.tmp.1.dr
Source: Binary string: System.Formats.Tar.ni.pdb source: is-URA97.tmp.1.dr
Source: Binary string: /_/artifacts/obj/UIAutomationProvider/x64/Release/net8.0/UIAutomationProvider.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Threading.AccessControl/Release/net8.0-windows/System.Threading.AccessControl.pdb source: is-6E0AB.tmp.1.dr
Source: Binary string: System.Xml.XPath.XDocument.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Xml/Release/net8.0-windows/System.Xml.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.ReaderWriter\Release\net8.0\System.Xml.ReaderWriter.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: WindowsBase.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.CSharp\Release\net8.0-windows\Microsoft.CSharp.pdb source: is-U5CAB.tmp.1.dr
Source: Binary string: System.Windows.Presentation.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Text.RegularExpressions.ni.pdb source: is-SNOP4.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Resources.Reader/Release/net8.0-windows/System.Resources.Reader.pdb source: is-JT9R1.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Windows/Release/net8.0-windows/System.Windows.pdbSHA256 source: is-7D57R.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Requests\Release\net8.0-windows\System.Net.Requests.pdbSHA256@ source: is-IU0LQ.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdb source: is-C8Q0I.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.ReaderWriter\Release\net8.0\System.Xml.ReaderWriter.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel\Release\net8.0\System.ComponentModel.pdb source: is-RT9LP.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: is-219L9.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdbSHA256 source: is-5A8TQ.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Emit.Lightweight\Release\net8.0\System.Reflection.Emit.Lightweight.pdbSHA256 source: is-8Q6ES.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net8.0/System.Configuration.ConfigurationManager.pdb source: is-EVMTH.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdb source: is-21558.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdb source: is-5A8TQ.tmp.1.dr
Source: Binary string: /_/artifacts/obj/WindowsBase/x64/Release/net8.0/WindowsBase.pdbRSDS#F source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: UIAutomationProvider.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Xml.Serialization/Release/net8.0-windows/System.Xml.Serialization.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Requests\Release\net8.0-windows\System.Net.Requests.pdb source: is-IU0LQ.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: is-3DQQ4.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdb source: is-G9TVR.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Windows/Release/net8.0-windows/System.Windows.pdb source: is-7D57R.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml/Release/net8.0-windows/System.Xml.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/PresentationFramework.Luna/x64/Release/net8.0/PresentationFramework.Luna.pdb source: is-0QI8B.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb===GCTL source: is-M7PK8.tmp.1.dr
Source: Binary string: Microsoft.CSharp.ni.pdb source: is-U5CAB.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Windows.Presentation/x64/Release/net8.0/System.Windows.Presentation.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Net.WebProxy.ni.pdb source: is-3U4SF.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdb source: is-J5Q53.tmp.1.dr
Source: Binary string: UIAutomationClient.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Tar\Release\net8.0-windows\System.Formats.Tar.pdb source: is-URA97.tmp.1.dr
Source: Binary string: /_/artifacts/obj/WindowsBase/x64/Release/net8.0/WindowsBase.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.IO.Compression.ZipFile.ni.pdb source: is-G8384.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdbSHA256s# source: is-G9TVR.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdb source: is-KSMQT.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net8.0-windows\System.Console.pdb source: is-QLJJ1.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Design.Facade/Release/net8.0/System.Design.pdb source: is-7IP4F.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml.Linq/Release/net8.0-windows/System.Xml.Linq.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net8.0/System.Configuration.ConfigurationManager.pdbSHA256 source: is-EVMTH.tmp.1.dr
Source: Binary string: /_/artifacts/obj/WindowsFormsIntegration/x64/Release/net8.0/WindowsFormsIntegration.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: UIAutomationClientSideProviders.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb source: is-G721R.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xaml/x64/Release/net8.0/System.Xaml.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Memory.ni.pdb source: is-219L9.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdb source: is-N6T5R.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath.XDocument\Release\net8.0\System.Xml.XPath.XDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath\Release\net8.0\System.Xml.XPath.pdbSHA256] source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\bin\wpfgfx\x64\Release\wpfgfx_cor3.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Web/Release/net8.0-windows/System.Web.pdbSHA256 source: is-8SOAE.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebProxy\Release\net8.0\System.Net.WebProxy.pdb source: is-3U4SF.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Data.Common\Release\net8.0\System.Data.Common.pdb source: is-S7M74.tmp.1.dr
Source: Binary string: System.Net.Requests.ni.pdb source: is-IU0LQ.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml.Serialization/Release/net8.0-windows/System.Xml.Serialization.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Xaml/x64/Release/net8.0/System.Xaml.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Runtime.InteropServices.ni.pdb source: is-3DQQ4.tmp.1.dr
Source: Binary string: /_/artifacts/obj/UIAutomationTypes/x64/Release/net8.0/UIAutomationTypes.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdbxxxGCTL source: is-21558.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp, is-2TVF9.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdbSHA256l8 source: is-KSMQT.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.IO.Packaging/Release/net8.0/System.IO.Packaging.pdb source: is-O2VS5.tmp.1.dr
Source: Binary string: /_/artifacts/obj/UIAutomationClientSideProviders/x64/Release/net8.0/UIAutomationClientSideProviders.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdbSHA256 source: is-9VBVU.tmp.1.dr
Source: Binary string: UIAutomationTypes.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ConfigurationManager.ni.pdb source: is-EVMTH.tmp.1.dr
Source: Binary string: System.Console.ni.pdb source: is-QLJJ1.tmp.1.dr
Source: Binary string: System.Security.Cryptography.ProtectedData.ni.pdb source: is-OL3NB.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath\Release\net8.0\System.Xml.XPath.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdbSHA2564- source: is-N6T5R.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: is-E704A.tmp.1.dr
