Edit tour

Windows Analysis Report
SteamSetup.exe

Overview

General Information

Sample name:	SteamSetup.exe
Analysis ID:	1558928
MD5:	1b34108b77b984e227bbad718d89594a
SHA1:	a75f5432e2ce39dc6c3f190d8d35ee2475a0ae6b
SHA256:	3f27a1a005beb7b1032bf9aef9fe5128ee1cccc332de862717b42d0b7f9c1f34
Tags:	exeuser-J_Jancelewicz
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Connects to many ports of the same IP (likely port scanning)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Process Tree

System is w10x64

SteamSetup.exe (PID: 7340 cmdline: "C:\Users\user\Desktop\SteamSetup.exe" MD5: 1B34108B77B984E227BBAD718D89594A)

SteamSetup.tmp (PID: 7360 cmdline: "C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp" /SL5="$10472,49358704,796160,C:\Users\user\Desktop\SteamSetup.exe" MD5: 5338593C8A3654FEF48E3EFD7FBBE890)

Steam2.exe (PID: 7640 cmdline: "C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe" MD5: 24579F75EE35BDD8E4CCC5351295BD9D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Programs\SteamClient\is-0A2IM.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Programs\SteamClient\is-H6DF9.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Programs\SteamClient\is-EL3N4.tmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: SteamSetup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{97C23183-77ED-457C-90C7-3FA73E699316}_is1

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:52303 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.254.199.184:443 -> 192.168.2.4:52571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.254.199.184:443 -> 192.168.2.4:52572 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 155.133.253.36:443 -> 192.168.2.4:52573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.254.192.98:443 -> 192.168.2.4:52574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.254.192.99:443 -> 192.168.2.4:52575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 155.133.253.52:443 -> 192.168.2.4:52576 version: TLS 1.2

