5d8d697707c89466cfe203bde7e242680d020646bd5e49edaabd67fc6a7d6321

Resubmissions

08/05/2024, 20:14

240508-y1cebsfh84 5

08/05/2024, 20:11

240508-yygw2afg78 6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 20:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam.exe
Size

4.2MB
MD5

7c2056e7337a5f29d2e5d3c67830745f
SHA1

d502f5c22895a859056930a5489192873cd04673
SHA256

3f321dbbc60371a585d60b17e3f67386bf1792b430d20071ca0e3efd9dbae99d
SHA512

c729dbee4d528d05d2a6d25ea105d8f34bb9087b9151c0b31a59337e444e4bccb1f3e49fce122fb3dd7b65132a15a0c8b5618c853287fecbe5427376200b2495
SSDEEP

98304:+bgwm93udfvBtp0vrjT/KFdGRv/SrbeJo7P0:utm81pjWzEfbe27P0

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping14432_447525041\_platform_specific\win_x64\widevinecdm.dll.sig	steamwebhelper.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping14432_447525041\_platform_specific\win_x64\widevinecdm.dll	steamwebhelper.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping14432_447525041\LICENSE	steamwebhelper.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping14432_447525041\manifest.json	steamwebhelper.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping14432_447525041\_metadata\verified_contents.json	steamwebhelper.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping14432_447525041\manifest.fingerprint	steamwebhelper.exe

Executes dropped EXE 12 IoCs

pid	Process
14196	Steam.exe
14432	steamwebhelper.exe
14468	steamwebhelper.exe
14600	steamwebhelper.exe
14672	steamwebhelper.exe
14940	gldriverquery64.exe
15012	steamwebhelper.exe
15060	steamwebhelper.exe
15308	gldriverquery.exe
9104	vulkandriverquery64.exe
7556	vulkandriverquery.exe
16812	steamwebhelper.exe

Loads dropped DLL 44 IoCs

pid	Process
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14468	steamwebhelper.exe
14468	steamwebhelper.exe
14468	steamwebhelper.exe
14196	Steam.exe
14600	steamwebhelper.exe
14600	steamwebhelper.exe
14600	steamwebhelper.exe
14196	Steam.exe
14600	steamwebhelper.exe
14600	steamwebhelper.exe
14600	steamwebhelper.exe
14600	steamwebhelper.exe
14672	steamwebhelper.exe
14672	steamwebhelper.exe
14672	steamwebhelper.exe
14196	Steam.exe
15012	steamwebhelper.exe
15012	steamwebhelper.exe
15012	steamwebhelper.exe
15060	steamwebhelper.exe
15060	steamwebhelper.exe
15060	steamwebhelper.exe
15060	steamwebhelper.exe
16812	steamwebhelper.exe
16812	steamwebhelper.exe
16812	steamwebhelper.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe
14196	Steam.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
14196	Steam.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4556	Steam.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe
Token: SeShutdownPrivilege	14432	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	14432	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe
14432	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
14196	Steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 14196	4556	Steam.exe	97
PID 4556 wrote to memory of 14196	4556	Steam.exe	97
PID 4556 wrote to memory of 14196	4556	Steam.exe	97
PID 14196 wrote to memory of 14432	14196	Steam.exe	98
PID 14196 wrote to memory of 14432	14196	Steam.exe	98
PID 14432 wrote to memory of 14468	14432	steamwebhelper.exe	99
PID 14432 wrote to memory of 14468	14432	steamwebhelper.exe	99
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14600	14432	steamwebhelper.exe	100
PID 14432 wrote to memory of 14672	14432	steamwebhelper.exe	101
PID 14432 wrote to memory of 14672	14432	steamwebhelper.exe	101
PID 14196 wrote to memory of 14940	14196	Steam.exe	104
PID 14196 wrote to memory of 14940	14196	Steam.exe	104
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105
PID 14432 wrote to memory of 15012	14432	steamwebhelper.exe	105

C:\Users\Admin\AppData\Local\Temp\Steam.exe
"C:\Users\Admin\AppData\Local\Temp\Steam.exe"
1⤵
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\Steam.exe
  C:\Users\Admin\AppData\Local\Temp\Steam.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:14196
- - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
    C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=14196" "-buildid=1714854927" "-steamid=0" "-logdir=C:\Users\Admin\AppData\Local\Temp\logs" "-uimode=7" "-startcount=0" "-userdatadir=C:\Users\Admin\AppData\Local\Steam\cefdata" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Users\Admin\AppData\Local\Temp\clientui" "-steampath=C:\Users\Admin\AppData\Local\Temp\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --disable-quick-menu "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal"
    3⤵
    - Checks computer location settings
    - Drops file in Program Files directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:14432
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\dumps "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1714854927 --initial-client-data=0x368,0x36c,0x370,0x344,0x374,0x7ffc4f7fee38,0x7ffc4f7fee48,0x7ffc4f7fee58
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1714854927 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=1668 --field-trial-handle=1740,i,277202240552938110,5958515387651105002,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1714854927 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2188 --field-trial-handle=1740,i,277202240552938110,5958515387651105002,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1714854927 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2504 --field-trial-handle=1740,i,277202240552938110,5958515387651105002,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1714854927 --steamid=0 --first-renderer-process --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1740,i,277202240552938110,5958515387651105002,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1714854927 --steamid=0 --log-file="C:\Users\Admin\AppData\Local\Temp\logs\cef_log.txt" --mojo-platform-channel-handle=2624 --field-trial-handle=1740,i,277202240552938110,5958515387651105002,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:16812
- - C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:14940
- - C:\Users\Admin\AppData\Local\Temp\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    PID:15308
- - C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:9104
- - C:\Users\Admin\AppData\Local\Temp\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    PID:7556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2668,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
1⤵
PID:4540