Source: Binary string: WindowsFormsIntegration.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdbmmmGCTL source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: System.Data.Common.ni.pdb source: is-S7M74.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Windows.Presentation/x64/Release/net8.0/System.Windows.Presentation.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/UIAutomationClient/x64/Release/net8.0/UIAutomationClient.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.RegularExpressions\Release\net8.0\System.Text.RegularExpressions.pdb source: is-SNOP4.tmp.1.dr
Source: Binary string: System.IO.Packaging.ni.pdb source: is-O2VS5.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebProxy\Release\net8.0\System.Net.WebProxy.pdbSHA256 source: is-3U4SF.tmp.1.dr

Networking
barindex
Connects to many ports of the same IP (likely port scanning)
Source: global traffic TCP traffic: 162.254.199.165 ports 27018,0,1,2,7,8
Yara detected Generic Downloader
Source: Yara match File source: C:\Users\user\AppData\Local\Programs\SteamClient\is-0A2IM.tmp, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Programs\SteamClient\is-H6DF9.tmp, type: DROPPED
Source: Yara match File source: C:\Users\user\AppData\Local\Programs\SteamClient\is-EL3N4.tmp, type: DROPPED
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.4:52304 -> 162.254.199.165:27018
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-atl3.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: SX1pmJICoUOgvcAEWO04Yg==Sec-WebSocket-Version: 13
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp1-dfw1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 8pAM8HKoEEa2SDwRfJv7Yw==Sec-WebSocket-Version: 13
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp1-iad1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 4Mzn+oyKNEOPx/VMky/HWA==Sec-WebSocket-Version: 13
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-iad1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 9SfrCnjzD0+vkNHqMYQEtw==Sec-WebSocket-Version: 13
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-dfw1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: gct+FU7dl0WK9aM8K5/MdQ==Sec-WebSocket-Version: 13
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 104.102.49.254 104.102.49.254
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /ISteamDirectory/GetCMListForConnect/v1/?format=vdf&cellid=0 HTTP/1.1Host: api.steampowered.comUser-Agent: SteamKit/3.0.0
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-atl3.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: SX1pmJICoUOgvcAEWO04Yg==Sec-WebSocket-Version: 13
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp1-dfw1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 8pAM8HKoEEa2SDwRfJv7Yw==Sec-WebSocket-Version: 13
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp1-iad1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 4Mzn+oyKNEOPx/VMky/HWA==Sec-WebSocket-Version: 13
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-iad1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 9SfrCnjzD0+vkNHqMYQEtw==Sec-WebSocket-Version: 13
Source: global traffic HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-dfw1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: gct+FU7dl0WK9aM8K5/MdQ==Sec-WebSocket-Version: 13
Source: global traffic DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic DNS traffic detected: DNS query: api.steampowered.com
Source: global traffic DNS traffic detected: DNS query: cmp1-atl3.steamserver.net
Source: global traffic DNS traffic detected: DNS query: cmp2-atl3.steamserver.net
Source: global traffic DNS traffic detected: DNS query: cmp1-dfw1.steamserver.net
Source: global traffic DNS traffic detected: DNS query: cmp1-iad1.steamserver.net
Source: global traffic DNS traffic detected: DNS query: cmp2-iad1.steamserver.net
Source: global traffic DNS traffic detected: DNS query: cmp2-dfw1.steamserver.net
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://uri.etsi.org/01903/v1.2.2#SSOFTWARE
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://uri.etsi.org/01903/v1.2.2#SignedProperties
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: http://uri.etsi.org/01903/v1.2.2#bhttp://uri.etsi.org/01903/v1.2.2#SignedProperties
Source: is-EVMTH.tmp.1.dr, is-O2VS5.tmp.1.dr, is-SELO9.tmp.1.dr String found in binary or memory: https://aka.ms/binaryformatter
Source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp String found in binary or memory: https://aka.ms/dotnet-core-applaunch?Architecture:
Source: is-21558.tmp.1.dr String found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=&os
Source: is-IU0LQ.tmp.1.dr String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp, is-21558.tmp.1.dr String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: is-21558.tmp.1.dr String found in binary or memory: https://aka.ms/dotnet/download
Source: is-21558.tmp.1.dr String found in binary or memory: https://aka.ms/dotnet/downloadUsage:
Source: is-21558.tmp.1.dr String found in binary or memory: https://aka.ms/dotnet/info
Source: is-21558.tmp.1.dr String found in binary or memory: https://aka.ms/dotnet/sdk-not-foundFailed
Source: is-EVMTH.tmp.1.dr, is-O2VS5.tmp.1.dr, is-S7M74.tmp.1.dr, is-SELO9.tmp.1.dr String found in binary or memory: https://aka.ms/serializationformat-binary-obsolete
Source: is-SNOP4.tmp.1.dr String found in binary or memory: https://github.com/dotnet/linker/issues/2715.
Source: is-5A8TQ.tmp.1.dr, is-9VBVU.tmp.1.dr, is-3U4SF.tmp.1.dr, is-N6T5R.tmp.1.dr, is-SNOP4.tmp.1.dr, is-3DQQ4.tmp.1.dr, is-EVMTH.tmp.1.dr, is-2TVF9.tmp.1.dr, is-KSMQT.tmp.1.dr, is-LFOPB.tmp.1.dr, is-8Q6ES.tmp.1.dr, is-J5Q53.tmp.1.dr, is-8SOAE.tmp.1.dr, is-O2VS5.tmp.1.dr, is-C8Q0I.tmp.1.dr, is-S7M74.tmp.1.dr, is-7D57R.tmp.1.dr, is-SELO9.tmp.1.dr, is-U5CAB.tmp.1.dr, is-IU0LQ.tmp.1.dr, is-URA97.tmp.1.dr String found in binary or memory: https://github.com/dotnet/runtime
Source: is-JT9R1.tmp.1.dr String found in binary or memory: https://github.com/dotnet/runtime0
Source: is-KSMQT.tmp.1.dr String found in binary or memory: https://github.com/dotnet/runtime;
Source: is-8SOAE.tmp.1.dr String found in binary or memory: https://github.com/dotnet/runtimeH
Source: is-J5Q53.tmp.1.dr String found in binary or memory: https://github.com/dotnet/runtimer
Source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://github.com/dotnet/runtimezX
Source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, is-7IP4F.tmp.1.dr String found in binary or memory: https://github.com/dotnet/winforms
Source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp, is-0QI8B.tmp.1.dr String found in binary or memory: https://github.com/dotnet/wpf
Source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp, is-0QI8B.tmp.1.dr String found in binary or memory: https://github.com/dotnet/wpf4
Source: is-S7M74.tmp.1.dr String found in binary or memory: https://github.com/mono/linker/issues/1187
Source: is-U5CAB.tmp.1.dr String found in binary or memory: https://github.com/mono/linker/issues/1416.
