Hijacked gaming accounts push a Steam gift-card QR phish, fake Steam apps and a MrBeast crypto-casino scam

Summary#

Hijacked Steam and Discord accounts are being used to send lure images to their contacts. This report follows one set of five such images, one sent over Steam and four over Discord, and everything they lead to.

The images contain no malware. Each one is a social-engineering lure, and they lead into two separate operations.

1. A Steam credential-phishing service (lane 1). The Steam image is a fake "$100 gift card" with a QR code. The QR code opens a look-alike of steamcommunity.com that shows a fake Steam sign-in box. The page is one tenant of a phishing-as-a-service platform: each page carries an affiliate ID, and at least two affiliates share the servers. The same platform runs malware: at least 16 Windows programs that pose as Steam (small WebView2 windows, and 61 MB installers that unpack an Electron app), all of which load their fake sign-in pages from the platform's own servers, and at least 18 droppers named after game cheats and injectors. Russian-language pages, hosting and a lure upload under a Russian file name point to a Russian-speaking operator.
2. A MrBeast crypto-casino deposit scam (lane 2). The four Discord images are a scripted story: a fake MrBeast post announces a casino bonus, a user activates the code, withdraws $3,700, and shows the money arriving in a wallet. The casino domain is one of at least 25 near-identical sites on one server, each lasting a few days. The images carry deliberately broken EXIF data so that every copy has a different file hash, which defeats hash-based spam filtering.

We found no technical link between the two lanes. They share only the hijacked accounts. That fits stolen sessions being sold or rented to more than one scammer.

Key findings#

• The fake Steam programs are credential-relay phishers, not infostealers. A full static re-analysis found that none of them read browser data, cookies, saved passwords or Steam files from the machine. Each shows a fake Steam sign-in window and relays what the victim types to the operator. The relay kit's own calls, recovered from one sample, send the username and password, then the Steam Guard code, then poll for the mobile approval, which is enough to take an account that has Steam Guard on.
• The Steam phish does not use a plain password form. It shows a fake Steam sign-in box inside the page, sets a signed cookie that names the affiliate who owns the link, and posts an encrypted record of the visit back to its server. Treat any password or Steam Guard code typed into it as captured.
• The phishing host 8909451279.f1shh[.]at serves a phishing page and is also the command server for three of the fake-Steam programs. Phishing and malware run on one platform, not merely on shared hosting.
• Five 61 MB installers unpack an Electron app whose package.json claims to be "steam-login-app" by "Valve Corporation", compiled to V8 bytecode (bytenode) in the October builds. It loads its fake Steam sign-in from njrlmwtgpk[.]shop, fakefake[.]shop and pulse-keys[.]store, which serve the same Russian-language kit as the QR-code phish, now behind Cloudflare.
• The fake-cheat route is real. 18 droppers named after cheat and injector products ("Phantom injector", "Medusa Lite", "Evicted Macros", "Fecurity", "Exlab" and others) call the same fakefake[.]shop server. They appeared in early August 2026, a month before the fake Steam apps.
• The casino lure images reuse a phrase from the casino site itself ("Your Withdrawal of $3700.00 Was Successfully!"), so the screenshots came from the real scam kit, not a mock-up.
• How the sending accounts are first compromised is not proven. The relay phish explains the Steam side directly: anyone who signs in to one of these fake windows hands over their login and Steam Guard code. The Discord side is separate. When both fall together, an infostealer taking both platforms' sessions at once is still the single best fit (medium confidence); password reuse, or two phishes, also fit.

The malware: fake Steam apps and game cheats#

The operator behind these lures runs malware as well as phishing pages. VirusTotal links 16 Windows programs to its servers, the same infrastructure that hosts the Steam phishing pages (Lane 1). We downloaded them and ran a representative of each family through CORD Research, a static analysis pipeline; nothing was executed. A second, deeper static pass then decoded the obfuscated scripts and read the bridge and hijacker code line by line. Where it changed CORD's first-pass findings, the section says so.

The key result: none of these programs is an infostealer. None reads browser data, cookies, saved passwords or Steam files from the machine. Each is a credential-relay phishing shell: a window that looks like Steam's sign-in, loads the operator's kit, and relays the username, password and Steam Guard code the victim types. They come in three forms, and they are spread through fake game cheats.