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d0 0x300
1⤵
PID:14848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping14432_447525041\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping14432_447525041\manifest.json

Filesize
1001B

MD5
2648d437c53db54b3ebd00e64852687e

SHA1
66cfe157f4c8e17bfda15325abfef40ec6d49608

SHA256
68a3d7cb10f3001f40bc583b7fff0183895a61d3bd1b7a1c34e602df6f0f8806

SHA512
86d5c3129bec156b17b8ebd5dec5a6258e10cb426b84dd3e4af85c9c2cd7ebf4faea01fd10dd906a18ea1042394c3f41a835eae2d83dc8146dfe4b6d71147828

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
f0af5dea4ac2720834785c2ae2337221

SHA1
531743e2a146f4c9aa6f6d7b4b6ffe001a2b8602

SHA256
202f1d1a7eea7534bca0e6f9380e5866fb2e949b888dba575194fb3e964aed3f

SHA512
11641f8742db67083c22ecddcee3de58c2a345163178575718563a9fc5f42a07c6028628a340df4599369db53585c4e7abe3d1079ace4a339f2b6768ac86f001

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe58c435.TMP

Filesize
48B

MD5
9db56626f72326728cdee3185240c835

SHA1
67689be6688c31b66c206ccca350643a805f3407

SHA256
af24bf8574f02fad954f3f2730e298faa7fe273fc439547a3b97ac4ad59cd52a

SHA512
8bde2a8fe0182815c8aa06be8af5d5080368ef6bceb02e5467c9f03f0cbb458b894d9aea1323b2959354fdae048bfac5c8c4d935913e4655f8447390108d7b28

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
693B

MD5
ac5bd2a2fd8157ab43370fbad0185caf

SHA1
671b49c8b16179f2bba01783f534bd88fae010eb

SHA256
0b379c71cc6d3b81a7dac261415d4fab7f19e76a7980e39fd71e5d3b51a14362

SHA512
9f9fcf8e7cfb76cd2437ca7884b37092e460263b1e8c5e6521d5cc4e66ebbfb55f7ed39a8aa55042f2be06c57be5bf951c2f09fddc0c23ad10ec54d6d795d5cb

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
786B

MD5
8f8b5bd54b0b0105d642f147777d59c5

SHA1
f81d957a1b4faff9aead7c0c0a64a41f895fa33b

SHA256
e8f89dc85021802b01dba6203a2f693793233b2b8a540907a6bd0442ce6dc567

SHA512
8475e3db7a4c0bf8dbc5b7d9bc6994e0936a1c38979af8cedb624c29c67e6ec8a72f350eb2d81fa9b8b935521b371f331cfce116a22c25bf0a56532a537374a4

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe597e8d.TMP

Filesize
484B

MD5
90481bdd92c2a8a91abbfcf43d0b712a

SHA1
0d3ef3653cff7354f4f57fa31d18ecf6ae001e2f

SHA256
db8cbf6606df6319b87900321aa2cf2e46b4e8c6fe2b77d1a98f4109bdda2e88

SHA512
81815cb8f9590e4e14c748c4ad01e5264cc9bd4ea7cd2ea6e94142bfec3c97f3d3857582135a5df2c8a52dcd3079bc75e7776e98a89e9b33f2c54a25ad3606c1

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
300B

MD5
3736a35c7e11977168c11857d354059d

SHA1
66a4483dbc914242e9207b98cf7f70cfc7c3cca3

SHA256
fde1e3d25321429bdc78948af3091499434bb773bec4b05b3d52c767488aca65

SHA512
2e58bf97cd3458071d1ecf370e6cc438f53d045c94358332bfccb82fcc0661a772ebb2cc1eda3abebb33ad9e694bc145c34fc7cd22fbeb9b517304232a23ccc6

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe59967a.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\aom.dll

Filesize
7.1MB

MD5
d764264518e77cc546a5876c3bcebad4

SHA1
ea17d45b396fa193a851bfd345e2b2c20ad60e12

SHA256
e78492de0ab575add50b925bfd44216d224d09904a9b14c17087a92fdcbc15cd

SHA512
7cf132ea5254a55c08186ffcf5e47360ef5ddd57d03d7051171f6753b22e3925304d183c2037bfd320ad56c08e079f9b2c4640db8cb3dbd38ff500c7a39e997f

Download Submit
C:\Users\Admin\AppData\Local\Temp\avif-16.dll

Filesize
226KB

MD5
a09c5fa842fa4456a0b53b46f1050225

SHA1
9e4677f19e77bf55e7d0e2e82d8c27f79dbbd78e

SHA256
3d7ba6fedfdfd6e751693d718a21438304690b754d1c5d13c847a829b2423b8b

SHA512
71c962da6ed6894209891513bf9f0132a5eab6c65a5d9ba334efcaf73463be5625665a060863a106d59fad1949f6191f641aa4c59ddb0e825701bef08ef9b5a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\audio.dll

