3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

Resubmissions

28/02/2024, 15:35

240228-s1gq6afa44 6

09/02/2024, 13:21

240209-qlxsqadb56 6

Analysis

max time kernel
1593s
max time network
1579s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
28/02/2024, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SteamSetup.exe
Size

2.2MB
MD5

70f3bc193dfa56b78f3e6e4f800f701f
SHA1

1e5598f2de49fed2e81f3dd8630c7346a2b89487
SHA256

3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1
SHA512

3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1
SSDEEP

49152:2DcHcEngZtNm1LQRHH4PTwZX6kg9hsf4lcszpyu7d/TC:rngZtNm1G4Pw6dJzZNTC

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0090.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_060_vehicle_0110.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\controller_config_controller_ps5.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_koreana.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\platform_czech.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_rtrackpad_down_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_rt_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_touchpad_swipe.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_hungarian.txt.gz_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\vstdlib_s64.dll_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\bump_paper_n.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\platform_dutch.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_dpad_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_button_capture_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_l_click_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_rb_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_outlined_button_x_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\FriendsPanelLeftBG_Over.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_dropdown.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamui_latam.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\steamui_postlogon_greek.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_l2_soft.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_ltrackpad_up.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_click_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_lt_click.svg_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\cef_log.txt	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0120.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steambootstrapper_korean.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_lb_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_buttons_s.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\templates\controller_ps5_gamepad_mouse_gyro.vdf_	steam.exe
File created	C:\Program Files (x86)\Steam\dumps\settings.dat	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0402.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0460.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\icon_cloud_outofsync.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_rtrackpad_left_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\layout\cloud_pending_sessions_dialog.layout_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0120.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0090.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_040_act_0315.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_trackpad_r_right_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\switchpro_dpad_left_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\filter_profanity_koreana.txt.gz_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0519.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_080_input_0130.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0527.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\simBottom.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\icon_steam.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_rt_soft_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_ltrackpad_left_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\gameproperties_betas.res_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0344.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_security_good.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_100_target_0150.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0401.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_color_button_square_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_rfn_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_mouse_r_click_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_button_options_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\libavcodec-58.dll_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\btnSelBottom.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_trackpad_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_buttons_w_lg.png_	steam.exe

Executes dropped EXE 15 IoCs

pid	Process
4740	steamservice.exe
4640	steam.exe
5376	steam.exe
5364	steamwebhelper.exe
5684	steamwebhelper.exe
2020	steamwebhelper.exe
5844	steamwebhelper.exe
5960	gldriverquery64.exe
6328	gldriverquery.exe
7256	steamwebhelper.exe
6012	steamwebhelper.exe
5948	vulkandriverquery64.exe
4976	vulkandriverquery.exe
6680	steamwebhelper.exe
7756	steamwebhelper.exe

Loads dropped DLL 57 IoCs

pid	Process
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5684	steamwebhelper.exe
5684	steamwebhelper.exe
5684	steamwebhelper.exe
5376	steam.exe
5376	steam.exe
2020	steamwebhelper.exe
2020	steamwebhelper.exe
2020	steamwebhelper.exe
2020	steamwebhelper.exe
2020	steamwebhelper.exe
2020	steamwebhelper.exe
2020	steamwebhelper.exe
5844	steamwebhelper.exe
5844	steamwebhelper.exe
5844	steamwebhelper.exe
5376	steam.exe
7256	steamwebhelper.exe
7256	steamwebhelper.exe
7256	steamwebhelper.exe
6012	steamwebhelper.exe
6012	steamwebhelper.exe
6012	steamwebhelper.exe
6012	steamwebhelper.exe
6680	steamwebhelper.exe
6680	steamwebhelper.exe
6680	steamwebhelper.exe
6680	steamwebhelper.exe
7756	steamwebhelper.exe
7756	steamwebhelper.exe
7756	steamwebhelper.exe
7756	steamwebhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\steam\Shell\Open	steamservice.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
2768	SteamSetup.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe
5376	steam.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5376	steam.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4740	steamservice.exe
Token: SeSecurityPrivilege	4740	steamservice.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe
Token: SeShutdownPrivilege	5364	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	5364	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe
5364	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5376	steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 4740	2768	SteamSetup.exe	73
PID 2768 wrote to memory of 4740	2768	SteamSetup.exe	73
PID 2768 wrote to memory of 4740	2768	SteamSetup.exe	73
PID 4640 wrote to memory of 5376	4640	steam.exe	78
PID 4640 wrote to memory of 5376	4640	steam.exe	78
PID 4640 wrote to memory of 5376	4640	steam.exe	78
PID 5376 wrote to memory of 5364	5376	steam.exe	79
PID 5376 wrote to memory of 5364	5376	steam.exe	79
PID 5364 wrote to memory of 5684	5364	steamwebhelper.exe	80
PID 5364 wrote to memory of 5684	5364	steamwebhelper.exe	80
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 2020	5364	steamwebhelper.exe	81
PID 5364 wrote to memory of 5844	5364	steamwebhelper.exe	82
PID 5364 wrote to memory of 5844	5364	steamwebhelper.exe	82
PID 5376 wrote to memory of 5960	5376	steam.exe	85
PID 5376 wrote to memory of 5960	5376	steam.exe	85
PID 5376 wrote to memory of 6328	5376	steam.exe	86
PID 5376 wrote to memory of 6328	5376	steam.exe	86
PID 5376 wrote to memory of 6328	5376	steam.exe	86
PID 5364 wrote to memory of 7256	5364	steamwebhelper.exe	87
PID 5364 wrote to memory of 7256	5364	steamwebhelper.exe	87
PID 5364 wrote to memory of 7256	5364	steamwebhelper.exe	87
PID 5364 wrote to memory of 7256	5364	steamwebhelper.exe	87
PID 5364 wrote to memory of 7256	5364	steamwebhelper.exe	87
PID 5364 wrote to memory of 7256	5364	steamwebhelper.exe	87