Source: is-U5CAB.tmp.1.dr String found in binary or memory: https://github.com/mono/linker/issues/1906.
Source: is-S7M74.tmp.1.dr String found in binary or memory: https://github.com/mono/linker/issues/1981
Source: SteamSetup.exe String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: SteamSetup.exe, 00000000.00000003.1688166005.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.exe, 00000000.00000003.1687407738.0000000002690000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000000.1689708207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-46PES.tmp.1.dr String found in binary or memory: https://www.innosetup.com/
Source: SteamSetup.exe, 00000000.00000003.1688166005.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.exe, 00000000.00000003.1687407738.0000000002690000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000000.1689708207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-46PES.tmp.1.dr String found in binary or memory: https://www.remobjects.com/ps
Source: SteamSetup.tmp, 00000001.00000003.1692507487.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1887946566.000000000250C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.steam.com/
Source: SteamSetup.exe, 00000000.00000003.1903609511.0000000002433000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.steam.com/Q6C
Source: SteamSetup.tmp, 00000001.00000003.1887946566.000000000250C000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://www.steam.com/Q9Q
Source: unknown Network traffic detected: HTTP traffic on port 52303 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52571 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52572 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52574
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52575
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52572
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52573
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52303
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52576
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 52571
Source: unknown Network traffic detected: HTTP traffic on port 52574 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52573 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52575 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 52576 -> 443
Source: unknown HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:52303 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.254.199.184:443 -> 192.168.2.4:52571 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.254.199.184:443 -> 192.168.2.4:52572 version: TLS 1.2
Source: unknown HTTPS traffic detected: 155.133.253.36:443 -> 192.168.2.4:52573 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.254.192.98:443 -> 192.168.2.4:52574 version: TLS 1.2
Source: unknown HTTPS traffic detected: 162.254.192.99:443 -> 192.168.2.4:52575 version: TLS 1.2
Source: unknown HTTPS traffic detected: 155.133.253.52:443 -> 192.168.2.4:52576 version: TLS 1.2
PE file contains executable resources (Code or Archives)
Source: SteamSetup.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
PE file does not import any functions
Source: is-HTHBE.tmp.1.dr Static PE information: No import functions for PE file found
Source: is-UCH6K.tmp.1.dr Static PE information: No import functions for PE file found
Source: is-9VBVU.tmp.1.dr Static PE information: No import functions for PE file found
Source: is-BV18A.tmp.1.dr Static PE information: No import functions for PE file found
Source: is-O2VS5.tmp.1.dr Static PE information: No import functions for PE file found
Source: is-V92IG.tmp.1.dr Static PE information: No import functions for PE file found
Source: is-KPNTM.tmp.1.dr Static PE information: No import functions for PE file found
Source: is-IOHDI.tmp.1.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: SteamSetup.exe, 00000000.00000003.1688166005.000000007FE36000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs SteamSetup.exe
Source: SteamSetup.exe, 00000000.00000003.1903609511.00000000023F8000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs SteamSetup.exe
Source: SteamSetup.exe, 00000000.00000003.1687407738.000000000277A000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs SteamSetup.exe
Source: SteamSetup.exe, 00000000.00000000.1685924822.00000000004C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs SteamSetup.exe
Source: SteamSetup.exe Binary or memory string: OriginalFileName vs SteamSetup.exe
Uses 32bit PE files
Source: SteamSetup.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: is-IOHDI.tmp.1.dr, PipeStream.cs Task registration methods: 'RegisterForCancellation'
Source: is-IOHDI.tmp.1.dr, PipeSecurity.cs Security API names: System.IO.Pipes.PipeSecurity.GetAccessControlSectionsFromChanges()
Source: is-IOHDI.tmp.1.dr, PipeSecurity.cs Security API names: ((CommonObjectSecurity)this).AddAccessRule
Source: is-IOHDI.tmp.1.dr, PipeSecurity.cs Security API names: System.Security.AccessControl.CommonObjectSecurity.GetAccessRules(bool, bool, System.Type)
Source: is-IOHDI.tmp.1.dr, NamedPipeServerStream.cs Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: is-IOHDI.tmp.1.dr, NamedPipeServerStream.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: is-IOHDI.tmp.1.dr, NamedPipeClientStream.cs Security API names: System.IO.Pipes.PipeStream.GetAccessControl()
Source: is-IOHDI.tmp.1.dr, NamedPipeClientStream.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: is-UCH6K.tmp.1.dr, Helper.cs Security API names: System.IO.FileSystemAclExtensions.SetAccessControl(System.IO.DirectoryInfo, System.Security.AccessControl.DirectorySecurity)
Source: is-UCH6K.tmp.1.dr, Helper.cs Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
Source: classification engine Classification label: sus24.troj.winEXE@5/496@8/7
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Mutant created: NULL
Source: C:\Users\user\Desktop\SteamSetup.exe File created: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: SteamSetup.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\SteamSetup.exe File read: C:\Users\user\Desktop\SteamSetup.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SteamSetup.exe "C:\Users\user\Desktop\SteamSetup.exe"
Source: C:\Users\user\Desktop\SteamSetup.exe Process created: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp "C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp" /SL5="$10472,49358704,796160,C:\Users\user\Desktop\SteamSetup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process created: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe "C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe"
Source: C:\Users\user\Desktop\SteamSetup.exe Process created: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp "C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp" /SL5="$10472,49358704,796160,C:\Users\user\Desktop\SteamSetup.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process created: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe "C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe" Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: linkinfo.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: ntshrui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: cscapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: icu.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: d3dcompiler_47_cor3.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: msctfui.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: wshunix.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: devobj.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{97C23183-77ED-457C-90C7-3FA73E699316}_is1 Jump to behavior
Source: SteamSetup.exe Static file information: File size 50219482 > 1048576
Source: SteamSetup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: /_/artifacts/obj/WindowsFormsIntegration/x64/Release/net8.0/WindowsFormsIntegration.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Resources.Reader/Release/net8.0-windows/System.Resources.Reader.pdbSHA256 source: is-JT9R1.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdb source: is-OL3NB.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb source: is-M7PK8.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: is-LFOPB.tmp.1.dr
Source: Binary string: System.ComponentModel.ni.pdb source: is-RT9LP.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.ZipFile\Release\net8.0-windows\System.IO.Compression.ZipFile.pdb source: is-G8384.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Metadata\Release\net8.0\System.Reflection.Metadata.pdb source: is-SELO9.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Emit.Lightweight\Release\net8.0\System.Reflection.Emit.Lightweight.pdb source: is-8Q6ES.tmp.1.dr
Source: Binary string: PresentationFramework.Luna.ni.pdb source: is-0QI8B.tmp.1.dr
Source: Binary string: System.Threading.AccessControl.ni.pdb source: is-6E0AB.tmp.1.dr
Source: Binary string: /_/artifacts/obj/UIAutomationClientSideProviders/x64/Release/net8.0/UIAutomationClientSideProviders.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdbSHA256 source: is-E704A.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XDocument\Release\net8.0\System.Xml.XDocument.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdbSHA256& source: is-J5Q53.tmp.1.dr
Source: Binary string: System.Reflection.Metadata.ni.pdb source: is-SELO9.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml.Linq/Release/net8.0-windows/System.Xml.Linq.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Windows.Input.Manipulations/x64/Release/net8.0/System.Windows.Input.Manipulations.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdbSHA256> source: is-C8Q0I.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdb source: is-9VBVU.tmp.1.dr
Source: Binary string: System.Windows.Input.Manipulations.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XDocument\Release\net8.0\System.Xml.XDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp, is-2TVF9.tmp.1.dr
Source: Binary string: System.Xaml.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Web/Release/net8.0-windows/System.Web.pdb source: is-8SOAE.tmp.1.dr
Source: Binary string: System.Text.Json.ni.pdb source: is-LFOPB.tmp.1.dr
Source: Binary string: System.Linq.ni.pdb source: is-9VBVU.tmp.1.dr
Source: Binary string: System.Formats.Tar.ni.pdb source: is-URA97.tmp.1.dr
Source: Binary string: /_/artifacts/obj/UIAutomationProvider/x64/Release/net8.0/UIAutomationProvider.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Threading.AccessControl/Release/net8.0-windows/System.Threading.AccessControl.pdb source: is-6E0AB.tmp.1.dr
Source: Binary string: System.Xml.XPath.XDocument.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Xml/Release/net8.0-windows/System.Xml.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.ReaderWriter\Release\net8.0\System.Xml.ReaderWriter.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: WindowsBase.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.CSharp\Release\net8.0-windows\Microsoft.CSharp.pdb source: is-U5CAB.tmp.1.dr
Source: Binary string: System.Windows.Presentation.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Text.RegularExpressions.ni.pdb source: is-SNOP4.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Resources.Reader/Release/net8.0-windows/System.Resources.Reader.pdb source: is-JT9R1.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Windows/Release/net8.0-windows/System.Windows.pdbSHA256 source: is-7D57R.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Requests\Release\net8.0-windows\System.Net.Requests.pdbSHA256@ source: is-IU0LQ.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdb source: is-C8Q0I.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.ReaderWriter\Release\net8.0\System.Xml.ReaderWriter.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel\Release\net8.0\System.ComponentModel.pdb source: is-RT9LP.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: is-219L9.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdbSHA256 source: is-5A8TQ.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Emit.Lightweight\Release\net8.0\System.Reflection.Emit.Lightweight.pdbSHA256 source: is-8Q6ES.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net8.0/System.Configuration.ConfigurationManager.pdb source: is-EVMTH.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdb source: is-21558.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdb source: is-5A8TQ.tmp.1.dr
Source: Binary string: /_/artifacts/obj/WindowsBase/x64/Release/net8.0/WindowsBase.pdbRSDS#F source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: UIAutomationProvider.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Xml.Serialization/Release/net8.0-windows/System.Xml.Serialization.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Requests\Release\net8.0-windows\System.Net.Requests.pdb source: is-IU0LQ.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: is-3DQQ4.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdb source: is-G9TVR.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Windows/Release/net8.0-windows/System.Windows.pdb source: is-7D57R.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml/Release/net8.0-windows/System.Xml.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/PresentationFramework.Luna/x64/Release/net8.0/PresentationFramework.Luna.pdb source: is-0QI8B.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb===GCTL source: is-M7PK8.tmp.1.dr