Source: SteamSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/artifacts/obj/WindowsFormsIntegration/x64/Release/net8.0/WindowsFormsIntegration.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Resources.Reader/Release/net8.0-windows/System.Resources.Reader.pdbSHA256 source: is-JT9R1.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdb source: is-OL3NB.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb source: is-M7PK8.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.Json\Release\net8.0\System.Text.Json.pdb source: is-LFOPB.tmp.1.dr
Source:	Binary string: System.ComponentModel.ni.pdb source: is-RT9LP.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.IO.Compression.ZipFile\Release\net8.0-windows\System.IO.Compression.ZipFile.pdb source: is-G8384.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Metadata\Release\net8.0\System.Reflection.Metadata.pdb source: is-SELO9.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Emit.Lightweight\Release\net8.0\System.Reflection.Emit.Lightweight.pdb source: is-8Q6ES.tmp.1.dr
Source:	Binary string: PresentationFramework.Luna.ni.pdb source: is-0QI8B.tmp.1.dr
Source:	Binary string: System.Threading.AccessControl.ni.pdb source: is-6E0AB.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/UIAutomationClientSideProviders/x64/Release/net8.0/UIAutomationClientSideProviders.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdbSHA256 source: is-E704A.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XDocument\Release\net8.0\System.Xml.XDocument.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdbSHA256& source: is-J5Q53.tmp.1.dr
Source:	Binary string: System.Reflection.Metadata.ni.pdb source: is-SELO9.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Xml.Linq/Release/net8.0-windows/System.Xml.Linq.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Windows.Input.Manipulations/x64/Release/net8.0/System.Windows.Input.Manipulations.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdbSHA256> source: is-C8Q0I.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdb source: is-9VBVU.tmp.1.dr
Source:	Binary string: System.Windows.Input.Manipulations.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XDocument\Release\net8.0\System.Xml.XDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp, is-2TVF9.tmp.1.dr
Source:	Binary string: System.Xaml.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Web/Release/net8.0-windows/System.Web.pdb source: is-8SOAE.tmp.1.dr
Source:	Binary string: System.Text.Json.ni.pdb source: is-LFOPB.tmp.1.dr
Source:	Binary string: System.Linq.ni.pdb source: is-9VBVU.tmp.1.dr
Source:	Binary string: System.Formats.Tar.ni.pdb source: is-URA97.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/UIAutomationProvider/x64/Release/net8.0/UIAutomationProvider.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Threading.AccessControl/Release/net8.0-windows/System.Threading.AccessControl.pdb source: is-6E0AB.tmp.1.dr
Source:	Binary string: System.Xml.XPath.XDocument.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Xml/Release/net8.0-windows/System.Xml.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.ReaderWriter\Release\net8.0\System.Xml.ReaderWriter.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: WindowsBase.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\Microsoft.CSharp\Release\net8.0-windows\Microsoft.CSharp.pdb source: is-U5CAB.tmp.1.dr
Source:	Binary string: System.Windows.Presentation.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Text.RegularExpressions.ni.pdb source: is-SNOP4.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Resources.Reader/Release/net8.0-windows/System.Resources.Reader.pdb source: is-JT9R1.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Windows/Release/net8.0-windows/System.Windows.pdbSHA256 source: is-7D57R.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Requests\Release\net8.0-windows\System.Net.Requests.pdbSHA256@ source: is-IU0LQ.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Data/Release/net8.0-windows/System.Data.pdb source: is-C8Q0I.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.ReaderWriter\Release\net8.0\System.Xml.ReaderWriter.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.ComponentModel\Release\net8.0\System.ComponentModel.pdb source: is-RT9LP.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Memory\Release\net8.0\System.Memory.pdb source: is-219L9.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdbSHA256 source: is-5A8TQ.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Reflection.Emit.Lightweight\Release\net8.0\System.Reflection.Emit.Lightweight.pdbSHA256 source: is-8Q6ES.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net8.0/System.Configuration.ConfigurationManager.pdb source: is-EVMTH.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdb source: is-21558.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Data.DataSetExtensions/Release/net8.0-windows/System.Data.DataSetExtensions.pdb source: is-5A8TQ.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/WindowsBase/x64/Release/net8.0/WindowsBase.pdbRSDS#F source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: UIAutomationProvider.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Xml.Serialization/Release/net8.0-windows/System.Xml.Serialization.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.Requests\Release\net8.0-windows\System.Net.Requests.pdb source: is-IU0LQ.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime.InteropServices\Release\net8.0\System.Runtime.InteropServices.pdb source: is-3DQQ4.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdb source: is-G9TVR.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Windows/Release/net8.0-windows/System.Windows.pdb source: is-7D57R.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Xml/Release/net8.0-windows/System.Xml.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/PresentationFramework.Luna/x64/Release/net8.0/PresentationFramework.Luna.pdb source: is-0QI8B.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\debug\createdump\createdump.pdb===GCTL source: is-M7PK8.tmp.1.dr
Source:	Binary string: Microsoft.CSharp.ni.pdb source: is-U5CAB.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Windows.Presentation/x64/Release/net8.0/System.Windows.Presentation.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Net.WebProxy.ni.pdb source: is-3U4SF.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Globalization/Release/net8.0-windows/System.Globalization.pdb source: is-J5Q53.tmp.1.dr
Source:	Binary string: UIAutomationClient.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Formats.Tar\Release\net8.0-windows\System.Formats.Tar.pdb source: is-URA97.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/WindowsBase/x64/Release/net8.0/WindowsBase.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.IO.Compression.ZipFile.ni.pdb source: is-G8384.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Numerics/Release/net8.0-windows/System.Numerics.pdbSHA256s# source: is-G9TVR.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdb source: is-KSMQT.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Console\Release\net8.0-windows\System.Console.pdb source: is-QLJJ1.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Design.Facade/Release/net8.0/System.Design.pdb source: is-7IP4F.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Xml.Linq/Release/net8.0-windows/System.Xml.Linq.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XmlSerializer\Release\net8.0\System.Xml.XmlSerializer.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net8.0/System.Configuration.ConfigurationManager.pdbSHA256 source: is-EVMTH.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/WindowsFormsIntegration/x64/Release/net8.0/WindowsFormsIntegration.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: UIAutomationClientSideProviders.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\dlls\mscorrc\mscorrc.pdb source: is-G721R.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Xaml/x64/Release/net8.0/System.Xaml.pdbRSDS source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Memory.ni.pdb source: is-219L9.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdb source: is-N6T5R.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath.XDocument\Release\net8.0\System.Xml.XPath.XDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath\Release\net8.0\System.Xml.XPath.pdbSHA256] source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\bin\wpfgfx\x64\Release\wpfgfx_cor3.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Web/Release/net8.0-windows/System.Web.pdbSHA256 source: is-8SOAE.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebProxy\Release\net8.0\System.Net.WebProxy.pdb source: is-3U4SF.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Data.Common\Release\net8.0\System.Data.Common.pdb source: is-S7M74.tmp.1.dr
Source:	Binary string: System.Net.Requests.ni.pdb source: is-IU0LQ.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Xml.Serialization/Release/net8.0-windows/System.Xml.Serialization.pdbSHA256 source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Xaml/x64/Release/net8.0/System.Xaml.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Runtime.InteropServices.ni.pdb source: is-3DQQ4.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/UIAutomationTypes/x64/Release/net8.0/UIAutomationTypes.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\fxr\standalone\hostfxr.pdbxxxGCTL source: is-21558.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Xml.XmlDocument/Release/net8.0-windows/System.Xml.XmlDocument.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp, is-2TVF9.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Configuration/Release/net8.0-windows/System.Configuration.pdbSHA256l8 source: is-KSMQT.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.IO.Packaging/Release/net8.0/System.IO.Packaging.pdb source: is-O2VS5.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/UIAutomationClientSideProviders/x64/Release/net8.0/UIAutomationClientSideProviders.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Linq\Release\net8.0\System.Linq.pdbSHA256 source: is-9VBVU.tmp.1.dr
Source:	Binary string: UIAutomationTypes.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ConfigurationManager.ni.pdb source: is-EVMTH.tmp.1.dr
Source:	Binary string: System.Console.ni.pdb source: is-QLJJ1.tmp.1.dr
Source:	Binary string: System.Security.Cryptography.ProtectedData.ni.pdb source: is-OL3NB.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Xml.XPath\Release\net8.0\System.Xml.XPath.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/System.Core/Release/net8.0-windows/System.Core.pdbSHA2564- source: is-N6T5R.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Runtime\Release\net8.0\System.Runtime.pdb source: is-E704A.tmp.1.dr
Source:	Binary string: WindowsFormsIntegration.ni.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdbmmmGCTL source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: System.Data.Common.ni.pdb source: is-S7M74.tmp.1.dr
Source:	Binary string: /_/artifacts/obj/System.Windows.Presentation/x64/Release/net8.0/System.Windows.Presentation.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: /_/artifacts/obj/UIAutomationClient/x64/Release/net8.0/UIAutomationClient.pdb source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Text.RegularExpressions\Release\net8.0\System.Text.RegularExpressions.pdb source: is-SNOP4.tmp.1.dr
Source:	Binary string: System.IO.Packaging.ni.pdb source: is-O2VS5.tmp.1.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Net.WebProxy\Release\net8.0\System.Net.WebProxy.pdbSHA256 source: is-3U4SF.tmp.1.dr

