Analysis

  • max time kernel
    115s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-08-2024 07:53

General

  • Target

    https://store.steampowered.com/

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 57 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Detected potential entity reuse from brand steam.
  • Drops file in Program Files directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 19 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 41 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://store.steampowered.com/"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://store.steampowered.com/
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59d558f9-635b-403b-8d19-21a0bb874e56} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" gpu
        3⤵
          PID:864
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2492 -parentBuildID 20240401114208 -prefsHandle 2468 -prefMapHandle 2464 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d820eb7c-2ed1-45ec-bbe6-ede2cb6f499d} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" socket
          3⤵
          • Checks processor information in registry
          PID:4068
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2904 -childID 1 -isForBrowser -prefsHandle 2908 -prefMapHandle 2772 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f422fcfa-ad29-4053-ae52-2a44168d3eee} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
          3⤵
            PID:1380
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 3604 -prefMapHandle 3624 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c92460af-b690-4d4b-b285-224de71db57e} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
            3⤵
              PID:1460
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4476 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4492 -prefMapHandle 4564 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9932d7c6-2567-4239-b083-2bb6174e3bba} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" utility
              3⤵
              • Checks processor information in registry
              PID:4996
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5432 -childID 3 -isForBrowser -prefsHandle 5240 -prefMapHandle 5244 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2819e589-36a7-4dd0-89c7-29edf6531872} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
              3⤵
                PID:1984
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5632 -childID 4 -isForBrowser -prefsHandle 5624 -prefMapHandle 5620 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {14bd1ddf-9e29-4dcd-83bf-225a66c94037} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
                3⤵
                  PID:1800
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 5 -isForBrowser -prefsHandle 5732 -prefMapHandle 5736 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 896 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52872440-fdb7-44e9-9c32-9234fa8fa01d} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" tab
                  3⤵
                    PID:432
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6128 -parentBuildID 20240401114208 -prefsHandle 4760 -prefMapHandle 4740 -prefsLen 29278 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38a491bc-76b2-43ca-a505-a32adb597f32} 2424 "\\.\pipe\gecko-crash-server-pipe.2424" rdd
                    3⤵
                      PID:3784
                    • C:\Users\Admin\Downloads\SteamSetup.exe
                      "C:\Users\Admin\Downloads\SteamSetup.exe"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:5316
                      • C:\Program Files (x86)\Steam\bin\steamservice.exe
                        "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:4768
                • C:\Program Files (x86)\Steam\steam.exe
                  "C:\Program Files (x86)\Steam\steam.exe"
                  1⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Modifies system certificate store
                  PID:6020
                  • C:\Program Files (x86)\Steam\steam.exe
                    "C:\Program Files (x86)\Steam\steam.exe"
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    PID:1440
                    • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=1440" "-buildid=1721173382" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-userdatadir=C:\Users\Admin\AppData\Local\Steam\cefdata" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal"
                      3⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2564
                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1721173382 --initial-client-data=0x368,0x36c,0x370,0x344,0x374,0x7ffe06b9ee38,0x7ffe06b9ee48,0x7ffe06b9ee58
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:4436
                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1721173382 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1596 --field-trial-handle=1728,i,12641175233615552428,5769375221668812265,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:964
                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1721173382 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2196 --field-trial-handle=1728,i,12641175233615552428,5769375221668812265,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2452
                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1721173382 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2512 --field-trial-handle=1728,i,12641175233615552428,5769375221668812265,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1828
                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1721173382 --steamid=0 --first-renderer-process --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1728,i,12641175233615552428,5769375221668812265,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:5736
                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1721173382 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3576 --field-trial-handle=1728,i,12641175233615552428,5769375221668812265,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:5208
                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1721173382 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3796 --field-trial-handle=1728,i,12641175233615552428,5769375221668812265,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:5944
                    • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                      .\bin\gldriverquery64.exe
                      3⤵
                      • Executes dropped EXE
                      PID:5756
                    • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                      .\bin\gldriverquery.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3172
                    • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                      .\bin\vulkandriverquery64.exe
                      3⤵
                      • Executes dropped EXE
                      PID:4944
                    • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                      .\bin\vulkandriverquery.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4064
                • C:\Windows\system32\AUDIODG.EXE
                  C:\Windows\system32\AUDIODG.EXE 0x510 0x4a8
                  1⤵
                    PID:2532