Source: Binary string: Microsoft.CSharp.ni.pdb source: is-U5CAB.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Windows.Presentation/x64/Release/net8.0/System.Windows.Presentation.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Net.WebProxy.ni.pdb source: is-3U4SF.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdb source: is-J5Q53.tmp.1.dr
Source: Binary string: UIAutomationClient.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Tar\Release\net8.0-windows\System.Formats.Tar.pdb source: is-URA97.tmp.1.dr
Source: Binary string: /_/artifacts/obj/WindowsBase/x64/Release/net8.0/WindowsBase.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.IO.Compression.ZipFile.ni.pdb source: is-G8384.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdbSHA256s# source: is-G9TVR.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdb source: is-KSMQT.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net8.0-windows\System.Console.pdb source: is-QLJJ1.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Design.Facade/Release/net8.0/System.Design.pdb source: is-7IP4F.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml.Linq/Release/net8.0-windows/System.Xml.Linq.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net8.0/System.Configuration.ConfigurationManager.pdbSHA256 source: is-EVMTH.tmp.1.dr
Source: Binary string: /_/artifacts/obj/WindowsFormsIntegration/x64/Release/net8.0/WindowsFormsIntegration.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: UIAutomationClientSideProviders.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb source: is-G721R.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xaml/x64/Release/net8.0/System.Xaml.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Memory.ni.pdb source: is-219L9.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdb source: is-N6T5R.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath.XDocument\Release\net8.0\System.Xml.XPath.XDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath\Release\net8.0\System.Xml.XPath.pdbSHA256] source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\bin\wpfgfx\x64\Release\wpfgfx_cor3.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Web/Release/net8.0-windows/System.Web.pdbSHA256 source: is-8SOAE.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebProxy\Release\net8.0\System.Net.WebProxy.pdb source: is-3U4SF.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Data.Common\Release\net8.0\System.Data.Common.pdb source: is-S7M74.tmp.1.dr
Source: Binary string: System.Net.Requests.ni.pdb source: is-IU0LQ.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml.Serialization/Release/net8.0-windows/System.Xml.Serialization.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Xaml/x64/Release/net8.0/System.Xaml.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Runtime.InteropServices.ni.pdb source: is-3DQQ4.tmp.1.dr
Source: Binary string: /_/artifacts/obj/UIAutomationTypes/x64/Release/net8.0/UIAutomationTypes.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdbxxxGCTL source: is-21558.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp, is-2TVF9.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdbSHA256l8 source: is-KSMQT.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.IO.Packaging/Release/net8.0/System.IO.Packaging.pdb source: is-O2VS5.tmp.1.dr
Source: Binary string: /_/artifacts/obj/UIAutomationClientSideProviders/x64/Release/net8.0/UIAutomationClientSideProviders.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdbSHA256 source: is-9VBVU.tmp.1.dr
Source: Binary string: UIAutomationTypes.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: System.Configuration.ConfigurationManager.ni.pdb source: is-EVMTH.tmp.1.dr
Source: Binary string: System.Console.ni.pdb source: is-QLJJ1.tmp.1.dr
Source: Binary string: System.Security.Cryptography.ProtectedData.ni.pdb source: is-OL3NB.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath\Release\net8.0\System.Xml.XPath.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdbSHA2564- source: is-N6T5R.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: is-E704A.tmp.1.dr
Source: Binary string: WindowsFormsIntegration.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdbmmmGCTL source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: System.Data.Common.ni.pdb source: is-S7M74.tmp.1.dr
Source: Binary string: /_/artifacts/obj/System.Windows.Presentation/x64/Release/net8.0/System.Windows.Presentation.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: /_/artifacts/obj/UIAutomationClient/x64/Release/net8.0/UIAutomationClient.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.RegularExpressions\Release\net8.0\System.Text.RegularExpressions.pdb source: is-SNOP4.tmp.1.dr
Source: Binary string: System.IO.Packaging.ni.pdb source: is-O2VS5.tmp.1.dr
Source: Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebProxy\Release\net8.0\System.Net.WebProxy.pdbSHA256 source: is-3U4SF.tmp.1.dr
Binary contains a suspicious time stamp
Source: is-BV18A.tmp.1.dr Static PE information: 0x82AF122D [Fri Jun 24 06:58:53 2039 UTC]
PE file contains sections with non-standard names
Source: SteamSetup.exe Static PE information: section name: .didata
Source: SteamSetup.tmp.0.dr Static PE information: section name: .didata
Drops PE files
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Json.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-IU0LQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.InteropServices.RuntimeInformation.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FFGT1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemData.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-J5A62.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OHS2U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-5UA7J.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-03T8C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Encoding.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NMQB8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-P1CEB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NI148.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-N6T5R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-9GBK7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationUI.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-21558.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-3T158.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Registry.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-GOJFJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.PerformanceCounter.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FER0U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Forms.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Thread.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Hashing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Resources.ResourceManager.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\createdump.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FGBU1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Registry.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-E537O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FPFGC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-TC3UL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.Native.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.Formatters.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-B4T90.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Concurrent.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-393CK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-2ACL7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\protobuf-net.Core.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Security.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\mscordaccore.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Transactions.Local.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.DiagnosticSource.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.Serialization.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OFR4B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XmlDocument.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-RQKJN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.Xml.Linq.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.CodeDom.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Emit.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-6FLE2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.EventLog.Messages.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Web.HttpUtility.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-CB3FM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-LMELL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-3NS6I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-3CV6V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.DispatchProxy.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-353H2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0QI8B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-D583Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-PR1SN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.DiaSymReader.Native.amd64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-L7DHN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0ED3E.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-4IO64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-4JUH3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Encodings.Web.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Resources.Writer.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Configuration.ConfigurationManager.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OL3NB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Royale.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Forms.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.InteropServices.JavaScript.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.Brotli.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-SELO9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-RMN2A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-S7M74.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-PCJI1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-175RN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\mscorlib.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationNative_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-R29DJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-23N9N.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0TTDC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Resources.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Transactions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-2E66P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NH22G.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-842D2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Csp.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.CoreLib.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-PP8SL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-TAUBR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.SystemEvents.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-URA97.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Tracing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-K613I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-V1K2R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-G5ANC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0KAJQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-G9TVR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemXmlLinq.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-6E0AB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-3DQQ4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-SG76T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\D3DCompiler_47_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.Json.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.NameResolution.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-7V7V0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Dynamic.Runtime.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Aero.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.IsolatedStorage.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-8SOAE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemXml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Sockets.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-O2VS5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Linq.Queryable.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-U5R7O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-B0N4M.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.CompilerServices.VisualC.