Networking

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 162.254.199.165 ports 27018,0,1,2,7,8

Yara detected Generic Downloader

Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\SteamClient\is-0A2IM.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\SteamClient\is-H6DF9.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Programs\SteamClient\is-EL3N4.tmp, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:52304 -> 162.254.199.165:27018

Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-atl3.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: SX1pmJICoUOgvcAEWO04Yg==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp1-dfw1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 8pAM8HKoEEa2SDwRfJv7Yw==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp1-iad1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 4Mzn+oyKNEOPx/VMky/HWA==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-iad1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 9SfrCnjzD0+vkNHqMYQEtw==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-dfw1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: gct+FU7dl0WK9aM8K5/MdQ==Sec-WebSocket-Version: 13

Source: Joe Sandbox View

IP Address: 104.102.49.254 104.102.49.254

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ISteamDirectory/GetCMListForConnect/v1/?format=vdf&cellid=0 HTTP/1.1Host: api.steampowered.comUser-Agent: SteamKit/3.0.0
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-atl3.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: SX1pmJICoUOgvcAEWO04Yg==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp1-dfw1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 8pAM8HKoEEa2SDwRfJv7Yw==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp1-iad1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 4Mzn+oyKNEOPx/VMky/HWA==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-iad1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: 9SfrCnjzD0+vkNHqMYQEtw==Sec-WebSocket-Version: 13
Source: global traffic	HTTP traffic detected: GET /cmsocket/ HTTP/1.1Host: cmp2-dfw1.steamserver.netConnection: UpgradeUpgrade: websocketSec-WebSocket-Key: gct+FU7dl0WK9aM8K5/MdQ==Sec-WebSocket-Version: 13

Source: global traffic	DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: api.steampowered.com
Source: global traffic	DNS traffic detected: DNS query: cmp1-atl3.steamserver.net
Source: global traffic	DNS traffic detected: DNS query: cmp2-atl3.steamserver.net
Source: global traffic	DNS traffic detected: DNS query: cmp1-dfw1.steamserver.net
Source: global traffic	DNS traffic detected: DNS query: cmp1-iad1.steamserver.net
Source: global traffic	DNS traffic detected: DNS query: cmp2-iad1.steamserver.net
Source: global traffic	DNS traffic detected: DNS query: cmp2-dfw1.steamserver.net

Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://uri.etsi.org/01903/v1.2.2#SSOFTWARE
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://uri.etsi.org/01903/v1.2.2#SignedProperties
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://uri.etsi.org/01903/v1.2.2#bhttp://uri.etsi.org/01903/v1.2.2#SignedProperties
Source: is-EVMTH.tmp.1.dr, is-O2VS5.tmp.1.dr, is-SELO9.tmp.1.dr	String found in binary or memory: https://aka.ms/binaryformatter
Source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?Architecture:
Source: is-21558.tmp.1.dr	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=&os
Source: is-IU0LQ.tmp.1.dr	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp, is-21558.tmp.1.dr	String found in binary or memory: https://aka.ms/dotnet/app-launch-failed
Source: is-21558.tmp.1.dr	String found in binary or memory: https://aka.ms/dotnet/download
Source: is-21558.tmp.1.dr	String found in binary or memory: https://aka.ms/dotnet/downloadUsage:
Source: is-21558.tmp.1.dr	String found in binary or memory: https://aka.ms/dotnet/info
Source: is-21558.tmp.1.dr	String found in binary or memory: https://aka.ms/dotnet/sdk-not-foundFailed
Source: is-EVMTH.tmp.1.dr, is-O2VS5.tmp.1.dr, is-S7M74.tmp.1.dr, is-SELO9.tmp.1.dr	String found in binary or memory: https://aka.ms/serializationformat-binary-obsolete
Source: is-SNOP4.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/linker/issues/2715.
Source: is-5A8TQ.tmp.1.dr, is-9VBVU.tmp.1.dr, is-3U4SF.tmp.1.dr, is-N6T5R.tmp.1.dr, is-SNOP4.tmp.1.dr, is-3DQQ4.tmp.1.dr, is-EVMTH.tmp.1.dr, is-2TVF9.tmp.1.dr, is-KSMQT.tmp.1.dr, is-LFOPB.tmp.1.dr, is-8Q6ES.tmp.1.dr, is-J5Q53.tmp.1.dr, is-8SOAE.tmp.1.dr, is-O2VS5.tmp.1.dr, is-C8Q0I.tmp.1.dr, is-S7M74.tmp.1.dr, is-7D57R.tmp.1.dr, is-SELO9.tmp.1.dr, is-U5CAB.tmp.1.dr, is-IU0LQ.tmp.1.dr, is-URA97.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: is-JT9R1.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/runtime0
Source: is-KSMQT.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/runtime;
Source: is-8SOAE.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/runtimeH
Source: is-J5Q53.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/runtimer
Source: SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/runtimezX
Source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, is-7IP4F.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/winforms
Source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp, is-0QI8B.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/wpf
Source: SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp, is-0QI8B.tmp.1.dr	String found in binary or memory: https://github.com/dotnet/wpf4
Source: is-S7M74.tmp.1.dr	String found in binary or memory: https://github.com/mono/linker/issues/1187
Source: is-U5CAB.tmp.1.dr	String found in binary or memory: https://github.com/mono/linker/issues/1416.
Source: is-U5CAB.tmp.1.dr	String found in binary or memory: https://github.com/mono/linker/issues/1906.
Source: is-S7M74.tmp.1.dr	String found in binary or memory: https://github.com/mono/linker/issues/1981
Source: SteamSetup.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: SteamSetup.exe, 00000000.00000003.1688166005.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.exe, 00000000.00000003.1687407738.0000000002690000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000000.1689708207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-46PES.tmp.1.dr	String found in binary or memory: https://www.innosetup.com/
Source: SteamSetup.exe, 00000000.00000003.1688166005.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.exe, 00000000.00000003.1687407738.0000000002690000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000000.1689708207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-46PES.tmp.1.dr	String found in binary or memory: https://www.remobjects.com/ps
Source: SteamSetup.tmp, 00000001.00000003.1692507487.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1887946566.000000000250C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.steam.com/
Source: SteamSetup.exe, 00000000.00000003.1903609511.0000000002433000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.steam.com/Q6C
Source: SteamSetup.tmp, 00000001.00000003.1887946566.000000000250C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.steam.com/Q9Q