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Program Files (x86)\Steam\Steam.exe

                    Filesize

                    4.2MB

                    MD5

                    33bcb1c8975a4063a134a72803e0ca16

                    SHA1

                    ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

                    SHA256

                    12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

                    SHA512

                    13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

                  • C:\Program Files (x86)\Steam\aom.dll

                    Filesize

                    7.1MB

                    MD5

                    d764264518e77cc546a5876c3bcebad4

                    SHA1

                    ea17d45b396fa193a851bfd345e2b2c20ad60e12

                    SHA256

                    e78492de0ab575add50b925bfd44216d224d09904a9b14c17087a92fdcbc15cd

                    SHA512

                    7cf132ea5254a55c08186ffcf5e47360ef5ddd57d03d7051171f6753b22e3925304d183c2037bfd320ad56c08e079f9b2c4640db8cb3dbd38ff500c7a39e997f

                  • C:\Program Files (x86)\Steam\avif-16.dll

                    Filesize

                    226KB

                    MD5

                    a09c5fa842fa4456a0b53b46f1050225

                    SHA1

                    9e4677f19e77bf55e7d0e2e82d8c27f79dbbd78e

                    SHA256

                    3d7ba6fedfdfd6e751693d718a21438304690b754d1c5d13c847a829b2423b8b

                    SHA512

                    71c962da6ed6894209891513bf9f0132a5eab6c65a5d9ba334efcaf73463be5625665a060863a106d59fad1949f6191f641aa4c59ddb0e825701bef08ef9b5a5

                  • C:\Program Files (x86)\Steam\bin\SteamService.exe

                    Filesize

                    2.5MB

                    MD5

                    ba0ea9249da4ab8f62432617489ae5a6

                    SHA1

                    d8873c5dcb6e128c39cf0c423b502821343659a7

                    SHA256

                    ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

                    SHA512

                    52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

                  • C:\Program Files (x86)\Steam\bin\audio.dll

                    Filesize

                    177KB

                    MD5

                    c3f779618f359161cb4584d8b4f76c96

                    SHA1

                    ed20aefa670c8a9a01b2e5648228e1d38a2f7a99

                    SHA256

                    06b721c371debecc442b7d03774f99935f46b261311bb1ab110bfe8b0a48a516

                    SHA512

                    7aaeef7574def8c27e3b63d07dd9db09619ff047de47253d1035764c80fd6000ad6718cf60e5e2e3a6b4bdeefc407bb5a43961ce03ba512b271c326a5cc307b5

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-console-l1-1-0.dll

                    Filesize

                    23KB

                    MD5

                    4cbad862a3ff6e7ac0f33a904d247536

                    SHA1

                    57ed831d8f3739aee41735fce679641862c36076

                    SHA256

                    32a70082cf3496745580c0e4b7d1bdbe925013300f0573ccef466e7a1915a51c

                    SHA512

                    355e5f5081588c2460b6c21818172eea17b18f6d94a958902db57a585409c8a2231a2666bc12548316a041bfce8a2eeeef2e4759a9e38900550b6a7c96d7ed2a

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-console-l1-2-0.dll

                    Filesize

                    23KB

                    MD5

                    f9bf7d30ea5a945b77910a06151ff620

                    SHA1

                    3158c9ab3fd9b6fed40e77abe39eb53234151977

                    SHA256

                    b4ff5467266a4f8e5d8998525a8948b8b86d51a23c2f4f7023c505c8db341802

                    SHA512

                    07e01ebde7c80fa3937f2169da9dc496f0a5efbbbc9c305e7772e28e334906054c14747fe10cca0ac1f1f275d95a08801ae7c44ca1cbddae1c1e008bf428d1a4