Each full report is CORD's complete analysis: every behaviour with its evidence, all decoded strings, the static process map, how the code connects, the decompiled C and annotated assembly of every function read, and the evidence index.

WebView2 fake Steam window (f27af032)#

Verdict: malicious · credential-relay shell · family not attributed. CORD's first pass classed it as a stealer and dropper; the deeper pass corrected both.

Ten builds named steam.exe or Steam.exe: 1 MB x64, mingw-linked, first submitted 2026-09-21 to 2026-10-17, flagged by 3 to 40 engines. All ten share the same five bundled files; two are one build with two padding bytes patched to change the hash.

Code reached is 692 of 2,508 functions from the entry; most of the rest is the statically linked WebView2 and C runtime.

How it runs#

What it does#

How the code connects#

The UI-thread handler (0x140005a90) receives {id, method, params} messages from the page, parses them (0x1400075c0), dispatches, and answers {id, ok, result|error} (0x140002900). The eight methods are win.min, win.drag, win.resize and win.close; fs.readText (0x1400033d0) and fs.writeText (0x1400038b0), both confined to the program's own folder; http.request (0x140004000, WinInet); and shell.open (0x140003c10, http(s) only). The navigation to /client is a plain Navigate with no parameters.

The function CORD's first pass called a "system fingerprint" (0x1400094c0) has no callers. It is junk padding whose size changes with every build, there to vary the hash.

What it talks to and touches#

• hxxps://8909451279.f1shh[.]at/client in this build; six different numbered f1shh[.]at subdomains across the ten builds.
• Writes WebView2Loader.dll beside itself and a copy of itself under C:\Windows\.

Notable strings#

window.steamm, __steammHooked, SteamWindow, Steam/1.0, WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS, --disable-client-side-phishing-detection, only http(s) allowed, unknown method:.

Verdict and detection opportunities#

YARA rules steamlure_wv2_bridge_app (bridge and browser-argument strings) and steamlure_wv2_c2_url (the embedded f1shh /client URL); see Detection. Of CORD's anchors, the entry stub (A1) and the WinInet client (A3) hold. Do not use anchor A4: it rests on the junk function.

Open questions#

The kit page's JavaScript is served at run time, so what it does inside this window is known from the copy embedded in the hijacker below, not from this sample.

Read the full CORD report for f27af032 →

NSIS installer and Electron app (c8628650)#

Verdict: malicious · credential-relay shell (the Electron payload) · family not attributed. CORD's first pass classed the payload as a stealer with browser-storage access and Node integration on; the deeper pass corrected both.

Five builds, about 61 MB each, flagged by 0 to 2 engines.

Code reached is 81 of 104 functions of the NSIS stub; the payload logic lives in the unpacked layers.

How it runs#

Layers#

What it does#

Decoded strings#

The September builds' main.js was decoded in full by reimplementing the obfuscator's string table and rotation in Python (the rotation checksum matched, which validates the decode); it was never run.

• TARGET_URLS: hxxps://njrlmwtgpk[.]shop/2123223, hxxps://fakefake[.]shop/3253523, hxxps://pulse-keys[.]store/6887.
• ANTI_DELETE = true but never read. PROCESS_PROTECTION = false; when on it only renames the process to svchost.exe. WATCHER_SCRIPT = ''. A --watcher <file> mode runs a script with ELECTRON_RUN_AS_NODE. There is no persistence or self-protection.
• The injected script carries Steam's Russian-language UI strings, so the operator's relay browser runs in Russian.

The October main.jsc files are the same program: the same three hosts, the same functions and byte-identical injected CSS and script. The engine is Electron 25.9.8 with V8 11.4.183.29; "Chrome 122" is only the spoofed user agent.

We disassembled the October bytecode of c8628650 statically (V8 11.4 Ignition, read as data, never run) and it confirms the decoded September logic instruction by instruction. The obfuscator writes false as ![], which compiles to CreateEmptyArrayLiteral followed by one ToBooleanLogicalNot:

• In createWindow, contextIsolation and nodeIntegration are both set that way: false. So are frame, resizable, fullscreenable and show.
• At top level, ANTI_DELETE is !![] (true) and is never read. PROCESS_PROTECTION is ![] (false), and a conditional jump on it skips the process.title = "svchost.exe" assignment, so that rename is dead code. WATCHER_SCRIPT is an empty string.
• The only live extra is the --watcher <file> branch: if the file exists, it sets ELECTRON_RUN_AS_NODE=1, loads the file and quits. Otherwise the program goes straight to the fake Steam window.
• In the TARGET_URLS array, fakefake[.]shop and pulse-keys[.]store are stored in plain form, and the first slot, njrlmwtgpk[.]shop, is filled from the encoded string table at run time.