Filesize
175KB

MD5
11c178694e376daceb091d0321a1ccfb

SHA1
c6526bc64f23d412a3a6eeaed0f5af7eaaea7f5a

SHA256
8feb103a5525f369403ce9460f939b93e3f7bb2a34cb7af53cc24200b1329ed7

SHA512
b735ef070dea53ee8af36e872afdbe66ee5037c31968f6045575f88f9ae9608ee1db87305e02f846ab99eea7616da0c706cf0369c8c9ecc0f7784ab9536eb872

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\SDL3.dll

Filesize
1.8MB

MD5
48426b2f86ae5ab81ece7ab7b3d4cef2

SHA1
7c6487dcf40c01899e05ac1b73395491638b9280

SHA256
9e0e1147a58b4fb230c93849fb9a37bf52c26b0b95b3b00e81989dcb2b22694e

SHA512
ddfc0e15d56d772b4c97d0f556798b06a0bee2aed49702c4bbab99f5f0fcf6fe3121922268f6d5d92aa41e8da6e477492563e6a81b0c01dc927f293f4f8dd6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-console-l1-1-0.dll

Filesize
23KB

MD5
9c2202f9ebd8d2e8c90c93d3b0f433e1

SHA1
3d20c8f8428df16372e7de91a6d4f94b80aefb4c

SHA256
894842053591d4818bac9e1e476601cf39e4191b4bd0748ccb9f3c2711caa946

SHA512
b274b3f3dafd290f72351b36b9937445e78b6a16eb6cfa9a0b6de3cf11d5d809cd5f4095c2c4a05c16bdd1fb1be0b883e4c387ae8f7693eab958a63ce408097e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-console-l1-2-0.dll

Filesize
23KB

MD5
0b2450ac7066b1aa6970cd4763bed6a8

SHA1
9cdc98d8a852c5e66c42e83edec21a1a2ab1d347

SHA256
9e9ee99c5fbe9a2a784d324b4bff06842874dbc33320c1fb02f063060d2d5c7b

SHA512
a1e0b0dee99c5d4ee03f15fa69436f41c965438b289eb244c8bbdec2de4b439e8ea60417ca6a37064b0aff023fbae5debb732e5e69027ca86623514520d6dffd

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-datetime-l1-1-0.dll

Filesize
23KB

MD5
880c1094ab4679600f77012712fcfdcc

SHA1
d92636752ceed77e4eb37967306de746953e375a

SHA256
65e57b5316eee1433c006adc6487c3ad3e17412b1a6d5a35ba518aaefd871bbf

SHA512
de8a622fd97bcd0a429c7a0874fc6dbeacb966e406dc519448ddfb420f584686a7a5ef105b4ac45a3a8de3bf0b7ed5b79ed62a92ebfceea3bceccce7298af652

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-debug-l1-1-0.dll

Filesize
23KB

MD5
df9bc6c6936655ed05180de600916f3c

SHA1
abfd6dc420368aaee7d3ce11cca36af3cb4446f6

SHA256
b34fda7a50b20aaae509d0919ced53d718afb997a2bd9f3b97446c3cebf994d6

SHA512
b6d935a6046a573df8c0a7bafd57c35f333f74fbe754e18de13cdf9a39fd9649449030539b208046651d648eca20e4b5d0e73a8a7d173d6ea37bbfc311b0d6df

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
23KB

MD5
a78aabc0f9a9dc5b9923d2ff67d24f23

SHA1
3a0330b84c7ca674f0710c10eee1e5126d545429

SHA256
39e98dd2cfd15b1687f3a8f8690a80026af0deaba5142c0fe503bbebca46d4c1

SHA512
3efd9fd95ef6aa16172c3d89150d49611c21deaa13fd50c2114e76380de573255ec6bdcfe10665bbe15a17c1d05ba327ca7ea24949ad1a173b3db86bab24adcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-fibers-l1-1-0.dll

Filesize
23KB

MD5
72dbf67f86c95cdef31eaaef5861a00f

SHA1
18134f00734a2255bdf9bbc777045ac2d4f2e2f3

SHA256
5c74808c61ca8b6acb8f74813fb116341b18c27e4a654bbdd383b9fee3f33d36

SHA512
e0bbcdfb658ffa70b047cfd84a0e8a5613530ed0a34cc9ac365f69e253894db4b6fd059ce02627c201c1e9efe0b98aaddb70a641ce297677d3f9162838fdd1f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l1-1-0.dll

Filesize
27KB

MD5
ee9e1e1af17a74d23438fb63f6b66395

SHA1
11f60e073257560f5f3dc8943e854bf2eac36ed2

SHA256
8587505e511503127abb7e5c614853b7848a489d96da0a95bc736dc6c3097a5e

SHA512
aca34604580214291d1ea62765ecb280c6eafad7bf8967af8c268d2daff84f783dafec8ed334ac051ad61a14fc3128dc3f396116b9c6413a288fbe7bb099a202

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l1-2-0.dll

Filesize
23KB

MD5
a5707e6342e22d92ef8df839783d1716

SHA1
642c499b65382d883f6f9381fa204ba8d08f1f10

SHA256
fbf7e43884a1fd8adf167a5cfa4319339e2dba84515ec4487e074decc9afb206

SHA512
33a5255fe6b46d228cc131d27479d272342e88f12d884b841751167000e2c6a9c08a996526580a8466e957f4696d2400baf5d2cc2b3e5f8ea23ae3803d684285