Source: unknown	Network traffic detected: HTTP traffic on port 52303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52576
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52571
Source: unknown	Network traffic detected: HTTP traffic on port 52574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52575 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52576 -> 443

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.4:52303 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.254.199.184:443 -> 192.168.2.4:52571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.254.199.184:443 -> 192.168.2.4:52572 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 155.133.253.36:443 -> 192.168.2.4:52573 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.254.192.98:443 -> 192.168.2.4:52574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.254.192.99:443 -> 192.168.2.4:52575 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 155.133.253.52:443 -> 192.168.2.4:52576 version: TLS 1.2

Source: SteamSetup.tmp.0.dr

Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: is-HTHBE.tmp.1.dr	Static PE information: No import functions for PE file found
Source: is-UCH6K.tmp.1.dr	Static PE information: No import functions for PE file found
Source: is-9VBVU.tmp.1.dr	Static PE information: No import functions for PE file found
Source: is-BV18A.tmp.1.dr	Static PE information: No import functions for PE file found
Source: is-O2VS5.tmp.1.dr	Static PE information: No import functions for PE file found
Source: is-V92IG.tmp.1.dr	Static PE information: No import functions for PE file found
Source: is-KPNTM.tmp.1.dr	Static PE information: No import functions for PE file found
Source: is-IOHDI.tmp.1.dr	Static PE information: No import functions for PE file found

Source: SteamSetup.exe, 00000000.00000003.1688166005.000000007FE36000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SteamSetup.exe
Source: SteamSetup.exe, 00000000.00000003.1903609511.00000000023F8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SteamSetup.exe
Source: SteamSetup.exe, 00000000.00000003.1687407738.000000000277A000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SteamSetup.exe
Source: SteamSetup.exe, 00000000.00000000.1685924822.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs SteamSetup.exe
Source: SteamSetup.exe	Binary or memory string: OriginalFileName vs SteamSetup.exe

Source: SteamSetup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-IOHDI.tmp.1.dr, PipeSecurity.cs	Security API names: System.IO.Pipes.PipeSecurity.GetAccessControlSectionsFromChanges()
Source: is-IOHDI.tmp.1.dr, PipeSecurity.cs	Security API names: ((CommonObjectSecurity)this).AddAccessRule
Source: is-IOHDI.tmp.1.dr, PipeSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.GetAccessRules(bool, bool, System.Type)
Source: is-IOHDI.tmp.1.dr, NamedPipeServerStream.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: is-IOHDI.tmp.1.dr, NamedPipeServerStream.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: is-IOHDI.tmp.1.dr, NamedPipeClientStream.cs	Security API names: System.IO.Pipes.PipeStream.GetAccessControl()
Source: is-IOHDI.tmp.1.dr, NamedPipeClientStream.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: is-UCH6K.tmp.1.dr, Helper.cs	Security API names: System.IO.FileSystemAclExtensions.SetAccessControl(System.IO.DirectoryInfo, System.Security.AccessControl.DirectorySecurity)
Source: is-UCH6K.tmp.1.dr, Helper.cs	Security API names: System.Security.AccessControl.FileSystemSecurity.AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)

Source: C:\Users\user\Desktop\SteamSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SteamSetup.exe "C:\Users\user\Desktop\SteamSetup.exe"
Source: C:\Users\user\Desktop\SteamSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp "C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp" /SL5="$10472,49358704,796160,C:\Users\user\Desktop\SteamSetup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process created: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe "C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe"
Source: C:\Users\user\Desktop\SteamSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp "C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp" /SL5="$10472,49358704,796160,C:\Users\user\Desktop\SteamSetup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process created: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe "C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SteamSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SteamSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: d3dcompiler_47_cor3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: wshunix.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Section loaded: gpapi.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Automated click: Next

Source: SteamSetup.exe	Static PE information: section name: .didata
Source: SteamSetup.tmp.0.dr	Static PE information: section name: .didata