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-AJ60V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Console.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-IBGJR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FUODR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-1P5NQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\WindowsFormsIntegration.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-PJDI3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemCore.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-O5P26.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.RegularExpressions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OMU5T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-ISS47.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Packaging.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-C1TIS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Pkcs.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Input.Manipulations.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Pipes.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Intrinsics.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-BRU3O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Controls.Ribbon.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-ERNCA.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebSockets.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-41G2F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.TextWriterTraceListener.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationCore.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Forms.Design.Editors.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NK6GU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PenImc_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-7JPAQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-M7PK8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-GK1S4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-6KRKJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Cng.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OD7NK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\hostpolicy.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-V92IG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Tools.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Ping.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-VE7BR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\wpfgfx_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-7F6KI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NGLMS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-3II23.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-ICB9T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-JIDK5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Web.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-H3VRF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-1SION.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-5A8TQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-MJMLB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Principal.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.X509Certificates.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Timer.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-IOHDI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.Common.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XPath.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.Annotations.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-V5O72.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Metadata.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\UIAutomationProvider.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Formats.Asn1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Numerics.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Specialized.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-O9S7G.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-SHJIR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-SA04C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-1GT60.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.Linq.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.Uri.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Emit.ILGeneration.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-G721R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-MT7MH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Printing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Quic.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ServiceProcess.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-EPD79.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-PS2Q9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NBGUE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-4O1SG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-KTNL3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-06ALL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\coreclr.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-7D57R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.Forms.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ValueTuple.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.Watcher.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-KSMQT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-621DK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-KPNTM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-3J2EH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-46PES.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.TraceSource.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\vcruntime140_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Luna.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-QLJJ1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-7PK1K.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-3GH17.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Classic.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-U5CAB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\SteamKit2.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Core.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-TK2A2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.AeroLite.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Pipes.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.TypeExtensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-8Q6ES.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-JS4JU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.AppContext.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-E704A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Buffers.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\UIAutomationClientSideProviders.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-C4PDK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Http.Json.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Immutable.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-JT9R1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-F7HS6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-E52FV.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-J5Q53.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-RPC5P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Design.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-BPLBO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-VBC6I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\DirectWriteForwarder.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-C0NRL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-LFOPB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Design.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Encoding.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebClient.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-IIQJM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FVIIK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Http.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-82OGO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-C6SPK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FHTIL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\protobuf-net.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\mscordaccore_amd64_amd64_8.0.824.36612.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-KM93B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Tasks.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.TypeConverter.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\clrjit.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-E917C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-TH0C6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Encoding.CodePages.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.FileSystem.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-2UHB1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Tasks.Dataflow.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0A2IM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.SecureString.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\msquic.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Presentation.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Mail.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Numerics.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OF9H5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xaml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-E88LT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-QQFQ0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\WindowsBase.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-9VBVU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FQLAJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Channels.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-S9H2V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Linq.Parallel.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.NetworkInformation.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebHeaderCollection.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.HttpListener.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0BV5K.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-G8384.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\netstandard.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-RH90K.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-BMK4J.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebProxy.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.DirectoryServices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NOPIK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-LKC3R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-HUU3F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-DE47S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-CTNSH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XmlSerializer.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.UnmanagedMemoryStream.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-8JNSQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-RT9LP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-BV18A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\UIAutomationTypes.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-IKSD2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-L9IRH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\clrgc.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-C4VI1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-IDQQK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-HT29O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.ReaderWriter.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Numerics.Vectors.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-UCH6K.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0R6D5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.DataContractSerialization.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.InteropServices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XPath.XDocument.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NES76.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Claims.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-D5RPK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Loader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ServiceModel.Web.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\UIAutomationClient.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-EVMTH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-BSKQN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-FUJRK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-I9KME.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-IM89D.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-DN9A9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-8O1SP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0I40G.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-EL3N4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-9A0PH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Principal.Windows.