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-file-l2-1-0.dll

Filesize
23KB

MD5
a2317c5ce4c82910c7f4e97d48af645a

SHA1
67f5034a905cd1ef0c2888fd2cc40c2024d0848c

SHA256
363c1cc60b8cf09f026ffe4d6dabee37021f37d5719fa55ab807d56613e30b90

SHA512
35be28f55fcde4ad140fa089ee86aaeff3e90f174737474dfd502925313225db393a3e27eda0b44d9bee831ead48a24e803c35884842cee2946d558650b6f8f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-handle-l1-1-0.dll

Filesize
23KB

MD5
ae7a8beeed5233404cd32b2befa02077

SHA1
34ea5e1d5ef85bb5af4ac7483b8bc46e9263764c

SHA256
9e0fb5ca77dddd8716fa0c782a11d484756c471c91c35247a4e7e08f55e33b3a

SHA512
a6895c62834bb95622f909be1d85fc9b1796ab108c25b4652ae96517c2eea3df9b7c3ce951ec1283d91e5574e20eb1d6756b45b6d63753d3966bda2d8bf585a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-heap-l1-1-0.dll

Filesize
23KB

MD5
f8716cb27d1ab19ee1a95aca508e1dc9

SHA1
721f225d36302ba8542a0e223994f8339ffda596

SHA256
d9f71e7f76a39ff8b9cef6f931439de3ae62251be62543d16719d78c02cbdc1e

SHA512
dcb2b4ce63363cbc4a49d3b123eb4890634ea1ee25749ddd5cd3880123c3e53ca70c430eaaa9da15c23727cb5b4fde12b4388acd31b4c195377f6ed39dd3703d

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
23KB

MD5
4263970ca16f36e941598ba308e537b2

SHA1
fcd26814062ba652898931db3be5dff2968c12f1

SHA256
555db885fe01dbf9078b46e2f2eca4de573d809f261fc38ff9338179de99d983

SHA512
bea8a3cb7cbf36ac011c425202904f981c00c3479f1438bf8ed2430430f37d6b2e84e90857e49c166e81f72dda9e51b96bb78c40292f41c742d0af51069bde1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
23KB

MD5
ccdc8fe8856484c4b9eb2a19270ca069

SHA1
aff62d30be1dcf65a95dd7e5a9fb6d4a29fd95b2

SHA256
c57320b896e75eafbc6c5edc7d5916ec895ac69fd24ad5e59bd3a8f4ca4e7fb6

SHA512
a231a5b7af686cc6f8909193757f999fee0e67880b9f0f956d80e760c3990c70f5b5cdac2fcfbb5aebf8ad43b2d8fe85067e17be2458eaa36dbe594dfa980714

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-localization-l1-2-0.dll

Filesize
23KB

MD5
e6f7c30244cc74b2f9fbe25bc09f1e4a

SHA1
579a395f38de163a6b1118504a3d398b4409119f

SHA256
76fe06b6aee795bd72a52fac180a2e105f09745ebea017017e8025c5a0d3fcdb

SHA512
621a85c7768b3666f4dfcb7d3e1ef6082b348ea60401f654bc2c9d660dfce78f74314e20df98c45644f6af5ca05e765a9fbdce1a7ca04ad3fa57dc67ca165fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-memory-l1-1-0.dll

Filesize
23KB

MD5
dccc7f052614666443de0dd379f2461e

SHA1
1429be469a6fa1a0a67d28929fa63a807a289b12

SHA256
9aff2ddfa566d25ff6a6930e58c6e041036c222aeafb809f623662897e52ce6e

SHA512
5f1be2c1bdb42159a4c135dd7bc1376f28fe871ac2d11b2ee7733a50b1ad11fb2c1a195ef167be9a262bb24ce5c024eebbb2dd82e44955f6fe6ae623a7ae8784

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
23KB

MD5
773b5cbf74b44f021305fc86accce0b8

SHA1
4e13357b171dad8fd8608f848402553604b6b82c

SHA256
42d22a4c725b707f2ca406b453ea5028032f4b31e3b8d6e2c11b6a3b92ed973c

SHA512
fe2379e5c7707aac8f5aab9febaf7baced61ed6b1e9c7e665fd0c6c46a5434437b9036df6a307a390400278ada7a7e1c6f4c005b3bd7ad2a6ec47e10dde1d7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
23KB

MD5
b2804dea14ec0a1a8bb2877794024ef6

SHA1
f1f3affb9d90e26ee9b3076033a3360f7e83ad50

SHA256
5412dd07064025ffcf8668da2aa2eaedb93d9f92a4d98e054994356414be5208

SHA512
c1cf4ecf1e34026d2cf6db45e2b0379e6db7f8ee8fee36f65f8f42bea1e61f6bace7b3ef06f6b316c21ef8c9961c425b778716d64557f7b836c366453606940b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
23KB

MD5
7f5cecf3ee465e4668a9be0fa31674c5

SHA1
00d15773bf1c799195ad14f61531144c2cea5e6d

SHA256
557f29501705c8207995764e1c860f25403b6a967e6c3cf1f1e12ff123b6f636

SHA512
3bcaaf5cd51148e2db5256711c05aaba3650c49396f9b11c30112f805c8c0338bdcafcfe62203851a282920a49def88b6d96da604422465c3cdcd2be0c7e7fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
23KB

MD5
ca1098bc9b13f7b5fc6ea115a36de9ba

SHA1
9083f54900f0a6e03ba28ede19fe9ce64b6409d4

SHA256
ec580803a295c18ddf74878fe1637e679cd6267af6d7c3e9d639f433b685813c

SHA512
ce8202578091ff5dd1d4a961bfa4327b33ec422a9fb2d52b8fbab41a663311022e3d1122e6ccdebe613a4339a7221a5841e801d2ad33a424c9153f4b05cceb37