C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Steam\bin\steamservice.exe
  "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4740

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=5376" "-buildid=1708985249" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--disable-features=DcheckIsFatal"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1708985249 --initial-client-data=0x30c,0x310,0x314,0x2e8,0x318,0x7ffbf18aee28,0x7ffbf18aee38,0x7ffbf18aee48
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      PID:5684
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1708985249 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1504 --field-trial-handle=1572,i,17499456421520487674,10045132064066568898,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      Drops file in Program Files directory
      Executes dropped EXE
      Loads dropped DLL
      PID:2020
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1708985249 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1980 --field-trial-handle=1572,i,17499456421520487674,10045132064066568898,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5844
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1708985249 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2292 --field-trial-handle=1572,i,17499456421520487674,10045132064066568898,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7256
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1708985249 --steamid=0 --first-renderer-process --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2752 --field-trial-handle=1572,i,17499456421520487674,10045132064066568898,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:6012
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1708985249 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3352 --field-trial-handle=1572,i,17499456421520487674,10045132064066568898,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:6680
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --buildid=1708985249 --steamid=0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2252 --field-trial-handle=1572,i,17499456421520487674,10045132064066568898,131072 --disable-features=BackForwardCache,DcheckIsFatal,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7756
- - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:5960
- - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    PID:6328
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:5948
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    PID:4976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x194
1⤵
PID:6004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.1MB

MD5
b4411620a3551834e4f699cc5a9b27e6

SHA1
5093960cc86613e310d13770b5adef00fe93f3eb

SHA256
3caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04

SHA512
47dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024

Download Submit
C:\Program Files (x86)\Steam\aom.dll

Filesize
332KB

MD5
a58e91b2e6dd48d5eb3c6c86ffaad956

SHA1
20263ba41a8984c54af7187ef42522622e77adb4

SHA256
c10aa097b707323473aec74fff79648906b93480e481965e809d8bc835fca078

SHA512
f1156a12755bfcd8674d23998971e2fbbbe4ed0c032d9c77d92c808f475ac8e51b6e1fc355d1f64bbdaa1fb50bcb0098b32b36297d2f0f70368ce36f86502054

Download Submit
C:\Program Files (x86)\Steam\avif-16.dll

Filesize
226KB

MD5
a09c5fa842fa4456a0b53b46f1050225

SHA1
9e4677f19e77bf55e7d0e2e82d8c27f79dbbd78e

SHA256
3d7ba6fedfdfd6e751693d718a21438304690b754d1c5d13c847a829b2423b8b

SHA512
71c962da6ed6894209891513bf9f0132a5eab6c65a5d9ba334efcaf73463be5625665a060863a106d59fad1949f6191f641aa4c59ddb0e825701bef08ef9b5a5

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.7MB

MD5
2de3f7cf6020b3bb6bc4199459a63016

SHA1
8a30e5e333a353eb069ab961a4c1918fcbb44623

SHA256
f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e

SHA512
5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e

Download Submit
C:\Program Files (x86)\Steam\bin\audio.dll

Filesize
178KB

MD5
82256c56a9004b7089a2d4acc71072cf

SHA1
51735d436accef26fedd8eb74a216ad87baf57b9

SHA256
3ccd834addfad96ef91b88d897f53c70cb9715d6e8a4fc33d077e8956ef061cc

SHA512
38c3aabdae735088e0243e4b91e6a3a0b5792a756fe3a39dec5507137e4eb5f284662b2c4aea211c43653787597018380dcb656688c773a218e365c4404b226e