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-datetime-l1-1-0.dll

                    Filesize

                    23KB

                    MD5

                    e763390e8aebf15cb2b9b5b8c9cc4e9e

                    SHA1

                    0f9f6544903700fa26c8892ff7e4881c56238282

                    SHA256

                    5963b1cdb894ce297e52844741047f74f8d86fa7e97437e26d9bc8f0094e1003

                    SHA512

                    4c8089029c0d97ef1a1570dc47a8eda08f2071332521cdb54b5b52786d078c19bf0324fa43b9d1c49b942f8eedf7a6dab606b25a3913a80f6c8d7bb97d28a768

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-debug-l1-1-0.dll

                    Filesize

                    23KB

                    MD5

                    df9e90a38a99d1f609ba721a3d329195

                    SHA1

                    ad8859c5ec7f591800c0d4b6453eb10167ae142d

                    SHA256

                    ba17d3a66e3df85fbf8b82b500f1360f8598cd48a814fda3e552cdd995e6f449

                    SHA512

                    e41ba10d2c679754627c348232bd8124a01eceedfe30c88b6f7ed257895a7b59e5149d448a68415c4d2cc1a5c2c32a575f032b764a14a2330d62f08ccb87de85

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-errorhandling-l1-1-0.dll

                    Filesize

                    23KB

                    MD5

                    649e3b7d4b114213383aebd2dda0308d

                    SHA1

                    ba1ba5acb362cbab817c5e1a3126d6ebf600740b

                    SHA256

                    b15dd0c332b261d62a0b37b8981980a15e47b4682e6985e26f155a85f19e1466

                    SHA512

                    e667462ba457d44982337edda451a5d78eb4b6eab2e6a696ca333bdcd6688873e2c50b45e464e333ecf9f5b07dc35412bc746ff187b99e8139f9b8ef0456849c

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-fibers-l1-1-0.dll

                    Filesize

                    23KB

                    MD5

                    b72dcda47e269f98aa6998df1b27b3e5

                    SHA1

                    8a68318787497d2ed4ee6d981de825c874bcb603

                    SHA256

                    b9aefe9709a17fcaf8b85168c68f42e2b57f8214e7456a82c74495b815dc5bfe

                    SHA512

                    17b00481db67db8bf8f07035c760eb7adff65d59c532711d918bb1f2bbdbb6230cd0c583f3418102b80b6a085d45d3e3efe9a641e7dfa821c8a18505e9bb1420

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l1-1-0.dll

                    Filesize

                    27KB

                    MD5

                    d218fcedc1bee50c45f4e786c6d60564

                    SHA1

                    c4371579afbfae000e5b9a0ce07472be17badc9f

                    SHA256

                    13266c9674e9c663252ff2dc1a014a86cbaa42801d210f408269bd1dff681440

                    SHA512

                    efc30d116515ee000084db671a4c2d68551035b5512e7117c3c53d6ceb2b0418ee2ccdb5f76fa267be48e37d21a950e20423f95fc4e1c4d2c9e5fb47b692c882

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l1-2-0.dll

                    Filesize

                    23KB

                    MD5

                    2bfcd1d1b70eef1a10c939a4eeab5403

                    SHA1

                    12656ee086124eaf205a9eb470a78bc5e3d2512e

                    SHA256

                    b0919c80eb88d5d6aeb7a6eb42344f40ebf6bf0914a45045d9606e2469f15132

                    SHA512

                    9143ffd7e00f4168f78f72e9e08e6a901ffc57a1bdc07531d73f0d4fc59ae2a114d939bf2a60313ac34aa835e6c297168f255685cbd795c748fe9c8906d2215c

                  • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\api-ms-win-core-file-l2-1-0.dll