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-profile-l1-1-0.dll

Filesize
23KB

MD5
756153668502de1c25c4123733aad401

SHA1
760238dd09d4579003418e9b9cbc778c122e6aa5

SHA256
e203f4918e3d8c88efe4dd83985a3eeb71d94116eaf9e90cb7d62973c5ccf0b6

SHA512
6839e10fc83bf9d6f1380df221ca1b40d59da745d7c82a4140ecb468debc5f339fbbc510781850ac70696f74e4092c72bf897e9c66f3a7914d4d089aa9531cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
23KB

MD5
578a8869c793d427297d8b27cd6f5bc8

SHA1
7caef315139997a18aa9426e04af6da0fc1c42ad

SHA256
857e523e3d6c0c96d90d9e5b491ce0bb3f514ece422999c2165eec1057fc01b2

SHA512
0494d66b449a05c9de384e3211288f0bc1223483ccd33ac06d1ba30c68d6acd4a37c563e179fd9990c09c7dd37f94a842042d4ced93e1976ba5098c8d0d0f852

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-string-l1-1-0.dll

Filesize
23KB

MD5
a37150945dd638258cadbf19c9721168

SHA1
dbea87d699699ec9cafb88e631cd4db9541d68d5

SHA256
f8eb2fdca2481c2961e90a54620f2189dc7d094cf287536993daf5ce522d274f

SHA512
514d09ac3852f6fa86e79841fd2922819b596804ac166e62578bb4ea38948879b8e8ede6c6fcd368fc29727d0e2def1cdd8f02832d3f8572a98da2739cead01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-synch-l1-1-0.dll

Filesize
23KB

MD5
474af6d8555d94f7f7b98ab3c8035ae2

SHA1
3fb45930406dc1f134f336ba57002e991bd8cf2e

SHA256
4d30ff9cf68c9f5dd59f86a2498919bac51cae63382cfba1b4f6cafb67e31948

SHA512
711bdb12802e32a2311fd12022e03745ee1dc0f102c1e19c26fb7181901f350244e3f0978ae87c100aee124d2aa9261faa6a9ea249df76f791deb35919ccfb7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-synch-l1-2-0.dll

Filesize
23KB

MD5
346e63df6c712107c1a43ada1209a690

SHA1
e0ef35ca47c1c3875f6edf22c28aabfafad9b4c7

SHA256
3be68ac33afd101f25b8e214b363b31b3e8a09f4441140fcc1bd5307d6c6c44f

SHA512
a188642478b4d56d7ad632ac82032951f668b12b1721b783a4f8d059bb379edc0346208e6f6b957cf9455798ede6a8a441d9a13beab21e1e166e37783495c780

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
23KB

MD5
859d9676ce764f148803141f8b2614f6

SHA1
c42507a528b7e492d6ef0c99d3946cdc3250b4c9

SHA256
ea01b104994a3c9132d7d58a7f76ced515cc62d24c762a5da3b8039ca2ee60a7

SHA512
1bb5dcead486dba48b337ba2a7590b7ac5e90f85d7f623479c4406b16c0d5ca0fc492713c3c0a31ce0d64053246ee50a6c33ee58f0a3793f101f1af14cbb9f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-timezone-l1-1-0.dll

Filesize
23KB

MD5
e1e74e6e90876973063b5c84fdb71294

SHA1
0ebdd9d54d9d6b1b3475b466dfec6f2a121d3a87

SHA256
232fed0561c071fed572b954bb7f0702c74543e6473cb021098a70349e3a93e8

SHA512
d998cddad2f9620803e62e408a77992980b7369b3a0a49f3cb0f9c22c0c4106b71f4ce9e0011c1b7a0541d508e20650d76fc097e9e0633c84f45089b2280dec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-core-util-l1-1-0.dll

Filesize
23KB

MD5
8b958395de9f6614433ea1917ee8f265

SHA1
24d7fa69d09cf19bde347d8411d990759afdd0c8

SHA256
9cb43b9145a69ace87b677d4021c8459891cb0446a2259b793de29335530ccfa

SHA512
2a12e9a8100f0a39622a503d6124e5c1d5a509adb98fb44769c68c366f9a0e24f368e83be6d83a0424b0b15929c8880b5313bcf6484ee920f536b13aa6643644

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-conio-l1-1-0.dll

Filesize
23KB

MD5
8c4a62cafbdb87c2498e11c509300873

SHA1
81b9180ad1194634e12a4f2fe4a52aab6f763b96

SHA256
1d19dc9d51fd5239b0123526de6ccf9407d1c5b76a382e7c5c451706142d9e05

SHA512
440c9dbeae6044d5ed3fae1a7c87378e2156942e0fe3c7ae29edceb622d11cf7effd209ae0d0737238e251a68aec89a04f2072ca5170492e735e367f4f5c7fc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-convert-l1-1-0.dll

Filesize
27KB

MD5
f10c7d6a424f7c8f175b719b734c7bfb

SHA1
00d62a610931451e240ccffa679e30146840db52

SHA256
52b3c25fd17654c2ef8d51a5361e2257e72d84e495327f4f47e980fe97a12ac8

SHA512
8d0ea30740ed956c5351a5e0d55d55e6343d13caa88b9ecc181ccec3dbc8c09f2fe4db0e7cf588843ae73393f7fc8cfd62e4113bcf3be6896d9e775fea7d4d0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-environment-l1-1-0.dll