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-QB0O9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.Core.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Tasks.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\mscordbi.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-54V5Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-QQMQ0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-J5UVU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Formats.Tar.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.ThreadPool.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Aero2.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0R4RR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-IJCCG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Linq.Expressions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-9K5SP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-T2AEF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.NonGeneric.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.EventLog.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-C1QE8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Configuration.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OMLDU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-624HU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.CompilerServices.Unsafe.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-2VB07.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-N0JVU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-6UJNJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\hostfxr.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-LB3BN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.ZipFile.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-07LBE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Memory.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-J4F54.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-M1IBB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.MemoryMappedFiles.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.DriveInfo.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemDrawing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-2TVF9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-5I1AN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OEM2B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.ProtectedData.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-MQN3F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\mscorrc.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\ReachFramework.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.OpenSsl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Requests.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-HKSM3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Debug.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-H6DF9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-CG1VF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.dll (copy) Jump to dropped file
Source: C:\Users\user\Desktop\SteamSetup.exe File created: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-S9871.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-83U1I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Permissions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-SNOP4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Contracts.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebSockets.Client.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ObjectModel.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-160D2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0CFKI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-0AA2H.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-6UT8P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XDocument.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.Calendars.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-CDVC3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Common.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-80BQ8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-RUGAU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-HQ8MG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Temp\is-457S0.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.ServicePoint.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-M0K5L.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-VC35U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Accessibility.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.StackTrace.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Handles.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Encoding.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OLKB5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.EventBasedAsync.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-MQH5V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-BGSNO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-RNA4A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-5R65M.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-6A3I2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-OS7F4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NMQLB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-7IP4F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-C8Q0I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Process.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Resources.Reader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-9H3PC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-HTHBE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-R4HMS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-NA0P8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-219L9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-T8PJ7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-HVE4F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-CO8N6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-M4HRH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Overlapped.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.DataSetExtensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Linq.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-J1ACH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\clretwrc.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-85E29.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Algorithms.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-322AN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Emit.Lightweight.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.DataAnnotations.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-4RNUS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.CSharp.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-3U4SF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-16F0N.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.FileVersionInfo.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Tasks.Parallel.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-85LFJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Forms.Design.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-1274N.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Local\Programs\SteamClient\is-HF7IL.tmp Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam.lnk Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Memory allocated: 2CD65900000 memory reserve | memory write watch Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Window / User API: threadDelayed 392 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Window / User API: threadDelayed 924 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Window / User API: threadDelayed 457 Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Window / User API: threadDelayed 6609 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Json.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-IU0LQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.InteropServices.RuntimeInformation.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FFGT1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemData.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OHS2U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-J5A62.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-5UA7J.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-03T8C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Encoding.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NMQB8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-P1CEB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NI148.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-N6T5R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-9GBK7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationUI.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-21558.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-3T158.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Registry.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-GOJFJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.PerformanceCounter.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FER0U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Forms.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Thread.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Hashing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Resources.ResourceManager.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\createdump.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FGBU1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Registry.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-E537O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FPFGC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-TC3UL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.Formatters.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.Native.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-B4T90.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Concurrent.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-393CK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-2ACL7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\protobuf-net.Core.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Security.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\mscordaccore.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Transactions.Local.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.DiagnosticSource.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.Serialization.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OFR4B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XmlDocument.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-RQKJN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.Xml.Linq.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.CodeDom.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Emit.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-6FLE2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.EventLog.Messages.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Web.HttpUtility.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-CB3FM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-LMELL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-3NS6I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.DispatchProxy.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-3CV6V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-353H2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0QI8B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-D583Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-PR1SN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.DiaSymReader.Native.amd64.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-L7DHN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0ED3E.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-4IO64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-4JUH3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Encodings.Web.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Resources.Writer.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Configuration.ConfigurationManager.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Royale.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Forms.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OL3NB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.InteropServices.JavaScript.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.Brotli.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-SELO9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-RMN2A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-S7M74.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-PCJI1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationNative_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\mscorlib.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-175RN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-R29DJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0TTDC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-23N9N.