                    Filesize

                    23KB

                    MD5

                    b3a3f902a5fe7b70c988aebd0e523d53

                    SHA1

                    6fb07024c76cd0c4e07c3d0efa088b74998d59b1

                    SHA256

                    61365671b9fccbc10c06ccc0d4c8875dd98ca51e8d3eb77e91069b1bd11e4a96

                    SHA512

                    3bc057781870932f9703561bed8f786af9306a6a237582551edd12220e95521b8433a507ce702fa929654e930d0cba976eb0fc72fbe567d44620232e18390ce9

                  • C:\Program Files (x86)\Steam\crashhandler.dll

                    Filesize

                    361KB

                    MD5

                    7fd9c99282f84cb7895b1461c5b6c903

                    SHA1

                    3ace763ad9bc84f85825bb96cbba9162c5c28d2c

                    SHA256

                    c57cdc261c15b4c6872e39b6eecf60a0ef7e09632b7fff34c38c3c7b8f715b19

                    SHA512

                    832a20949a72d916151ad98539407d2c7e9b15933c01b1b21adf4d14f47464329f07c180d0e1960fb42efab068ad5f310779aaf6cc40bee1c8bcbc32fa981608

                  • C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

                    Filesize

                    13KB

                    MD5

                    e34643dff153f0d77aec19162357e399

                    SHA1

                    1079b14bdc043f610a810a1ff864c1e080bfb92f

                    SHA256

                    6e6473c9b9cf98a6d5d9a753c5c0ff78940340499907c08bf24a80262fab1b02

                    SHA512

                    6fc709fdda33f09c4ec8167a3d74ae99142f5c336c3d2034caaeb0d416289cad9d410c2bb5d790b8ebc20a8e601944e139da7bca857cd8a40ae5663d55e0806b

                  • C:\Program Files (x86)\Steam\package\steam_client_metrics.bin

                    Filesize

                    2KB

                    MD5

                    beb940356d0ca52725952582b1c75308

                    SHA1

                    aec3a4efbc22659d002cffc45959e65f43f754f9

                    SHA256

                    5fda87b35074d4f65da8e0ad7e99b317e3f1fe05b0c05703bf49156db3af2a26

                    SHA512

                    95c06ee3aea9b65bf86933096bf5931fd21aaecd3808598b22bd89be2682ff70e5442162993fd58014367cb2b7ce7e1a0f98249584d2cd29e3195fa73e9e166e

                  • C:\Program Files (x86)\Steam\package\steam_client_win32.installed

                    Filesize

                    465KB

                    MD5

                    dd84a6d3a5a13725557fbbf1e8d57d9d

                    SHA1

                    b9e8d6e4c0715850da90740521a6b2c97df6cec0

                    SHA256

                    81cc2601fa7230479d5e05f739c5ef5504a23bfb3855d7319965f61139c3221c

                    SHA512

                    b94d17f84d2a55962f28c833653cb5605d7945fa5cbb3a149273274f61992b31835688ea7e89ecb816f9ec963973e2f22582f6cb9e7fef3021ea67caa1ad6de5

                  • C:\Program Files (x86)\Steam\package\steam_client_win32.manifest

                    Filesize

                    9KB

                    MD5

                    628c58048e8d0dfd0d5a985b359b353f

                    SHA1

                    fa1c6b8addaeca7da658894e64b62252f8aacacb

                    SHA256

                    290816f20a98ea9b9ab3185c2c59eeb3c4c7b9a861c72d453622e7d1e07653d4

                    SHA512

                    be287f2c42927f939997b61052e23fb4c13b7709655fc20c34956c5d131d8820cf90aa67139191f801c1ca118ee71a33b74970e263ed87916203fc0f3e6fdb8e