Filesize
23KB

MD5
376af3c88806fc781657dd44790fe917

SHA1
3b39874c4e4db575d38d01be4c4f4c673264e156

SHA256
1048b06d6ee6a882b23c2f8e995bfd37bb987d5297df9a7752176ea45be25791

SHA512
7316b597a13511f1e5bed6e5a3cf421bc3d8efdd6785597dc6908de658a6b20a658d09af95d5a4dce7941ab35da0b39f92d0a8f6a3398c37a2b225756c68ef4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
23KB

MD5
c0123097636db5655b905f6c8b4dd3a5

SHA1
dc67706f924b97bcdd141545d37a176ce40fec6a

SHA256
aaa98f62bf9b59f767526a5746d835cac3a1fa24059d4d25229a51b84d90521b

SHA512
43b19efb10e69b79a47ac42589cfe112a4cb42ceb087be27ab535d065243e6ca60baba36cead040aeeaefbae545d412d2b039dcc90f3c1da0d28b528da913140

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-heap-l1-1-0.dll

Filesize
23KB

MD5
343858f28c824a864cf53bc434e045f6

SHA1
c74bd7f49746ef17c9931f8020228396e35d613d

SHA256
e306ad69288a5fc020638bf7218fe5bd343365ab9d1465934e9b1f208f50f3e1

SHA512
325c359ed1caa28dfc64f0dce10923c4aa3490c0ea9a03ab5488bf4f2f8d6e5a6914d5734a5b7723bebe252dc5370d38a205ff40d9f65af356621d82094b08ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-locale-l1-1-0.dll

Filesize
23KB

MD5
4ca2317d970fab725959390d9b4c5b48

SHA1
663a61913997d19fbae639298a360f4c83564896

SHA256
1df30836ea0826d02ac46ecb783257f774ee6bbc073ab1de62fc09a9fdac2eba

SHA512
268dcc422e562f97c1cab81cc7d3a4b9c3e9e44c4679666edeec775ae049511d092fe4c99ff22e1afbc8ad065ead0d6b0fb2484dcb764cae8a3d2181f165c138

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-math-l1-1-0.dll

Filesize
31KB

MD5
c13c4c30c16b3c340f2ab002bcfcecea

SHA1
b27a05c304d98e9eab92eedff6c60d16dfb3eb5c

SHA256
94bd40ccc96f0550d021ebc53b48b844bba0298f2e57c83d07c4f508034ae8dc

SHA512
e86431c1ff89dbc974c3dee8c05aba097669020b6900e06aec54054cb7fa3facd5bb96cb404a218b2562865d24a0bb1f65f098fd079e896ae610b2e2c27770c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
31KB

MD5
374d312dd46238422ee1202c8dc1b3da

SHA1
b93b79504035fae2d776744ab99402a7fa846e7e

SHA256
087d9859304fc2c7c55e3adbe0add2ed3ee438868ba240e45797adeadd7e5762

SHA512
f803683cb92adc72770ef1b86399d48546f1687ff329e6fe8846f3b4bc1b5b0477c84b657adbdd023de5d62ead8d98e651f2631e9ee68df1196d707f0e160aaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-private-l1-1-0.dll

Filesize
75KB

MD5
6723c4a5323fd1ca2230fe0c4a30bf0e

SHA1
36701fdf6814debd0cbfd75ef8a1b1abab610dba

SHA256
e0206cfcd213a0eeff4d5c95127cfb303f15f90a9a6c6ab604e2afdeb421b54b

SHA512
a54e2da6973228b54cdd6ee51b3e541f5e232cc502f4c0889045eb5afbfd81c4b8997fddbfdc66d376f3e0bf989e65001796fe474b20bbde96f78e3ec89cb3fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-process-l1-1-0.dll

Filesize
23KB

MD5
550bbfada29a9637c3e30c04f85fc4ac

SHA1
f5da825a66bd168a1f306350e3437f78be190985

SHA256
2f77ab480cb71f6116cc27253d2fe95f0bc029c91ef2a8ea14b429e50e41efb8

SHA512
a33576a08cd4f24083807b30625f16898c939bc8bcdb94b1742a1fbefab5b1124a5d7b14fcfbbf5689f754dfb03203cc03c0a038fcf920af7999dac85272dfd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
27KB

MD5
42e63c1ba3f2c79b8cc193a24a9611c2

SHA1
7dd2bfaa737f04fad938f8696abd586327f3b4f2

SHA256
0e5827d2ccacfb6893183f2a315e8845db46d5a0f40cd1c317147308b19a112b

SHA512
20dfde8241545c839b01eb297c6a80156fa827b21fff01e18c71e531ec8f0905ecd214f169db44cfbd84f38b0f48e3e165d0423d807af488597ba0b9520129ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
27KB

MD5
97425d9aea0d462042d570587c7e5e51

SHA1
9c013c5c810cb631692ef184098af9ccbe172f78

SHA256
cafe25bba3daa3ecc1984151e2174abca2f669c23d79a166f82e7d3489eeaf3b

SHA512
adea9b32168544918c1b188f4186618f2dd09da8e1ac2b15b9e801241b8bc8f0414d6572ecaf6a4c5026ba142e789744eca04468cd333261251ec8680801f231