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-console-l1-1-0.dll

Filesize
23KB

MD5
5d341bc73b1e54509a5ad1cf242ee223

SHA1
c99d28dd1bf7df8f7560b39115ea193a0bb3b322

SHA256
e13c9c03c459682822eb5734e1f184e80dbae5fed2421cb5dc3e238946f3edf0

SHA512
39a3cd6c02b3ac42dbbe62b2a08ef1858f368163cd194d9d09fa2097b357e0540e0bf1a93b169dd93cf83bc08aeb6247d8a93a82ae72b418c1af128c9fc7e695

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-console-l1-2-0.dll

Filesize
23KB

MD5
fe49ecd88cb1b0b9a5cf88e01f4075a6

SHA1
4d47900af773a09056157336cd4a0373e9996c5f

SHA256
a82e6229869a90d19310f4247d6b3027309ee4ea49bc9c127e532b46bf95e78b

SHA512
d610e3e17bf2c082f6c52c8a9194e9f1f5d2d1c7bcb30a7fe7cdc0dfad5851b2d2d46368d964753235a892ea716fcb2694584d78580286b28b31393b85dc09b9

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-datetime-l1-1-0.dll

Filesize
23KB

MD5
587181061a8482dd8eefa8c1cbdd23b1

SHA1
6fdab708bc8b50cb9422b089c240275d478c59b2

SHA256
a4f49dfff349a4f12dc473650a57f52f6d9c2df50a12a7fe21e829ffcb2409e0

SHA512
3ae7c4a29f56dd482c9f442935f527e3bd0b902268f1d39c15fd909a4157e5f67c696136ed69cb14bb85abd08e2bbb14c3fa12e5f0dd6c75c6f4737a0873461d

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-debug-l1-1-0.dll

Filesize
23KB

MD5
227e0e0e8f61f433eba82d2b6e388415

SHA1
c76f5c4ca826b4bd63bbd1c75b5549a7b1d8307b

SHA256
872cf90b7f7ae3187e1abe1e60923736d3b85c12db32f413f42dec5b3aaeffbb

SHA512
c355b0e902ff8abbadd8499fe4b075b6045876f8c6f8797a189adeea0437d1dc1df385bd65ae379913dc8cfefc46145c291e74aa8f34cf0949a2cf0d7a615618

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
23KB

MD5
b2ebcf3c67f1722852b1061a7d6fa641

SHA1
02caf1c965f01aacdc0913be07766c6e48c07cc5

SHA256
68d7c802b9fd6f30be824965e61f02982eb43628379511fe46f1b93df0e4a6a5

SHA512
d7350120554855cb1712594e0c5cf25b956b8411a309bc6fd3837aec91364c10f9c98bf67914ee780b223bb3ebae0b41708a5d1993dbb800a544427f58dd2995

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-fibers-l1-1-0.dll

Filesize
23KB

MD5
55b7fde967d55a7de2f3e36179a0c049

SHA1
c0ceffcd7c8a335b44220f4fb9fdad45262fb174

SHA256
a70fa9a015aa316ec0e25ca507114c05a3dbb680e700c6e4c9bf8ddda2abd499

SHA512
ad3ef67b240bc53d8d0a21013b8207b6fecd74f810ff9fbca97a0493f0bfba0c5c60acff9b1bb5b1678cef4ec41f73cc47222c70b991e7dc39ac17e7620c3e83

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l1-1-0.dll

Filesize
27KB

MD5
3fc486b956727fd86b0d94d796b9c5c8

SHA1
779ba40fde8778dddc85b11c1ec492aed6ae2278

SHA256
e81b5784920db490038e1057d821bb5699dd2d2f319294b9939661f4cbfc94f9

SHA512
3c6b11fb4322da667886bdcb0511638fde6a563292f62f1040eb2eb314d1f282bc0efb9c20ce8f7518fc4da90eebb769bfe4b4e30180a7219c6f7e61fad2c3e6

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l1-2-0.dll

Filesize
23KB

MD5
7fad4ed5b9192c9e412da8eb032acdaf

SHA1
2a04c0e7be7e16eb7bd62198e3a868fe0d87a985

SHA256
10b141aaa2abf16276b69ac0773843884a47eb08fae0008ee647a15bcd7deff7

SHA512
fe611d421a53db561f02f484b9441cccfb21a2502b40a4189c5fb339ed828972352a6b0672d758f9641fc37168d9c6b100e478736342531359286918a7be4ea0

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l2-1-0.dll

Filesize
23KB

MD5
7d54304abfe17b8c3bf3451e32a5d0fe

SHA1
203f3143e122f1fa8162b6afcf53aacab90e3299

SHA256
7dcc29037927fcd5dba11ba4aacafd1de4ef643cf0f6b09fbdd0e58816fb7150

SHA512
32b407d65f9d29d21b7671dbed07dc61057a8adef81b4342879255b8a34e3ddf8aaaf80f368c983611ac9eeaa72f7ef801ed421b65433c3c4521fa7171b1bf9e