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Transactions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Resources.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-2E66P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NH22G.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-842D2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Csp.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.CoreLib.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-PP8SL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-TAUBR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.SystemEvents.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-URA97.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Tracing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-K613I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-G5ANC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-V1K2R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0KAJQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-G9TVR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemXmlLinq.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-6E0AB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-3DQQ4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-SG76T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.Json.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.NameResolution.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Dynamic.Runtime.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-7V7V0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Aero.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.IsolatedStorage.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-8SOAE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemXml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Sockets.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-O2VS5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Linq.Queryable.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-B0N4M.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-U5R7O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.CompilerServices.VisualC.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-AJ60V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-IBGJR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Console.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FUODR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-1P5NQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\WindowsFormsIntegration.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-PJDI3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemCore.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-O5P26.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.RegularExpressions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OMU5T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-ISS47.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Packaging.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-C1TIS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Pkcs.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Input.Manipulations.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Pipes.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Intrinsics.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-BRU3O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Controls.Ribbon.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-ERNCA.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebSockets.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-41G2F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.TextWriterTraceListener.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationCore.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Forms.Design.Editors.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PenImc_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NK6GU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-7JPAQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-M7PK8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-GK1S4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-6KRKJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Cng.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OD7NK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\hostpolicy.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-V92IG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Ping.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Tools.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\wpfgfx_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-VE7BR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-7F6KI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NGLMS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-3II23.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-ICB9T.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-JIDK5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Web.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-H3VRF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-1SION.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-5A8TQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-MJMLB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Principal.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.X509Certificates.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Timer.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.Common.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-IOHDI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XPath.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.Annotations.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Metadata.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\UIAutomationProvider.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-V5O72.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Formats.Asn1.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Numerics.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Specialized.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-O9S7G.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-SA04C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-SHJIR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-1GT60.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.Linq.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.Uri.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Emit.ILGeneration.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-G721R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-MT7MH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Printing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Quic.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ServiceProcess.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-EPD79.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-PS2Q9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NBGUE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-4O1SG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-KTNL3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-06ALL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\coreclr.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-7D57R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.Forms.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ValueTuple.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.Watcher.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-KSMQT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-621DK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-KPNTM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-3J2EH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-46PES.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.TraceSource.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\vcruntime140_cor3.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Luna.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-QLJJ1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-7PK1K.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Classic.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-3GH17.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\SteamKit2.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-U5CAB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Core.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-TK2A2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.AeroLite.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Pipes.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.TypeExtensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-8Q6ES.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-JS4JU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.AppContext.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-E704A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\UIAutomationClientSideProviders.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Buffers.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-C4PDK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Http.Json.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Immutable.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.AccessControl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-JT9R1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-F7HS6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-E52FV.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-J5Q53.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-RPC5P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Design.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-BPLBO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\DirectWriteForwarder.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-VBC6I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-C0NRL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-LFOPB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Design.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Encoding.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebClient.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FVIIK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-IIQJM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Http.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-C6SPK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-82OGO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FHTIL.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\mscordaccore_amd64_amd64_8.0.824.36612.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\protobuf-net.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-KM93B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Tasks.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.TypeConverter.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\clrjit.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-E917C.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-TH0C6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Encoding.CodePages.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.FileSystem.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-2UHB1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Tasks.Dataflow.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0A2IM.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.SecureString.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Presentation.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\msquic.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Mail.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Numerics.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OF9H5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xaml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-E88LT.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-QQFQ0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\WindowsBase.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-9VBVU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FQLAJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Channels.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-S9H2V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Linq.Parallel.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.NetworkInformation.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.Xml.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebHeaderCollection.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.HttpListener.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0BV5K.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-G8384.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\netstandard.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-RH90K.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-BMK4J.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebProxy.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.DirectoryServices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NOPIK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-LKC3R.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-HUU3F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-DE47S.