                  • C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

                    Filesize

                    15KB

                    MD5

                    577b7286c7b05cecde9bea0a0d39740e

                    SHA1

                    144d97afe83738177a2dbe43994f14ec11e44b53

                    SHA256

                    983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

                    SHA512

                    8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

                  • C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

                    Filesize

                    20KB

                    MD5

                    00bf35778a90f9dfa68ce0d1a032d9b5

                    SHA1

                    de6a3d102de9a186e1585be14b49390dcb9605d6

                    SHA256

                    cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

                    SHA512

                    342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

                  • C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

                    Filesize

                    23B

                    MD5

                    836dd6b25a8902af48cd52738b675e4b

                    SHA1

                    449347c06a872bedf311046bca8d316bfba3830b

                    SHA256

                    6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

                    SHA512

                    6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

                    Filesize

                    4KB

                    MD5

                    0340d1a0bbdb8f3017d2326f4e351e0a

                    SHA1

                    90d078e9f732794db5b0ffeb781a1f2ed2966139

                    SHA256

                    0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

                    SHA512

                    9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

                    Filesize

                    6KB

                    MD5

                    4c81277a127e3d65fb5065f518ffe9c2

                    SHA1

                    253264b9b56e5bac0714d5be6cade09ae74c2a3a

                    SHA256

                    76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

                    SHA512

                    be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

                    Filesize

                    4KB

                    MD5

                    2158881817b9163bf0fd4724d549aed4

                    SHA1

                    c500f2e8f47a11129114ee4f19524aee8fecc502

                    SHA256

                    650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

                    SHA512

                    f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

                    Filesize

                    4KB

                    MD5

                    03b664bd98485425c21cdf83bc358703

                    SHA1

                    0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

                    SHA256

                    fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

                    SHA512

                    4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

                    Filesize

                    4KB

                    MD5

                    31a29061e51e245f74bb26d103c666ad

                    SHA1

                    271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

                    SHA256

                    56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

                    SHA512

                    f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

                    Filesize

                    4KB

                    MD5

                    da6cd2483ad8a21e8356e63d036df55b

                    SHA1

                    0e808a400facec559e6fbab960a7bdfaab4c6b04

                    SHA256

                    ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

                    SHA512

                    06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

                    Filesize

                    4KB

                    MD5

                    9e62fc923c65bfc3f40aaf6ec4fd1010

                    SHA1

                    8f76faff18bd64696683c2a7a04d16aac1ef7e61

                    SHA256

                    8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

                    SHA512

                    c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

                    Filesize

                    4KB

                    MD5

                    10c429eb58b4274af6b6ef08f376d46c

                    SHA1

                    af1e049ddb9f875c609b0f9a38651fc1867b50d3

                    SHA256

                    a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

                    SHA512

                    d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

                    Filesize

                    4KB

                    MD5

                    5c026fd6072a7c5cf31c75818cddedec

                    SHA1

                    341aa1df1d034e6f0a7dff88d37c9f11a716cae6

                    SHA256

                    0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

                    SHA512

                    f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

                    Filesize

                    6KB

                    MD5

                    189ba063d1481528cbd6e0c4afc3abaa

                    SHA1

                    40bdd169fcc59928c69eea74fd7e057096b33092

                    SHA256

                    c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

                    SHA512

                    ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

                    Filesize

                    4KB

                    MD5

                    18aaaf5ffcdd21b1b34291e812d83063

                    SHA1

                    aa9c7ae8d51e947582db493f0fd1d9941880429f

                    SHA256

                    1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

                    SHA512

                    4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

                    Filesize

                    4KB

                    MD5

                    1514d082b672b372cdfb8dd85c3437f1

                    SHA1

                    336a01192edb76ae6501d6974b3b6f0c05ea223a

                    SHA256

                    3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

                    SHA512

                    4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

                    Filesize

                    4KB

                    MD5

                    8958371646901eac40807eeb2f346382

                    SHA1

                    55fb07b48a3e354f7556d7edb75144635a850903

                    SHA256

                    b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

                    SHA512

                    14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

                    Filesize

                    5KB

                    MD5

                    7e1d15fc9ba66a868c5c6cb1c2822f83

                    SHA1

                    bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