Source: C:\Users\user\Desktop\SteamSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Window / User API: threadDelayed 392	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Window / User API: threadDelayed 924	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Window / User API: threadDelayed 457	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Window / User API: threadDelayed 6609	Jump to behavior

Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: _hwndProgman
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Progman
Source: SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: IsProgmanWindow

Source: C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 DLL Side-Loading	1 Timestomp	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	22 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner
C:\Users\user\AppData\Local\Programs\SteamClient\Accessibility.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\D3DCompiler_47_cor3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\DirectWriteForwarder.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.CSharp.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.DiaSymReader.Native.amd64.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.Core.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.Forms.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Primitives.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Registry.AccessControl.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Registry.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.SystemEvents.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PenImc_cor3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationCore.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemCore.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemData.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemDrawing.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemXml.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemXmlLinq.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Aero.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Aero2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.AeroLite.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Classic.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Luna.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Royale.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationNative_cor3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\PresentationUI.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\ReachFramework.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\Steam2.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\SteamKit2.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.AppContext.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Buffers.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.CodeDom.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Concurrent.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Immutable.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.NonGeneric.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.Specialized.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Collections.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.Annotations.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.DataAnnotations.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.EventBasedAsync.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.Primitives.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.TypeConverter.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.ComponentModel.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Configuration.ConfigurationManager.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Configuration.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Console.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Core.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.Common.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.DataSetExtensions.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Data.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Design.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Contracts.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Debug.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.DiagnosticSource.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.EventLog.Messages.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.EventLog.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.FileVersionInfo.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.PerformanceCounter.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Process.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.StackTrace.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.TextWriterTraceListener.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Tools.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.TraceSource.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Diagnostics.Tracing.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.DirectoryServices.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Common.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Design.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.Primitives.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Drawing.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Dynamic.Runtime.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Formats.Asn1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Formats.Tar.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.Calendars.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.Extensions.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.Globalization.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.Brotli.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.FileSystem.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.Native.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.ZipFile.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Compression.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.AccessControl.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.DriveInfo.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.Primitives.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.Watcher.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.FileSystem.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Hashing.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.IsolatedStorage.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.MemoryMappedFiles.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Packaging.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Programs\SteamClient\System.IO.Pipes.AccessControl.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
http://uri.etsi.org/01903/v1.2.2#SSOFTWARE	0%	Avira URL Cloud	safe
https://www.steam.com/Q6C	0%	Avira URL Cloud	safe
https://www.steam.com/Q9Q	0%	Avira URL Cloud	safe
http://uri.etsi.org/01903/v1.2.2#bhttp://uri.etsi.org/01903/v1.2.2#SignedProperties	0%	Avira URL Cloud	safe
https://www.steam.com/	0%	Avira URL Cloud	safe
http://uri.etsi.org/01903/v1.2.2#SignedProperties	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
cmp1-atl3.steamserver.net	162.254.199.165	true	false	high
api.steampowered.com	104.102.49.254	true	false	high
cmp2-iad1.steamserver.net	162.254.192.99	true	false	high
cmp1-dfw1.steamserver.net	155.133.253.36	true	false	high
cmp2-atl3.steamserver.net	162.254.199.184	true	false	high
cmp2-dfw1.steamserver.net	155.133.253.52	true	false	high
cmp1-iad1.steamserver.net	162.254.192.98	true	false	high
198.187.3.20.in-addr.arpa	unknown	unknown	false	high

Name	Malicious	Reputation
https://cmp1-iad1.steamserver.net/cmsocket/	false	high
https://cmp2-dfw1.steamserver.net/cmsocket/	false	high
https://cmp2-iad1.steamserver.net/cmsocket/	false	high
https://cmp2-atl3.steamserver.net/cmsocket/	false	high
https://api.steampowered.com/ISteamDirectory/GetCMListForConnect/v1/?format=vdf&cellid=0	false	high
https://cmp1-dfw1.steamserver.net/cmsocket/	false	high