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-handle-l1-1-0.dll

Filesize
23KB

MD5
1b9aeb2a9d8b2e3af4ac1b63a0a3b653

SHA1
e308dca394e7598592606c202d85828c51deef38

SHA256
ce35d8a2c907ed6e7c26e4f99e8eff116358f2944026808df00c403a5ee4c939

SHA512
92b6d6560f78b88842d52a809bbbc303b934ea32f20134df1065a5d4ac045401af0c861c2ef176216e915cff2bd3c609b2addf64498da2fbfae66624ed350610

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-heap-l1-1-0.dll

Filesize
23KB

MD5
79ab9c62285491096f023e4a112fcc23

SHA1
52b8527c1c578a19352884b38f1a1e459c8ba798

SHA256
61d5719d2cb625fc7277682d2dadcac77c8f75825049f9e54618f7ec52116fb1

SHA512
29f14e0813a8bd9a3b802e9aca7dfdc733c439812ec9fbcc634197b49dfbe7e74e277417c5fce9dd654952674c20d9db971bc89d04dbe3ca8f9f759da61543c7

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
23KB

MD5
88e70b4aca4a1a4bafd8d1cfb0048bf1

SHA1
e008dcfbcfcf4a510610e9166230824d419ad99d

SHA256
95b0396babcbcb2cac645f921f63e86588c5446eae3db81564c82384d86d5a1d

SHA512
5e8e4756a6eabf7fb5fbc323a807c5fcbb14bb0cf55e23d3194d705448a888d496820b2f22edeb22deaec6e200f667a56acf59ab2fdade94e1de2e5d085e11bc

Download Submit
C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

Filesize
16KB

MD5
0d2ee2a57b5602ac9f15794e1cb70ecc

SHA1
638b2649cc95c8714beb248b44bb6fa1bd5c7d2b

SHA256
b7672b44a2fb8645e16b5a1612340ac4a10c80f5c2de17d3d6205b790076950f

SHA512
732121f272a4b9852ace4c8a96bde2b57544c6136de3b68bcdfbadefcf711a3549f8ca4010361aa53dbad71192fed1740b1d97ae41027a4dbe03569c26ae6f5a

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_metrics.bin

Filesize
3KB

MD5
0985a0cb05eb02521d4445809a184f5a

SHA1
00ebfd490bcdaf8a52e39a6e5c5e464e139a2e64

SHA256
fa1cc43a5acd9da14e6ce09773797b733dcf4f3a59d56d391afd2a313b728fa1

SHA512
1cdd7baa20853f586fb9601f38c82b193d6391b3bda7c7af7d5740b21ff42e7eea12d12d0e40b7887789c5370a4f2242f2f2a260cc05069fc7b90bdcf67dd41c

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.installed

Filesize
380KB

MD5
35dbde96036bd3c1c580d2508b86e90e

SHA1
2b73b2f8fe1c33ea7261f70f2f389c0629f0062b

SHA256
8f15a3636b0696d2ef80f7471f0fcc70d15e57d1c6c552619a83969e45394278

SHA512
8d2265f19d2318c2bf9eadfefc1471a2086d0cc6d6a68882b0fb5b4b242f75eea67ffe797a4a87629a9c5067772e852c3629d5cfa82e46eefeac7bb5dccbaddf

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.manifest

Filesize
9KB

MD5
bd2b87a8b4f635b9578cad7b90b35126

SHA1
739366b19e0341483c54f6fc5006a2d0dcf5bb15

SHA256
78d4aeb8c6cb23d730f079cc4f7064744e7d9fff7fc40ccf094622cd18f75e0a

SHA512
c06adade446af0a41b0853c10c21128c32d0b533ab4ee3f45f1b4ee5f8539ed12cdd80e8a5e4a5ae8f490f356e51f04c379281c2fb0fe67857072c8984336868

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
8ebd46495dd3b4ab05431c5c771d5657

SHA1
e426214322a729faddb5bc80053af5750c76683b

SHA256
70c39d5d5b16640165de19cee80da4a391035108cbc5f5009372a86954f0fe92

SHA512
53afd923f583eda4db580935a8cdd62413af8e830c04f2c12d15c55e905c114ec11a5e4483660601504c27e9350e9e47c6432f8f699464e11c5050fe846d7dc4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
239c03a3dc1c27993da724736d086cef

SHA1
ff88246f8ea3502873dcbdc622378f006c58a2e6

SHA256
b387e2fb971297d3438acca130c53dfdd202ae2ca5b52d6503333734cda4fbfc

SHA512
656922e8f2dec46ef36efba5c85088c47b02e89f62b27559611fcbe6ef85c6cd8462a4532e2d2d7f4faa977ab24f0de6f5f72e3075f8889db9e6e60baa162a32

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
6def4d3cf1453d5fb69d22fca29892a4