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-CTNSH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XmlSerializer.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.UnmanagedMemoryStream.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-8JNSQ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-RT9LP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\UIAutomationTypes.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-BV18A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-IKSD2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-L9IRH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\clrgc.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-C4VI1.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-IDQQK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-HT29O.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.ReaderWriter.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Numerics.Vectors.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-UCH6K.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0R6D5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Private.DataContractSerialization.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.InteropServices.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XPath.XDocument.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Claims.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NES76.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-D5RPK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Loader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ServiceModel.Web.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\UIAutomationClient.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-BSKQN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-EVMTH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-FUJRK.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-I9KME.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-IM89D.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-DN9A9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-8O1SP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0I40G.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-EL3N4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-9A0PH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Principal.Windows.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-QB0O9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.Core.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Tasks.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\mscordbi.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-54V5Q.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-QQMQ0.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-J5UVU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Formats.Tar.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.ThreadPool.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Aero2.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0R4RR.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Linq.Expressions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-IJCCG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-9K5SP.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-T2AEF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.EventLog.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.NonGeneric.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Configuration.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-C1QE8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OMLDU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-624HU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.CompilerServices.Unsafe.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-2VB07.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-N0JVU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-6UJNJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\hostfxr.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-LB3BN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Extensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.ZipFile.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Memory.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-07LBE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-J4F54.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Serialization.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-M1IBB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.MemoryMappedFiles.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.DriveInfo.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemDrawing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-2TVF9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.ProtectedData.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-5I1AN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OEM2B.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-MQN3F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\mscorrc.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.OpenSsl.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\ReachFramework.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.Requests.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Debug.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-HKSM3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-CG1VF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-H6DF9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-S9871.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Permissions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-SNOP4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Contracts.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ObjectModel.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.WebSockets.Client.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-160D2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0CFKI.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-0AA2H.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-6UT8P.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Xml.XDocument.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.Calendars.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-CDVC3.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Common.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-RUGAU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-80BQ8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-HQ8MG.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-457S0.tmp\_isetup\_setup64.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Net.ServicePoint.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-M0K5L.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-VC35U.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Accessibility.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.StackTrace.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Runtime.Handles.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Text.Encoding.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OLKB5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.EventBasedAsync.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-MQH5V.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-BGSNO.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-5R65M.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-RNA4A.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-6A3I2.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-OS7F4.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NMQLB.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-7IP4F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-C8Q0I.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Resources.Reader.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Process.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-9H3PC.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-HTHBE.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-R4HMS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-NA0P8.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-219L9.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-T8PJ7.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-HVE4F.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-CO8N6.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-M4HRH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Overlapped.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.Primitives.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.DataSetExtensions.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Linq.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-J1ACH.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\clretwrc.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-85E29.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Security.Cryptography.Algorithms.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-322AN.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Reflection.Emit.Lightweight.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.DataAnnotations.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-4RNUS.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.CSharp.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-16F0N.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-3U4SF.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.FileVersionInfo.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Threading.Tasks.Parallel.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\System.Windows.Forms.Design.dll (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-85LFJ.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-1274N.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\SteamClient\is-HF7IL.tmp Jump to dropped file
Queries disk information (often used to detect virtual machines)
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe File opened: PhysicalDrive0 Jump to behavior
Source: SteamSetup.tmp, 00000001.00000003.1890591391.0000000000911000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Process information queried: ProcessInformation Jump to behavior
Enables debug privileges
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Memory allocated: page read and write | page guard Jump to behavior
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: _hwndProgman
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: Progman
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: IsProgmanWindow
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1558928 Sample: SteamSetup.exe Startdate: 19/11/2024 Architecture: WINDOWS Score: 24 27 cmp2-iad1.steamserver.net 2->27 29 cmp2-dfw1.steamserver.net 2->29 31 6 other IPs or domains 2->31 39 Connects to many ports of the same IP (likely port scanning) 2->39 41 Yara detected Generic Downloader 2->41 8 SteamSetup.exe 2 2->8         started        signatures3 process4 file5 17 C:\Users\user\AppData\...\SteamSetup.tmp, PE32 8->17 dropped 11 SteamSetup.tmp 30 262 8->11         started        process6 file7 19 C:\Users\user\AppData\Local\...\is-H6DF9.tmp, PE32 11->19 dropped 21 C:\Users\user\AppData\Local\...\is-EL3N4.tmp, PE32 11->21 dropped 23 C:\Users\user\AppData\Local\...\is-0A2IM.tmp, PE32 11->23 dropped 25 488 other files (none is malicious) 11->25 dropped 14 Steam2.exe 2 11->14         started        process8 dnsIp9 33 cmp1-dfw1.steamserver.net 155.133.253.36, 443, 52573 VALVE-CORPORATIONUS Germany 14->33 35 cmp2-dfw1.steamserver.net 155.133.253.52, 443, 52576 VALVE-CORPORATIONUS Germany 14->35 37 5 other IPs or domains 14->37
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.254.199.165
 cmp1-atl3.steamserver.net United States
32590 VALVE-CORPORATIONUS false
155.133.253.52
 cmp2-dfw1.steamserver.net Germany
32590 VALVE-CORPORATIONUS false
162.254.199.184
 cmp2-atl3.steamserver.net United States
32590 VALVE-CORPORATIONUS false
104.102.49.254
 api.steampowered.com United States
16625 AKAMAI-ASUS false
155.133.253.36
 cmp1-dfw1.steamserver.net Germany
32590 VALVE-CORPORATIONUS false
162.254.192.98
 cmp1-iad1.steamserver.net United States
32590 VALVE-CORPORATIONUS false
162.254.192.99
 cmp2-iad1.steamserver.net United States
32590 VALVE-CORPORATIONUS false

Contacted Domains

Name IP Active
cmp1-atl3.steamserver.net 162.254.199.165 true
api.steampowered.com 104.102.49.254 true
cmp2-iad1.steamserver.net 162.254.192.99 true
cmp1-dfw1.steamserver.net 155.133.253.36 true
cmp2-atl3.steamserver.net 162.254.199.184 true
cmp2-dfw1.steamserver.net 155.133.253.52 true
cmp1-iad1.steamserver.net 162.254.192.98 true
198.187.3.20.in-addr.arpa unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://cmp1-iad1.steamserver.net/cmsocket/ false
    		high
    https://cmp2-dfw1.steamserver.net/cmsocket/ false
      		high
      https://cmp2-iad1.steamserver.net/cmsocket/ false
        		high
        https://cmp2-atl3.steamserver.net/cmsocket/ false
          		high
          https://api.steampowered.com/ISteamDirectory/GetCMListForConnect/v1/?format=vdf&cellid=0 false
            		high
            https://cmp1-dfw1.steamserver.net/cmsocket/ false
              		high