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-string-l1-1-0.dll

Filesize
27KB

MD5
e5623db2a54b98d1c69644777eb9cdba

SHA1
7ee9ff896277291cce9953ea6ef58def4fa3e3d0

SHA256
6054ce87cdc6f2edc1240f75c50db5ef02a8372453debbb1f07dd538af1ac638

SHA512
e0d5c51a4d6d225c0158b7fcb2e1ac026b23cf76b42683006c8368482056a9e05141d78e38d378111ac56e92f5610105d5e69a3876f74ea69a9a3cf1e451fea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-time-l1-1-0.dll

Filesize
23KB

MD5
ea1711980e463c54a29da0bbf999db55

SHA1
034d567fd6ca548c9c9e254fda01a1e559ef0077

SHA256
3a0e9029ca829380cabbc4a448e47657a01ba668bc7d2da7dc490f0571147b94

SHA512
d766ce1318bafc8866d6a58b14fc6f444ebf1d84f5aebdee77dbb576947c63decbb96f8fc53c279caa2e06264d76e47c167f941da2dcc6ba950318ea67aa52c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-crt-utility-l1-1-0.dll

Filesize
23KB

MD5
4548eac2865691d00f8bbc5c79b880b6

SHA1
2ac1c450daffbb22e62ff60a06409d98c6cf23c8

SHA256
453694608971d4291f52c0d6070698f7d29472a9416b52117e32640a083f683b

SHA512
ee99ee11b7f315f0b21fb27fa93d2aa32ff710862e3a31865f283f4ef521f2504f2c4b23b6b88c615056aef2fc9812aad6787695adc05840561191ec927a29ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-downlevel-kernel32-l2-1-0.dll

Filesize
27KB

MD5
eef810c168ba5114d95c91f1e88f6076

SHA1
7952e727e5556067012544ee066e8902f5576974

SHA256
c91132ebfd1ef5d70526c8a67d7c71223b40ef96369aa301e53d943f3deaf855

SHA512
a1a35a376c5ad19985c0bd22e8418a8c861db6f949107b304e4b2ba976d666f6999d5a564f97bbdae38d486f41909caef99c9eadc0b8f4cc894fbdb01fb975b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\api-ms-win-eventing-provider-l1-1-0.dll

Filesize
23KB

MD5
7e1b066d99e92ae3e384a3f2df0f6a10

SHA1
c57609b84d48d6ee67848d60dae93fc7f7cf0224

SHA256
090e87f58f945909481e318a77ff4551af74cbe79c5736c7864507bb76d9ce3a

SHA512
93e0fca3f807b1fde68a44dc02feddd68792a1c2a98913627cf32af603a45869e7be94382055c9ee10c9edc4a8a4f6b22999fd0f9532b52525967bb7fd4d83c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\chrome_elf.dll

Filesize
1.4MB

MD5
80439b12c49898ecdbecb371a294bacf

SHA1
992633f6e84209a6b5cef932c4c3d2c9f0b3e78f

SHA256
2fc98ab775011385ef96af83b13576cbc8b4809f6cfb6b2fc7e321bdedcb370b

SHA512
bdba712217a2cd8612a9ae15104fe97b5fcf990be8306dd6eed8fc29707d23d5b2cc80f596fc3618fa0ec7dc7440f90f55f8d5492c9b1dde6b15b181bf1a76ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\d3dcompiler_47.dll

Filesize
4.7MB

MD5
a9cd65f4e19f82f0b09003bf6bc3932f

SHA1
9c669fba967454169f1c0797f75e599a1d3d07c9

SHA256
71d9fd57f0279e388e2144aed0eb16240e77a8b98dfdf6aa1d8494f47252835c

SHA512
68a3d0b9aae7c7b953f489914bff2a2c82800dc9cfb1db7f14b80fbfc56941d464ecc8083370f566d7c62f9db8ee26685ecb5bb9674873ac4b1eb1431e3c853f

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\libEGL.dll

Filesize
469KB

MD5
6fe68d45f9129e49738230493a248281

SHA1
b47f0a056c60fabb771db2deb76af0249ddc4503

SHA256
ea893d84a80b5e6f1b96b4741acb8aacff89937053bedc11c50fa229bed6e905

SHA512
e45d6c2646f190adde5c14a4b03bc9aa4241a1c4e894c14ac84d98e0c7a5c90bc85bc93320b7a218c99539f765745e284233e25bc2ac036b7636dd80ad7b0422

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\libGLESv2.dll

Filesize
7.1MB

MD5
722e4a5213354404ca95c167bc79dbc0

SHA1
631a44277b3ab577ac822d5c1a388f5e8360fa0c

SHA256
2e8e740b950d2dc863d01b8dedf46009122084eb860bb90ba48d882b63ff88d6

SHA512
601f59fcf40718294aee00225ef734913dca92738c7c62735226f2b1dcf7871b34946286af434dd1c41689d202a85500924e68158a5eb9ed115a261278f372f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\msvcp140.dll

Filesize
555KB

MD5
8fdcc5cea7d960965a427dd76d174872

SHA1
9dfa5a755ce36069c142882a2ef5c456290f3984

SHA256
bef8fb98b6e255c145121b6c1a61ace8fa0b2ec3887deec6816bddb867a06606

SHA512
d8909fded13630e6c5c7f0573aa73f982edbbbd178f80871f184f4a974e87d87b4a0ee23fc8310b6f1a69dbf323d841c1e7d2d053b065304d30647c13815ad17