SHA1
09fe62653e55668de75a9fc5b64949ea81eb4991

SHA256
60c29f3c57c44c58daf69be797bfede31967b1ddfc9bb68cb7ddaa0acda67c8c

SHA512
ee4f3f5dd8a8aadde9cff8f8aca8a45fa419c36fd8a4a7d3af9b71e1f7e5d9e1d01c329c70e6da53238822b536e35224e55004bf2e1af4ec17d5b56ccfc58549

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
2fe6613e267857982d7df4368c9827ec

SHA1
d520c7427b283e3ff167b850ab15352e46d328d3

SHA256
2eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0

SHA512
cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
594be5b10d9f551e551cf20eae0e6dfc

SHA1
191c20f5cb0c27ecc5a055fa2379694f5e27a610

SHA256
e350ca62e777da4da6d25885be96d48e7ce3acf021a74f2a4902354a1bf03fbb

SHA512
e27bf6593a177c22e16ddf5a44d82b34b02063645a7fd63943b936028d9c433c89628038768a300c296c2d3bcab2ef6b8532a19f7283952d041865c704f62b0b

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
da69785dfbf494002f108dd73020183d

SHA1
34bb6061cdf120e7dced0402e588c3f712cf2dc0

SHA256
8cce22e7f13486f2bc612dcc8fa31d81038e6084a350fa10299d40c3a7f878c8

SHA512
db773783b63ed1d66a59272e05304c174b69f85d2838ae8049dffed6b6b30c2011fd9042dd652f9a1733a2b6891870b426cf1985d41921e5360c9b1ae1330e20

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
395286db3e67a59868e2662c326c541a

SHA1
716014d76622612a1bde2d4e1744d024f6d0b830

SHA256
02e48ee4e10354a2b2741d2e57ef565404753779f847906b5ae5c98ede06c01b

SHA512
64cdf1e6701ea57474051e338eee74859fc0ff4acd71ee0718a9b8cd698e94a9793c1901b6791fc0fc268c53fbc1e7e2f94ac1024f3f8765bf713954c194b0fe

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
b9e30df8cf272813b121133fcf259752

SHA1
16706f982f16d5feb9c808f94b8cfa50c23f5d80

SHA256
88919d7be26fb3e06401fc0254733d92fd743ecc56da4177b41613e1f094c3e8

SHA512
7beb65c0477b02742741a8ce23557f4f15e8cf1b1ef03a6bbadbf594bdf2cd686d7356d93719111d27b309a10ca75846765a13bb3eb4d0411785dfb13a675fc4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
d75580775d67a85353189736222a8878

SHA1
ccb2275c8f5d119640064fd533ca15f30d93f331

SHA256
10720923c1048502c5191d6d1d8580e35e707b24d457941dae94a87371af989a

SHA512
757dd94a1e3debb2520855a3d00e44e3a98b5764caf9c16c8d088fc1a1f1024eed742f1051635721f4bf2c00d1dac11fd975c09a7f5df78d1863de88f9bbf9fe

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
5462f47e56b978659ef56f196db013f4

SHA1
4749824d4e909369f59217d4980963ff17353f3f

SHA256
cbfbe91d4a4661df814ea447c03f4ca872ef3e27073a1eb746faccbfe75afc8a

SHA512
5a437968fc06619cf553ced32dba9c7c948f4364f02c8017986e9a4f09e9832b849c7e0567485ca1beba34a258d29b2612ea3ed6045c81777e9a5201139f81a3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
4KB

MD5
31bd3d4d8de5af4642b21d586d5ee54d

SHA1
552bebb93c71cd8acd72558db1810530909fb276

SHA256
52f256ded29ce22945b5bc0ef7a227189dfa91da69265ec13283a7067c239071

SHA512
cea49fc70b18a1294ec7e564ff7f4d1ff7efeb0db1cf1b088da6adcecc282569380f225e9a150d1666c5c1977ba4de0a5d9d667c72cfb8569a50546b978e9132

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
6KB

MD5
e04ad6c236b6c61fc53e2cb57ced87e8

SHA1
e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

SHA256
08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

SHA512
0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
4KB

MD5
56dcf7b68f70826262a6ffaffe6b1c49

SHA1
12e4272ba0e4eabc610670cdc6941f942da1eb6a

SHA256
948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

SHA512
c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
4KB

MD5
e9b8fccdb78bf9d275b79c75b2ff3e7b

SHA1
4b549411ed4db0f0a3699e76531353c226b06a76

SHA256
41ecfe0ffd6043a66a41bf9ea032712f2d1bbc19b434c6c666a107ee379f21e4

SHA512
4ce905a31f3a410712722271abd7e0a9a6c43646b61a321912b4a8e8f6fab68ab69add1d701c501bb069b8ecb65ecaf3bfa9be983933d0234a8c81c24bc6601f