What it talks to and touches#

The three hosts above; fakefake[.]shop and pulse-keys[.]store serve the platform's Russian-language Steam page, built for an Electron window (a CSS comment reads "ФОН КАК В ELECTRON", "background as in Electron").

Verdict and detection opportunities#

YARA rules steamlure_electron_package_json, steamlure_electron_mainjs_obfuscated, steamlure_electron_mainjsc_bytecode and steamlure_electron_nsis_installer; see Detection. CORD's strongest anchors are the NSIS, 7-zip, asar and bytenode nesting (A5) and the forged package.json (A6).

Open questions#

The October control flow is now closed for c8628650 (above). The two other October builds (64465b46, 6b3bb3be) were compared at string and structure level, not disassembled; they share the same version hash, functions and object layout.

Read the full CORD report for c8628650 →

Steam client hijacker (3d2b12f8)#

Verdict: malicious · persistent Steam client hijacker that serves the relay kit · family not attributed. CORD's pass classed it as a loader (confidence 0.4) and could not decode its URL or resources; the deeper pass recovered both.

One sample, 849 KB x64, Visual Studio 2019, flagged by 3 engines.

Code reached is 357 of 632 functions from the entry.

How it runs#

What it does#

How the code connects#

WinMain resolves CopyFileW and MoveFileW and calls the installer (0x140007950), which checks elevation, stops the service and closes Steam, then replaces the executable (0x140007680). Persistence is written at 0x140006d70, with the Steam path read at 0x140006170 and 0x140005f00. The shortcut hijacker (0x140007270, with an extension normaliser at 0x140007150) rewrites each matching .lnk. The lure window's WndProc (0x140005ae0) sets a timer whose handler calls the downloader (0x140005750).

Decoded strings#

• The download URL, XOR-encoded with 0x5a: hxxps://koooolda[.]shop/43413. The host resolves to 62[.]60[.]226[.]75, the FEMO IT server that hosts the phishing kit.
• Resource 103 is the relay kit's client script in plain form. Each action is a POST to a path built from DyNaM1c plus the action name, XOR-encrypted with the secret from the affiliate cookie. The actions are visit, doLogin (username and password), submitCode (Steam Guard) and checkConfirmations (mobile approval).

That is the operation in four calls: a Steam login, the second factor and the mobile confirmation, relayed in real time, which is enough to take an account protected by Steam Guard.

What it talks to and touches#

koooolda[.]shop; steam.exe and steam.orig.exe or steam.live.exe; the steam:// handler, Steam App Paths and Valve registry keys; Steam shortcuts on the desktop, in the Start menu and in AppData.

Verdict and detection opportunities#

YARA rule steamlure_wv2_steamui_hijacker. On a host, look for steam.orig.exe or steam.live.exe and a steam:// handler that points outside the Steam install.

Open questions#

Two of CORD's questions remain open: some of the ten RCDATA resources (IDs 103 to 113, about 650 KB) beyond the kit script, and the remaining XOR-decoded names.

Read the full CORD report for 3d2b12f8 →

Fake game cheats: how victims get infected#

VirusTotal shows 18 more programs calling fakefake[.]shop. They are named after game cheats, injectors and macro tools, and every one that has a label is flagged as a UAC bypass dropper (trojan.bypassuac, 7 to 32 engines):

Arcane, Covchec, Division, Evicted Macros, Exlab, Extreme, Fecurity, Hyper, Mason, Medusa Lite, Mira, Permanent, Phantom injector, SMG Software, Unicore, Visor

They first appeared between 2026-08-02 and 2026-08-14, a month before the earliest fake Steam installer. Several ran from a temporary unpack folder, the pattern of a self-extracting "cheat" download.