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/dotnet/runtime;	is-KSMQT.tmp.1.dr	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	SteamSetup.exe	false		high
https://www.steam.com/Q6C	SteamSetup.exe, 00000000.00000003.1903609511.0000000002433000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/info	is-21558.tmp.1.dr	false		high
https://github.com/dotnet/wpf	SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp, is-0QI8B.tmp.1.dr	false		high
https://github.com/mono/linker/issues/1416.	is-U5CAB.tmp.1.dr	false		high
https://aka.ms/dotnet-core-applaunch?Architecture:	Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp	false		high
https://aka.ms/dotnet/app-launch-failed	Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp, is-21558.tmp.1.dr	false		high
http://uri.etsi.org/01903/v1.2.2#bhttp://uri.etsi.org/01903/v1.2.2#SignedProperties	SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet/sdk-not-foundFailed	is-21558.tmp.1.dr	false		high
https://aka.ms/dotnet-core-applaunch?	Steam2.exe, 00000003.00000000.1879341006.00007FF69F827000.00000002.00000001.01000000.00000009.sdmp	false		high
https://github.com/dotnet/runtime0	is-JT9R1.tmp.1.dr	false		high
https://aka.ms/dotnet/downloadUsage:	is-21558.tmp.1.dr	false		high
https://github.com/dotnet/runtime	is-5A8TQ.tmp.1.dr, is-9VBVU.tmp.1.dr, is-3U4SF.tmp.1.dr, is-N6T5R.tmp.1.dr, is-SNOP4.tmp.1.dr, is-3DQQ4.tmp.1.dr, is-EVMTH.tmp.1.dr, is-2TVF9.tmp.1.dr, is-KSMQT.tmp.1.dr, is-LFOPB.tmp.1.dr, is-8Q6ES.tmp.1.dr, is-J5Q53.tmp.1.dr, is-8SOAE.tmp.1.dr, is-O2VS5.tmp.1.dr, is-C8Q0I.tmp.1.dr, is-S7M74.tmp.1.dr, is-7D57R.tmp.1.dr, is-SELO9.tmp.1.dr, is-U5CAB.tmp.1.dr, is-IU0LQ.tmp.1.dr, is-URA97.tmp.1.dr	false		high
https://github.com/dotnet/runtimer	is-J5Q53.tmp.1.dr	false		high
http://uri.etsi.org/01903/v1.2.2#SignedProperties	SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dotnet/runtimezX	SteamSetup.tmp, 00000001.00000003.1880994045.000000000576D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/mono/linker/issues/1981	is-S7M74.tmp.1.dr	false		high
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=&os	is-21558.tmp.1.dr	false		high
http://uri.etsi.org/01903/v1.2.2#SSOFTWARE	SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-warnings/	is-IU0LQ.tmp.1.dr	false		high
https://github.com/dotnet/winforms	SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, is-7IP4F.tmp.1.dr	false		high
https://github.com/dotnet/wpf4	SteamSetup.tmp, 00000001.00000003.1880994045.0000000005B6D000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000055F0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.00000000057A6000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1880994045.0000000005620000.00000004.00001000.00020000.00000000.sdmp, is-0QI8B.tmp.1.dr	false		high
https://www.remobjects.com/ps	SteamSetup.exe, 00000000.00000003.1688166005.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.exe, 00000000.00000003.1687407738.0000000002690000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000000.1689708207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-46PES.tmp.1.dr	false		high
https://github.com/mono/linker/issues/1906.	is-U5CAB.tmp.1.dr	false		high
https://aka.ms/serializationformat-binary-obsolete	is-EVMTH.tmp.1.dr, is-O2VS5.tmp.1.dr, is-S7M74.tmp.1.dr, is-SELO9.tmp.1.dr	false		high
https://www.innosetup.com/	SteamSetup.exe, 00000000.00000003.1688166005.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.exe, 00000000.00000003.1687407738.0000000002690000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000000.1689708207.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-46PES.tmp.1.dr	false		high
https://aka.ms/binaryformatter	is-EVMTH.tmp.1.dr, is-O2VS5.tmp.1.dr, is-SELO9.tmp.1.dr	false		high
https://github.com/dotnet/linker/issues/2715.	is-SNOP4.tmp.1.dr	false		high
https://github.com/dotnet/runtimeH	is-8SOAE.tmp.1.dr	false		high
https://aka.ms/dotnet/download	is-21558.tmp.1.dr	false		high
https://github.com/mono/linker/issues/1187	is-S7M74.tmp.1.dr	false		high
https://www.steam.com/	SteamSetup.tmp, 00000001.00000003.1692507487.00000000035B0000.00000004.00001000.00020000.00000000.sdmp, SteamSetup.tmp, 00000001.00000003.1887946566.000000000250C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.steam.com/Q9Q	SteamSetup.tmp, 00000001.00000003.1887946566.000000000250C000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
162.254.199.165	cmp1-atl3.steamserver.net	United States	32590	VALVE-CORPORATIONUS	false
155.133.253.52	cmp2-dfw1.steamserver.net	Germany	32590	VALVE-CORPORATIONUS	false
162.254.199.184	cmp2-atl3.steamserver.net	United States	32590	VALVE-CORPORATIONUS	false
104.102.49.254	api.steampowered.com	United States	16625	AKAMAI-ASUS	false
155.133.253.36	cmp1-dfw1.steamserver.net	Germany	32590	VALVE-CORPORATIONUS	false
162.254.192.98	cmp1-iad1.steamserver.net	United States	32590	VALVE-CORPORATIONUS	false
162.254.192.99	cmp2-iad1.steamserver.net	United States	32590	VALVE-CORPORATIONUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1558928
Start date and time:	2024-11-19 23:59:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SteamSetup.exe
Detection:	SUS
Classification:	sus24.troj.winEXE@5/496@8/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.steampowered.com	https://steamcommunlty-gifts.com/s/HRAB	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://steamcommunity-success.com/gift-card/9376695162	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://steamcommunlty-gifts.com/s/HRAB	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://steamcommunlty-gifts.com/s/HRAB	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://sneamcomnnumnlty.com/h474823487284/geting/active	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://sneamcomnnumnlty.com/f78493482943/geting/game	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://sneamcomnnumnlty.com/hfjf748934924/geting/put	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://sneamcomnnumnlty.com/jfh8893040282949023/here/put	Get hash	malicious	Unknown	Browse	104.102.49.254
	https://steamcommunrutty.com/gift/actlvation=Mor85Fhn6w4	Get hash	malicious	Unknown	Browse	104.102.49.254
	http://sneamcomnnumnlty.com/fact/actual/get	Get hash	malicious	Unknown	Browse	92.122.104.90