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
4KB

MD5
b2248784049e1af0c690be2af13a4ef3

SHA1
aec7461fa46b7f6d00ff308aa9d19c39b934c595

SHA256
4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

SHA512
f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
4KB

MD5
5c7bc92e0d948e3bba3f26f64a22fe7e

SHA1
bd259397a312bee9b8262058c30e0e354eeea93a

SHA256
5e6b0978fe8e2d14905f46e089b06681d6dfe76dd0c1551c168171ac4de75969

SHA512
8a6e18ce3d38a9658172b1871255a9941c572114137e468f130956c73ff13f282a46074a1dda6404dbdbf317ecdaadf01324194b8f8c081f862037784f4946ba

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
7KB

MD5
1a537a1d30fba1d3db449a9207b63835

SHA1
ab6903b4c8d6bd3571960b1218714b8d76b1880d

SHA256
49b6b664d50a1ae0c732bcfbbdd1db1812ddccf00bcf5f40200f0e7cff5542ee

SHA512
1215b0d017a6e3ea207edafe8edd500a91a7a971b2f989d8006fa65e475ae32ec00df3e8ec06b4077f64f5b789c536bfb9d8b9945ca0e0731d68e48876bd8459

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
4KB

MD5
29f9a5ab4adfae371bf980b82de2cb57

SHA1
6f7ef52a09b99868dd7230f513630ffe473eddf8

SHA256
711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

SHA512
543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Filesize
6KB

MD5
cadd7a2f359b22580bdd6281ea23744d

SHA1
e82e790a7561d0908aee8e3b1af97823e147f88b

SHA256
3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

SHA512
53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

Filesize
4KB

MD5
f8a86b74ce3b446e3111d1480b5feaf7

SHA1
af21c55fd6ac99e65db55af9b8f4ffe790c4382c

SHA256
8a049b6126e904dcb9ba5d8af21cc0ab25ca55221cf2cd48eea45504fe23083b

SHA512
70f8009f5940b10b77a6c152c8c73f3dd425fb9ac917014504e8116ef00032888de686271e0262cbe7a55c6e605e837dcfbeb54ece71e49646b1030195fa0845

Download Submit
C:\Program Files (x86)\Steam\steam.exe

Filesize
1.2MB

MD5
0b1d6a070eb00600c9c6739fff7b095f

SHA1
d8a497220153fcad3e368c90ce87a866862bdbab

SHA256
6d68a2850892a0f6d7b013315b9a0164a55bf90e0c0062a1aaeec4fc22b42823

SHA512
8a08df559513f938a3fe8c155e1ae6917c2c2b32cc4b3859716db1f8b350a80aad99ddcdd3068cfc8480bc279d66ba729e2dcf680c21887426780e4974b38c69

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000c

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000d

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
e873ffaa4bfd4fb194d31fb318874ff0

SHA1
5a0fbfa9b4dc69779416a777f7f1f5360d52a501

SHA256
e2a1c1b5777d1394f6c404186e865d5a384ab95e1f44956017b155afedcd6f62

SHA512
46a89f4ba721c4fa26484a80cc9a53f1f19a479eaf014439f273e8996a4ecfe24c1959cabcf24f4fec1d695328254f1954109b2c7ea0be218ed79ba74aea3eed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
3f57c6605abf3feeb61a1e40680807f6

SHA1
16e9ec8ab87cedd8d97551fa8151187610ab3547

SHA256
52f16e0cee10689ff9c0e777539025210906992974b3664d782d0317c9d9a421

SHA512
3c877ba31da682de6c4cd2ae751faf87f8552953091756154551f57992023d4a88f889682d2ebafe5c615094a49119a8da1febd1a925e37037a8496c90198521

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
1e727561f97ca93a6b3966eed10ac76a

SHA1
9f459e31246798165107ac7e8840b7be949b29c6

SHA256
e326d336f3fa4bb5cfce1e911afa00089939d47b532bcd74ca50903e9d3d0e06

SHA512
0e5d4923483fba74504b81f307a58b323c24913c62f63269c52cd35dee97fe8e5dbd16d0e28bda34e071d6a5dfac48be0f90f17796316c6edeeb0c4ffcb87dad

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
8b2c2652ec8382e35a18ef5a99aecc95

SHA1
a7d542b12afc965796af63576636627280c28cf2

SHA256
dd49278c0ee0b87ceb01c64a5e9c8f423a7bdb20f555fe3f9aee6b4dd0ad4031

SHA512
d3d0b1dfd65ea2473355aa8243cf3c616c784572e240757c74d94e4f07cfe4da8d85433c15e9ca2d63d3214aff29b126c33ebab28f87d4ba211ae57aa6f22e74