This fills the gap in the delivery story. A gamer looking for a cheat downloads a fake one, it raises its own privileges, and the machine is then open to the platform's fake Steam windows. The cheatdetector[.]shop domain, the Counter-Strike and Rust themed domains on the same servers, programs named SteamClient.exe, and one sample's build path 12rwqr-main/DWASDAS/SteamClient.exe (which looks like the author's own project folder) all fit the same picture. We have not tied a specific cheat download to a specific hijacked account.

How the lures reached people#

Both hijacked accounts sent the images to existing contacts, which is what makes the lures work: they arrive from a friend. Neither message contained a clickable link. The Steam lure hides its URL in a QR code, and the Discord lure spells the casino name out inside a screenshot. Link scanners on both platforms check text, not pixels, so neither lure gives them anything to block.

Lane 1: the Steam phishing service#

The lure#

The gift-card image shows real game art (Elden Ring, Baldur's Gate 3, Cyberpunk 2077, Starfield, Minecraft) around a Steam logo, with "TAKE YOUR FREE $100 GIFT CARD" above a QR code. The code decodes to hxxps://steamcomrnuunity[.]com/code/2035922. The domain swaps the m in "community" for rn, which reads as m at a glance, and doubles the u. The /code/<number> path imitates a gift-card redemption link.

The image was hosted on Steam's own user-content CDN at one point (one of its VirusTotal submission names is images.steamusercontent.jpg). Another submission used a Russian file name meaning "Untitled.jpg". It was first submitted on 2026-10-11, one day after the phishing URL's first public scan.

The landing page and sign-in box#

The domain's root returns a 404 page. Only the /code/<id> paths show the lure, which keeps the site looking empty to anyone who browses to the bare domain. Four codes were observed: 2035922, 647829, 876809 and 3454765444. One shows a $50 card and the others a $100 card. VirusTotal lists at least ten flagged paths on the domain, including /code/, /activate/ and long hex paths that change per visitor.

The page shows a Steam-styled landing screen with a fake counter of cards "received". Its "Get the card" button calls an openAuth() function in the page script. That function builds an iframe holding a Steam-styled sign-in dialog (password, Steam Guard code or QR sign-in) inside the phishing page. The server sends X-Frame-Options: ALLOWALL and frame-ancestors *, so the kit can also be framed by other sites.

We read the page script but did not run it, and we never submitted anything to the form. So we cannot say whether the dialog relays a live Steam sign-in or only records what is typed. Either way, treat any password, Steam Guard code or QR approval given to this page as stolen.

Inside the kit#

The affiliate cookie is the clearest sign that this is a service rather than one person's phishing site. Each link carries the ID of the affiliate who will be credited with the stolen account, and two different IDs appear on the same servers.

Infrastructure#

VirusTotal's passive DNS shows how large this is: 209 domains have resolved to 62[.]60[.]226[.]75 and 400 to 192[.]162[.]199[.]140, including at least 108 numbered f1shh[.]at subdomains. Most are Steam and game lures. Some subdomain names on steamcommunlty[.]site are those of other brands' sign-in pages (11st, gmarket, 12306, 1688, 126, entra, caslogin, auth-sso), which suggests the platform can phish for more than Steam (medium confidence; we did not see those pages).

The newer parts of the operation (fakefake[.]shop, pulse-keys[.]store, dojiner[.]at) sit behind Cloudflare, while the older lure servers stay exposed on FEMO IT. That looks like the operator learning to hide its origin servers.

AS214351 has been described as bulletproof hosting by Silent Push, Recorded Future and Infoblox. VirusTotal also showed steamcomrnuunity[.]com briefly pointing at 185[.]53[.]179[.]136 on 2026-10-15. That address belongs to a domain-parking service (Team Internet, AS206834), not to the operator, so we do not list it as an indicator.

Lane 2: the MrBeast crypto-casino scam#

The four-image story#

The pattern is a deposit scam. The bonus can only be "withdrawn" after a deposit or a "verification" payment, and that money is gone. The withdrawal and the wallet receipt were staged to make the payout look real.

Hash-busting images#

All four Discord images carry the same deliberately broken EXIF block: a 94-byte APP1 segment whose six fields point outside their own data. Orientation has a count of 2 and XResolution a count of 8. The comment field varies per image ("Exported from Photos", "Processed by MediaService", "Compressed by imaging-sdk", "Quality: standard"). None of this changes the picture, but every copy gets a different file hash. None of the four hashes we received has ever been seen on VirusTotal. That shows how well it works against "block this known image" filters.