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VALVE-CORPORATIONUS	IWnUKXop2x.elf	Get hash	malicious	Mirai, Okiru	Browse	103.28.54.20
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	162.254.195.132
	SecuriteInfo.com.Linux.Siggen.9999.16484.11734	Get hash	malicious	Unknown	Browse	155.133.238.98
	zZMmONZWnO.dll	Get hash	malicious	Wannacry	Browse	155.133.248.7
	SteamSetup.exe	Get hash	malicious	Unknown	Browse	205.196.6.229
	steam.exe	Get hash	malicious	Unknown	Browse	205.196.6.226
VALVE-CORPORATIONUS	IWnUKXop2x.elf	Get hash	malicious	Mirai, Okiru	Browse	103.28.54.20
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	162.254.195.132
	SecuriteInfo.com.Linux.Siggen.9999.16484.11734	Get hash	malicious	Unknown	Browse	155.133.238.98
	zZMmONZWnO.dll	Get hash	malicious	Wannacry	Browse	155.133.248.7
	SteamSetup.exe	Get hash	malicious	Unknown	Browse	205.196.6.229
	steam.exe	Get hash	malicious	Unknown	Browse	205.196.6.226
AKAMAI-ASUS	QuarantineMessage.zip	Get hash	malicious	Unknown	Browse	23.217.172.185
	Benefit Enrollment -wZ5nusm.pdf	Get hash	malicious	Unknown	Browse	23.203.104.175
	Customer forms.pdf	Get hash	malicious	Unknown	Browse	104.78.188.188
	Benefit Enrollment -eGz8VNb.pdf	Get hash	malicious	Unknown	Browse	23.203.104.175
	Integration.pdf www.skype.com.lnk	Get hash	malicious	Unknown	Browse	96.17.64.171
	b.pdf	Get hash	malicious	Unknown	Browse	23.217.172.185
	https://www.bing.com/ck/a?!&&p=5ceef533778c3decJmltdHM9MTcyMzQyMDgwMCZpZ3VpZD0zNjRmNjVlOC1lNTZjLTYxOWQtMTI1Ny03MTNlZTQyYTYwMTImaW5zaWQ9NTE0MA&ptn=3&ver=2&hsh=3&fclid=364f65e8-e56c-619d-1257-713ee42a6012&u=a1aHR0cHM6Ly9sZXhpbnZhcmlhbnQuY29tLw#aHR0cHM6Ly9HMTAuZHpwdndvYnIucnUvdkd5c2dQdC8=	Get hash	malicious	Unknown	Browse	92.122.18.57
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	23.200.88.15
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	2.18.121.138
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	23.195.93.152
VALVE-CORPORATIONUS	IWnUKXop2x.elf	Get hash	malicious	Mirai, Okiru	Browse	103.28.54.20
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	162.254.195.132
	SecuriteInfo.com.Linux.Siggen.9999.16484.11734	Get hash	malicious	Unknown	Browse	155.133.238.98
	zZMmONZWnO.dll	Get hash	malicious	Wannacry	Browse	155.133.248.7
	SteamSetup.exe	Get hash	malicious	Unknown	Browse	205.196.6.229
	steam.exe	Get hash	malicious	Unknown	Browse	205.196.6.226

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SteamSetup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Programs\SteamClient\Accessibility.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\D3DCompiler_47_cor3.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\DirectWriteForwarder.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.CSharp.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.DiaSymReader.Native.amd64.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.Core.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.Forms.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.VisualBasic.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Primitives.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Registry.AccessControl.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.Registry.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\Microsoft.Win32.SystemEvents.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PenImc_cor3.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationCore.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemCore.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemData.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemDrawing.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemXml.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework-SystemXmlLinq.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Aero.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.Aero2.dll (copy)

C:\Users\user\AppData\Local\Programs\SteamClient\PresentationFramework.AeroLite.dll (copy)

Windows Analysis Report
SteamSetup.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://s.id/sharedocument	Get hash	malicious	Unknown	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	https://trackru.top/us	Get hash	malicious	Unknown	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	https://www.google.ie/url?q=queryy8px(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$?	Get hash	malicious	HTMLPhisher	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	https://s.id/nelsi	Get hash	malicious	HTMLPhisher	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	https://www.google.ie/url?q=querymmjx(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2fsafrareal.com.br%2fyoya%2fgrcbea7q6lbvpmruhnx3bojhvb2k6ojxdnvuw/Y3doaXRlQHdvcmxkZHJ5ZXIuY29t$?	Get hash	malicious	Unknown	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	https://ledger-checks.s3.us-east-1.amazonaws.com/index.html	Get hash	malicious	Unknown	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	https://t.ly/9nPyg	Get hash	malicious	Unknown	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	Nota1893.exe	Get hash	malicious	Unknown	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	Requerimento.exe	Get hash	malicious	Unknown	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99
	Nota1893.exe	Get hash	malicious	Unknown	Browse	155.133.253.52 162.254.199.184 104.102.49.254 155.133.253.36 162.254.192.98 162.254.192.99