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe5a2c12.TMP

Filesize
48B

MD5
01a69ed8d55e4b8f27d5a02605d88686

SHA1
71ee840fcb90e5d7f9c5dda3649a74a3a8b7fc46

SHA256
b068eb4573b0562b0e6b066b956b3c8f1da3776a75e1446f8cc28a2877ca327d

SHA512
1dd369dd1d1b847b26345b12172601efe84ede61b0ae183b78f62de5df10b314ec528f13e49305d974076316468360fc3912154407c76f5202995e11f3a69c4e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
693B

MD5
e3d176b9dbf9267fe7a4502f515c0938

SHA1
ef0928a7d9736eef7639ad7deb18ea7bbe9a2928

SHA256
04bb53a8ab6f66275fdc3e881c9f8d1c3ecab499133d9fdc4ca7832e2dbaf758

SHA512
00655108a6e5cbd675010a3433a8f9e5bcc6cba08614a092adc3eb437413b73b6e76aa9ad249383f2508e54ddb5667b6b60867411ecb8010ced6f92f134a20ac

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe5aa47f.TMP

Filesize
484B

MD5
b8b8f4fcdb9a583a20afc415616fe9d6

SHA1
bdd1f6921df4da56c0530421c98e2637d6546e21

SHA256
0b7344eb9bc94c3daf161e65dd58c3aa920a54b3e1bf12e276759f4aab5542ac

SHA512
e4ef9949dabb5c10c58d19d9b64668951d9478e5d7003f09eb9e3b13dedf6130f5c8af10d2b68962229b86b496e91d8ba3287a3e412ae10a3a643ac7c36fc531

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
fce23c39394e89488037a7437e68403a

SHA1
bd6f136bf56b535ce772adfe949db7e2c17f5b12

SHA256
9aed16e5883adf400cf2993ee69904850ce064653a64ad7f76262c2f7780ddd3

SHA512
92f1073741730a013290f28a751c9bb5ddded60d06c62810007ca71745fe9e930de1399ff295312cd06cbab91f470211e8db546a1fd2d13e42b948cbe4231caa

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
b9d8fb3c7d36bbdbb28b3ecd43644185

SHA1
e7432a03da9748c03e1ce2b02b2e6c39d4fbb2f6

SHA256
bf839940131aeae0dc02ddc36a0420dd925e08fbb5e5c5880f1c70833f6cce88

SHA512
d37917fae574c89d8b0cfeb80b6f8999130055a1ee86c2035b259b45984d962f0bd179ea8a110f12616aee05e1cfcd49074077a7d4690d02de7bd8e331df4fd8

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
6ac5cb51d3321a6d49c0750c31031288

SHA1
0f680c286274d684d899ba8919490e70a7538f18

SHA256
2a8d200e6fefbec4765f3fc6ed027c80bc8eab23150204876e09a6cf1825ae6e

SHA512
09b37c34fa4905a93095952fc2251774f4f798a02fcac321b1882d1eee1b11ea30892e45effe71ee0f9a2c29a2daaed4757f9bfaedb7decaf219b4af98313487

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe5ab73b.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
539B

MD5
61ce2db9584b92eaf05eccfb667f55b5

SHA1
765e945c4b597b3b590e0a9147eb0960c074454e

SHA256
db1b121edba113d42b68928b6085c2e3033760a7369728b228c5e1cf8f163dd6

SHA512
5b3f908d58fa3ea98bcf97169dc351f5a251418d5df897bbbc473aa0c11ae5091a2ac1e48d41bf5faf1e7c00ce8874cbc89472417120b01afac32ed5c10b5f47

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
539B

MD5
686bfd419b0403212ee5e00321dba82f

SHA1
bc73fb8ed5d2251f32607928427972c3f9d1079d

SHA256
ab0bed1a8029cd7470a0d9fa9a3b618cffdd0f939f8a80c00be7c613da8b8e7e

SHA512
9c3df9468fe7c24728a04f36cc80033e3e1fa5932e47d39cc005903a47510c4a4a7b32efda5f8ef08f23c28edca25fb468943ecddce84a68a0b010219ba772ef

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
539B

MD5
275592796ee9c972bcd548698098fb27

SHA1
55f8d1931660c64801df33eedd6985706f4f921c

SHA256
a31dcc8424271f6f3b58c12e14c77345738dd28181138f631990985963bd979a

SHA512
5d12439517e50a9b76878f082508c248525c1225e14339a2214f8b04d3c70e341c4d0053d43582920f50ac63f01fec12240b5206c9f9556fbb6cdd6363d4b5f4

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
539B

MD5
c3f94e03131a78470e05acf3a6ac6f58

SHA1
35d1404bc92cb9941aec273f01d75348640d5946

SHA256
bd45785893b1e817f32e6bf2221c7e61feb37766851aed707fdbb8de229b0fdd

SHA512
7f32ecf7776a67075492be95381c4f2d51f9fde8ee10e22af2afbe879d7245d06d9f84ee534a10eb2140fb9fbe8a87af8e8eb859cfacf245c50d49c4e8deec90