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\openvr_api.dll

Filesize
806KB

MD5
4398179b668c70f4464ce9448fa0bac3

SHA1
a12848d2488fbd31a2481922664a2875f162bbdd

SHA256
0ba4d3049449403e1966cf8922ac5c2e6130fabe72c0cc6b3218da82f9110ac9

SHA512
98db440b4c220a9e71b60104c819c402bd88b6c10b9ed518660e8550884fa518e165bf20ec2d85a4bb5c379a28e9524d4b69dd25dc599e062498670fe8f28bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\bin\cef\cef.win7x64\steamwebhelper.exe

Filesize
6.9MB

MD5
b94bbbb4fdabd137df265b8ce4e7caaa

SHA1
7a5aeb4b78d738d62f57aa14ba30e5ae08672a79

SHA256
bf6ae327ddef953dd701948fd42431f26574e5487f77ad4b3d59b4a65602042d

SHA512
6c2ab3171949475beaac3f74ef20615f6a5da44c135f2bcb75c831ac66bc0e123d532dcb3a07511f1a5e2524ff8605c4e0c9de0c7ebd1a39b55d02bdcb44fda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\crashhandler.dll

Filesize
363KB

MD5
af7888ebe56010f3bf70574f71853cd9

SHA1
bbc3c2729bc2765ed346930450b42bcc1acdb4e8

SHA256
31c63ccc814699a5d46328c651db344d28635474f5c0531f9aaaf184d80fe976

SHA512
946874f68e932c242389062f696551d9bd5faff1b3732a18d61448c54d0c57e3fd00d75fcc27e5365ee641e4d70e35a987787cf9b670400fd11d3808f9870996

Download Submit
C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt

Filesize
11KB

MD5
a63c53c44f73f6f0aed379e186e05a1c

SHA1
7cfe194f24d6189e1cca8334ed5632319511d1cf

SHA256
6a89e2f177e35be15d0da8b9fd0956cb550ad291f7d71fe63104c8a9e13a4f51

SHA512
ac68575ae87b3d7f947bd173504c5c3cd653e32fb693330762816bf30ac1509cf8b2a1222eaa5e701673632c45c40901896fa0abf39f3b8c0d76d62786e5694d

Download Submit
C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin

Filesize
2KB

MD5
550c3019eabeb00bfd46e45273639aa2

SHA1
2e142027e5866365058f101de527042132d25dfb

SHA256
cc336dce4d4020d4cacc94374f7b5af9aba5ac83781ef91d2f771e6e60e3a158

SHA512
820b470d10553dfdbbe7dedffb0e480452c928733b3fc030c11e3e261e7a71c848b280134d17f4f0c2532d11cba03732c020b1417664a6099a6e35fa4bfd9904

Download Submit
C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.installed

Filesize
464KB

MD5
db435a2bacd2bad2a25d05898cf3cc5a

SHA1
316f21c6d8aa264a1d0b07144df4cefab6022741

SHA256
77d1202f4971162b15c362575eb82992eabd0e61baab4ffc575919bacb46eb5a

SHA512
94efb3af4f16d9e4e23134a06cba72770719032a38b36c208de6134960def8743d4f1b6f4588529282ded76b315ab33764b39bbbb79b4dbff4302477c650bbb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\package\steam_client_win32.manifest

Filesize
9KB

MD5
523923fca32f03ad1cdfcbc709ad58ae

SHA1
4d75494feed080fe3220bcac3b5adf6a147cca1b

SHA256
0cd3dbfcbb72d6157e1ae67ae235282a19235bfd5175c2a911162cc6ee90c184

SHA512
19a5532211e3d10f0ac76ff137c425c16f92e72277c5b1fcbc76a0a7cc1ba9592317835d448b2d1cf331f6677a9937288ef755efdf4a8c67d372f46cc7e50b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Users\Admin\AppData\Local\Temp\steam.exe

Filesize
4.2MB

MD5
359feb3b9136f83a261e0f260b568136

SHA1
055c32421bbb3dc8714d4f0405b2786e89e8ae6b

SHA256
7f79252afdb9402e0b4a5ac3dac1b19cc8689fd5192b69ecd7974458ef600984

SHA512
09400c3df422ee1293a8904ba4f368a792c672204370918b18266fda73c5e624229e21c32afba17fef43a01594841aeb990d56eced8ff2ebaebf4b6fd9c62cef

Download Submit
memory/4556-12101-0x0000000000A50000-0x0000000000F04000-memory.dmp

Filesize
4.7MB

Download
memory/14196-12283-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12241-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12273-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12377-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12372-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12289-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12358-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12254-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12278-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12268-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/14196-12314-0x0000000070040000-0x0000000071351000-memory.dmp

Filesize
19.1MB

Download
memory/15012-12248-0x000002453C290000-0x000002453C5E5000-memory.dmp

Filesize
3.3MB

Download
memory/15012-12249-0x000002453C140000-0x000002453C170000-memory.dmp

Filesize
192KB

Download
memory/15012-12185-0x00007FFC5D5D0000-0x00007FFC5D5D1000-memory.dmp

Filesize
4KB

Download
memory/15012-12184-0x00007FFC5BF30000-0x00007FFC5BF31000-memory.dmp

Filesize
4KB

Download
memory/15060-12251-0x000002295F8C0000-0x000002295F8F0000-memory.dmp

Filesize
192KB

Download
memory/15060-12250-0x000002295FB00000-0x000002295FE55000-memory.dmp

Filesize
3.3MB

Download
memory/16812-12339-0x000002BEA3D50000-0x000002BEA40A5000-memory.dmp

Filesize
3.3MB

Download
memory/16812-12355-0x000002BEA3C00000-0x000002BEA3C30000-memory.dmp

Filesize
192KB

Download