The casino farm#

The casino in the images, marewin[.]com, was registered at Dynadot on 2026-10-23 and put on clientHold about three days later. It sat on 172[.]86[.]88[.]161 (RouterHosting / Cloudzy, AS14956) beside at least 24 sister sites built from the same template, titled "{Name}: Crypto Casino & Provably Fair Games":

amkwin, basoowin, fabawin, hudowin, jolyspin, kegwin, kevowin, kigwin, mavubet, mazowin, meviwin, mosubet, padowin, pevowin, ruzowin, tasowin, uvowin, vadowin, vazowin, xakawin, zenawin, ziewin, zuzawin, zytwin (all .com)

Archived copies show a self-contained Next.js app with no analytics, no third-party scripts and no wallet addresses in the page. It accepts USDT, USDC and BNB. When we checked, HTTPS no longer worked on any of the sites, and plain HTTP to the server answered 503. The farm moves on to new names faster than registrars suspend them.

The setup resembles kits sold as a service for this kind of scam. We looked for one published kit's tell-tale API path (/api/mammoth/chat) and did not find it, so we do not name a kit.

Who is behind it#

We keep attribution at the group level and do not name individuals.

Timeline#

MITRE ATT&CK#

Detection#

Network#

Block the domains and IPs in the indicator list. For broader coverage, block or alert on new lookalikes of steamcommunity.com and steampowered.com, and on any HTTPS to AS214351.

Host#

Look for:

• Any steam.exe or Steam.exe outside C:\Program Files (x86)\Steam\, especially under C:\Windows\ with a random 5 to 9 character name.
• Unsigned programs that host an Edge WebView2 window, import WinInet and carry WebView2Loader.dll as resource RCDATA 300.
• Recently downloaded game "cheats", injectors or macro tools, especially any of the names in Fake game cheats, and anything that ran from a %TEMP% unpack folder and triggered a UAC bypass.
• An Electron app whose resources\app.asar contains package.json with "name": "steam-login-app", or a main.js that only requires bytenode and a main.jsc.
• NSIS installers around 61 MB with Valve version info that are not signed by Valve.
• A steam.exe renamed to steam.orig.exe or steam.live.exe, or the steam:// handler, Steam App Paths or Valve registry keys pointing somewhere other than the real Steam install, which is the hijacker's work.
• Traffic to any numbered subdomain of f1shh[.]at, or to koooolda[.]shop.

YARA#

Seven rules cover both families and the extracted Electron package:

• steamlure_webview2.yar — the WebView2 relay shells, a campaign rule for the embedded f1shh[.]at /client URL, and the persistent Steam client hijacker.
• steamlure_electron.yar — the steam-login-app package.json, the September obfuscated main.js, the October main.jsc bytecode, and the unsigned NSIS installer shell.
• All seven in one file: steamlure-all.yar.

In testing, each of the 16 programs was matched by its own family's rule, with no cross-family hits, and 14 of the 16 extracted package files matched (the two misses are the generic 44-byte bytenode loader, which has nothing distinctive to match). There were no hits on the clean-software set tested.

That clean-software set is a weak false-positive test: it is Windows system DLLs and .NET Framework files, with no Electron apps, NSIS installers or third-party WebView2 apps. Before you alert on these rules, test them against real Electron and WebView2 software (Discord, Slack, VS Code, Teams) and real NSIS installers. The campaign URL rule and the installer version-string rule will stop matching when the operator changes its domains or build string.

Recovery and cleanup#

This section is for anyone whose account sent these lures, and for anyone who scanned the QR code, signed in on the fake page, or ran one of the programs. If your account sent these lures, treat both Steam and Discord as compromised, and do all of it.

Right now#

1. Take the affected PC off the network (unplug it or turn off Wi-Fi).
2. From another device, warn your contacts on Steam and Discord: your account was hijacked, recent images and links from you are scams, and anyone who scanned the QR code or signed in should follow this guide.

Secure your email first#

Email resets every other account.

1. Sign out of all other sessions.
2. Change the password to a new one you have never used. A password manager makes this easy.
3. Turn on two-factor sign-in with an authenticator app or a passkey.
4. Check the recovery phone number and recovery email.
5. Remove any forwarding rules or filters you did not create.