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity~RFe59f591.TMP

Filesize
203B

MD5
5d600fbf5997310031668f841caf68ba

SHA1
491ac1f5ff79f2fa85f9171c5a035a569b46e6f8

SHA256
45a8591e0ef4792ab32532f595cbdd9ed5ba08b4f66242ad8d01f4bb6b49cbd3

SHA512
5316fc243a40aa4c5e2392ce21f11a46ecda340a29ad175b282d92057be5d0f226ecebc72926039b0c94f76cdcae659cc0341622c2fa4e010a5d2f07664aaa64

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\UserPrefs.json

Filesize
1KB

MD5
281012f45435769ae62bde520fa84db1

SHA1
b3d366158767ce6d7e6a6ca0804ed50472ad13de

SHA256
1d5daf4ccadb3b41d932620ef826d8df767b3ebe4d93644413492524c6040852

SHA512
241c4a867cbf265d48c40e1492b65840a6af7232c637695d50592e8e5a09694ef5aec049ec5a779a4a98dc6d5fd0b5126367a397bed2a41eee348e48669fe53f

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\UserPrefs.json~RFe5a9ed1.TMP

Filesize
1KB

MD5
625da02e98bd3f0e00af7a568621acb9

SHA1
72f8f777f2e34e1992f8a0aa442347e187d53213

SHA256
986223d237fef3591bbe47e3b3f872ffb79fcdd2cfc48b37a668cebb001cee46

SHA512
a575f9d4039381c0a662f56c2f65220929758ff21070dc73e07a793e008e6472073fd0285c79a7c0d5374bccbbcf2d465ac50b128f7e6b0a2712384d22df209c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswE1F6.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
\Program Files (x86)\Steam\crashhandler.dll

Filesize
367KB

MD5
cf945faeb1e108946a9a61a9869a97b3

SHA1
e094746c3f379753328f6866742ba37c9bec04f5

SHA256
77997ff2854de5a04846d598a99b046d79d84ca348958ca8c3dc72f791afb5bb

SHA512
085a4264f0adcdfe001bf4242e5614b29beb6f9d6d305e62687d7f905528056be6804b40f7cfe4117c95b974777ae1af7d6990ec6960e4ccf09af05ff3ba919d

Download Submit
\Users\Admin\AppData\Local\Temp\nswE1F6.tmp\StdUtils.dll

Filesize
99KB

MD5
98a4efba4e4b566dc3d93d2d9bfcab58

SHA1
8c54ae9fcec30b2beea8b6af4ead0a76d634a536

SHA256
e2ad7736209d62909a356248fce8e554093339b18ef3e6a989a3c278f177ad48

SHA512
2dbc9a71e666ebf782607d3ca108fd47aa6bce1d0ac2a19183cc5187dd342307b64cb88906369784518922a54ac20f408d5a58f77c0ed410e2ccf98e4e9e39a0

Download Submit
\Users\Admin\AppData\Local\Temp\nswE1F6.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
\Users\Admin\AppData\Local\Temp\nswE1F6.tmp\nsDialogs.dll

Filesize
9KB

MD5
0d45588070cf728359055f776af16ec4

SHA1
c4375ceb2883dee74632e81addbfa4e8b0c6d84a

SHA256
067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

SHA512
751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

Download Submit
\Users\Admin\AppData\Local\Temp\nswE1F6.tmp\nsExec.dll

Filesize
6KB

MD5
c5b9fe538654a5a259cf64c2455c5426

SHA1
db45505fa041af025de53a0580758f3694b9444a

SHA256
7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7

SHA512
f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa

Download Submit
\Users\Admin\AppData\Local\Temp\nswE1F6.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
memory/4640-12123-0x0000000000B70000-0x0000000000FE6000-memory.dmp

Filesize
4.5MB

Download
memory/5376-12302-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12411-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12323-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12319-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12372-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12383-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12306-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12396-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12218-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12332-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12417-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12430-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12438-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12448-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/5376-12274-0x000000006FBB0000-0x0000000070EAE000-memory.dmp

Filesize
19.0MB

Download
memory/6012-12234-0x000001EC15E60000-0x000001EC15EB1000-memory.dmp

Filesize
324KB

Download
memory/6680-12301-0x00000147B7050000-0x00000147B70A1000-memory.dmp

Filesize
324KB

Download
memory/7256-12167-0x00007FFBFEE90000-0x00007FFBFEE91000-memory.dmp

Filesize
4KB

Download
memory/7256-12233-0x0000020D94E80000-0x0000020D94ED1000-memory.dmp

Filesize
324KB

Download
memory/7256-12168-0x00007FFBFF440000-0x00007FFBFF441000-memory.dmp

Filesize
4KB

Download