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Programs\SteamClient\D3DCompiler_47_cor3.dll (copy)	https://investors.spotify.com.sg.misteri.us.kg/	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.32268.950.exe	Get hash	malicious	Unknown	Browse
	https://wavebrowser.co/	Get hash	malicious	Unknown	Browse
	https://github.com/GPSBabel/gpsbabel/releases/download/Continuous-Windows/GPSBabel-20240815T1150Z-e9b2084-Setup.exe	Get hash	malicious	Unknown	Browse
	https://viture.com/windows	Get hash	malicious	Unknown	Browse
	https://www.plexim.com/sites/default/files/packages/plecs-standalone-4-8-4_win64.exe	Get hash	malicious	Unknown	Browse
	YoutubePlaylistDownloader.exe	Get hash	malicious	Unknown	Browse
	https://developers.yubico.com/yubikey-manager-qt/Releases/yubikey-manager-qt-1.2.6-win64.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Users\user\AppData\Local\Temp\is-CVTB5.tmp\SteamSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	21168
Entropy (8bit):	6.542009642868284
Encrypted:	false
SSDEEP:	384:KBmy0h6gSGR5OcHivWt/WbX6HRN7KtHNsAR9zF0H:bSyOcHLgWwts89zmH
MD5:	3A293D421E4A853F569C2E7B5BF27775
SHA1:	64BE26396D3569E2A32FFE25A3A5B3F30D8EB67C
SHA-256:	F59C6ACF3ABA059DAD7414BA0046E0EA0646FA54036827C2A611CE8843232463
SHA-512:	8D9636E69105DCF5B3A5A07191E7C993A5A49B64869A9D2E8801FA31ACC1778C53E850E1286B0CD45F1111D8CC54CC8409C4C493B0601C68B92C980661AF4C30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f...........!..... ...........?... ...@....... ..............................ld....@..................................>..O....@..................(...`....................................................... ............... ..H............text........ ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H........ ......................P ......................................H!j.......8M..{.c....BD.l.....EVt.RL..*.8.c...Q...w....2..E..W...U..c..m..d&GA.,..rND...I>.v.......Ea...r..2..]..&.Fk.!...sTBSJB............v4.0.30319......l...,...#~..........#Strings............#US. .......#GUID...0.......#Blob...........W.........%3........!...........7...................t...3..................................... ...............^.?...y.r...........?...............-.....D.....d.....

Process:	C:\Users\user\Desktop\SteamSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3132416
Entropy (8bit):	6.38838830778387
Encrypted:	false
SSDEEP:	49152:9WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbd333sr:ntLutqgwh4NYxtJpkxhGq333Q
MD5:	5338593C8A3654FEF48E3EFD7FBBE890
SHA1:	6B301281F7ED992E22FEDBF962314EDCEE4560CD
SHA-256:	A29E2A4B87D32A4949C359D321B3B3EBB9D471AE5380500A5725BCE414158760
SHA-512:	56CB89B9C51010C5EE73A4DA935FDBD75EE93AFACB5681CD9648F9523339D3D2E151DE35976974FDA58874A0C5247A3251A5BD8428FD2435B07BF8E45D4035E4
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c.................L,..\|......hf,......p,...@...........................0...........@......@....................-.......-..9...................................................................................-.......-......................text.... ,......",................. ..`.itext...(...@,.....&,............. ..`.data...X....p,......P,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-......-.............@..@.tls....L.....-..........................rdata..]............,-.............@..@.rsrc.................-.............@..@..............1.......0.............@..@........................................................

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63ECF218 [Wed Feb 15 14:54:16 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	e569e6f445d32ba23766ad67d1e3787f

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xfdc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x8110	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22f4	0x254	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb39e4	0xb3a00	43af0a9476ca224d8e8461f1e22c94da	False	0.34525867693110646	data	6.357635049994181	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	185e04b9a1f554e31f7f848515dc890c	False	0.54443359375	data	5.971425428435973	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	cab2107c933b696aa5cf0cc6c3fd3980	False	0.36097935267857145	data	5.048648594372454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xfdc	0x1000	e7d1635e2624b124cfdce6c360ac21cd	False	0.3798828125	data	5.029087481102678	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	8ced971d8a7705c98b173e255d8c9aa7	False	0.345703125	data	2.7509822285969876	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	8d4e1e508031afe235bf121c80fd7d5f	False	0.2578125	data	1.877162954504408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x8110	0x8200	525899abf62de326bf7945b6f12f7e0e	False	0.7301081730769231	data	7.001913398079108	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7438	0x4d2e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0008097985626077
RT_STRING	0xcc168	0x360	data			0.34375
RT_STRING	0xcc4c8	0x260	data			0.3256578947368421
RT_STRING	0xcc728	0x45c	data			0.4068100358422939
RT_STRING	0xccb84	0x40c	data			0.3754826254826255
RT_STRING	0xccf90	0x2d4	data			0.39226519337016574
RT_STRING	0xcd264	0xb8	data			0.6467391304347826
RT_STRING	0xcd31c	0x9c	data			0.6410256410256411
RT_STRING	0xcd3b8	0x374	data			0.4230769230769231
RT_STRING	0xcd72c	0x398	data			0.3358695652173913
RT_STRING	0xcdac4	0x368	data			0.3795871559633027
RT_STRING	0xcde2c	0x2a4	data			0.4275147928994083
RT_RCDATA	0xce0d0	0x10	data			1.5
RT_RCDATA	0xce0e0	0x2c4	data			0.6384180790960452
RT_RCDATA	0xce3a4	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0xce3d0	0x14	data	English	United States	1.2
RT_VERSION	0xce3e4	0x584	data	English	United States	0.2563739376770538
RT_MANIFEST	0xce968	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, RegQueryValueExW, AdjustTokenPrivileges, GetTokenInformation, ConvertSidToStringSidW, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4541a8
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c