Steam#

1. Change the password at store.steampowered.com (Account details).
2. Go to store.steampowered.com/twofactor/manage and choose Deauthorize all other devices. This ends the attacker's session.
3. Make sure the Steam Guard Mobile Authenticator is on. Re-link it if anything about it changed.
4. Check the Web API key page at steamcommunity.com/dev/apikey. If a key exists that you did not create, revoke it. Hijackers register keys to watch and redirect your trade offers, and the key survives a password change.
5. Check that the email and phone on the account are still yours.
6. Review purchase history, trade history, Community Market listings and inventory. Note anything you did not do.
7. Check your Steam Family settings and the device list on the Steam Guard page for anything you did not add.
8. Expect a 15-day trade and market hold after these changes. It protects you.
9. Open a ticket at help.steampowered.com ("My account was stolen") with dates and what was taken.

Discord#

1. Change the password (User Settings → My Account). This also ends existing sessions and invalidates stolen tokens.
2. User Settings → Devices → Log out all known devices.
3. Turn two-factor on, or reset it to a fresh authenticator setup. Store the new backup codes off the PC.
4. User Settings → Authorized Apps: remove anything you do not recognise.
5. Check your email, phone, username, connections and payment methods, and any servers you own (bots added, roles changed, webhooks created).
6. Delete the scam messages from your DMs where you can, and report the account takeover at support.discord.com.

Clean the PC#

A full reinstall of Windows is the only way to be sure. These programs give a remote page read and write access to files, so a scan cannot prove they left nothing behind.

1. Back up documents and photos only, not programs, shortcuts or .exe files.
2. Make Windows install media from a clean computer with Microsoft's Media Creation Tool.
3. Reinstall and format the drive. Reinstall programs from official sources only.

If you cannot reinstall straight away:

1. Boot into Safe Mode with Networking.
2. Run full scans with Malwarebytes and the ESET Online Scanner, or a similar pair.
3. Look for the files in Host detection: stray steam.exe copies in C:\Windows\, unexpected WebView2 or Electron apps that pose as Steam, and recently installed apps you do not remember in Settings → Apps.
4. Check Startup apps, Task Scheduler and HKCU\Software\Microsoft\Windows\CurrentVersion\Run for entries you do not recognise.
5. Plan the reinstall anyway.

Do not sign in to anything on the PC until it is clean.

Everything the browser remembered#

Assume every saved password, cookie and autofill entry on that PC was taken.

1. Change passwords from a clean device, in this order: email, banking and payment apps, crypto exchanges, other gaming accounts (Epic, Battle.net, Riot, EA, Ubisoft), social media, shopping, then the rest.
2. Use "sign out everywhere" where a site offers it, because stolen cookies keep working until the session ends. Google, Microsoft, Apple and most banks have this option.
3. Turn on two-factor sign-in everywhere you can.
4. If you reused a password anywhere, change it there too.

Crypto wallets#

If the PC had wallet extensions (MetaMask, Phantom, Coinbase Wallet) or seed phrases stored on it:

1. On a clean device, create a new wallet with a new seed phrase.
2. Move all funds to it straight away.
3. Abandon the old wallet for good, and never import its seed phrase again.

If you sent money to the casino#

The money is almost certainly gone. Report it to your local police and to reportfraud.ftc.gov (US) or Action Fraud (UK), with the transaction hashes. Ignore anyone who offers to recover it for a fee. That is a second scam aimed at the same victims.

Checklist#

• PC offline
• Contacts warned
• Email: password, sessions, two-factor, recovery details, forwarding rules
• Steam: password, deauthorize devices, Steam Guard, API key revoked, trades reviewed, ticket opened
• Discord: password, devices logged out, two-factor, authorized apps cleared, ticket opened
• PC reinstalled (or scanned now and reinstall planned)
• Saved passwords changed, starting with money and email
• Crypto moved to a new wallet

Indicators#

All values are defanged. The full lists, with roles, first and last seen dates and sources, are in iocs.csv and iocs.json.

Phishing and C2 domains#

URLs#

IP addresses#

Malware (SHA-256)#

Fake game-cheat droppers (SHA-256)#

These call fakefake[.]shop. Profiled from VirusTotal; not analysed by CORD.

Lure images (SHA-256)#

The Discord images change hash with every copy, so these four hashes identify only our copies.

Other#