                    SHA256

                    fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

                    SHA512

                    0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

                    Filesize

                    4KB

                    MD5

                    202b825d0ef72096b82db255c4e747fa

                    SHA1

                    3a3265e5bbaa1d1b774195a3858f29cea75c9e75

                    SHA256

                    3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

                    SHA512

                    e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

                    Filesize

                    4KB

                    MD5

                    7913f3f33839e3af9e10455df69866c2

                    SHA1

                    15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

                    SHA256

                    05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

                    SHA512

                    534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

                    Filesize

                    4KB

                    MD5

                    58e0fcbee3cca4ef61b97928cfe89535

                    SHA1

                    1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

                    SHA256

                    c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

                    SHA512

                    99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

                    Filesize

                    4KB

                    MD5

                    9b0b0e82f753cc115d87c7199885ad1b

                    SHA1

                    5743a4ab58684c1f154f84895d87f000b4e98021

                    SHA256

                    0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

                    SHA512

                    b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

                    Filesize

                    4KB

                    MD5

                    eb8926608c5933f05a3f0090e551b15d

                    SHA1

                    a1012904d440c0e74dad336eac8793ac110f78f8

                    SHA256

                    2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

                    SHA512

                    9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

                    Filesize

                    4KB

                    MD5

                    6367f43ea3780c4ee166454f5936b1a8

                    SHA1

                    027a2c24c8320458c49cd78053f586cb4d94ee6f

                    SHA256

                    f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

                    SHA512

                    31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

                    Filesize

                    6KB

                    MD5

                    e04ad6c236b6c61fc53e2cb57ced87e8

                    SHA1

                    e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

                    SHA256

                    08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

                    SHA512

                    0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

                    Filesize

                    4KB

                    MD5

                    56dcf7b68f70826262a6ffaffe6b1c49

                    SHA1

                    12e4272ba0e4eabc610670cdc6941f942da1eb6a

                    SHA256

                    948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

                    SHA512

                    c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

                    Filesize

                    4KB

                    MD5

                    66456d2b1085446a9f2dbd9e4632754b

                    SHA1

                    8da6248b57e5c2970d853b8d21373772a34b1c28

                    SHA256

                    c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

                    SHA512

                    196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

                    Filesize

                    4KB

                    MD5

                    b2248784049e1af0c690be2af13a4ef3

                    SHA1

                    aec7461fa46b7f6d00ff308aa9d19c39b934c595

                    SHA256

                    4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

                    SHA512

                    f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

                    Filesize

                    4KB

                    MD5

                    194a73f900a3283da4caa6c09fefcb08

                    SHA1

                    a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

                    SHA256

                    5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

                    SHA512

                    25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

                    Filesize

                    7KB

                    MD5

                    53f7e8ac1affb04bf132c2ca818eb01e

                    SHA1

                    bffc3e111761e4dc514c6398a07ffce8555697f6

                    SHA256

                    488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

                    SHA512

                    c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

                    Filesize

                    4KB

                    MD5

                    29f9a5ab4adfae371bf980b82de2cb57

                    SHA1

                    6f7ef52a09b99868dd7230f513630ffe473eddf8

                    SHA256

                    711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

                    SHA512

                    543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

                    Filesize

                    6KB

                    MD5

                    cadd7a2f359b22580bdd6281ea23744d

                    SHA1

                    e82e790a7561d0908aee8e3b1af97823e147f88b

                    SHA256

                    3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

                    SHA512

                    53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

                  • C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

                    Filesize

                    4KB

                    MD5

                    f350c8747d77777f456037184af9212c

                    SHA1

                    753d8c260b852a299df76c4f215b0d2215f6a723

                    SHA256

                    15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185

                    SHA512

                    efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

                  • C:\Program Files (x86)\Steam\steam.exe

                    Filesize

                    4.2MB

                    MD5

                    ea6ae07191d791da1243a8c84e45b484

                    SHA1

                    b09c09f5ef38e2c95b91edf42ece680bd6246798

                    SHA256

                    4cf97f554b7c2bb90aecbfffbb2168804784b1a65ec357503a1bb7e450d31207

                    SHA512

                    6d779d0d4e5cbdf4cad14d048aabf79be7bbf13b20e244f96565ae444ad3433cfe1aa89fb8b4e86bc8a98689d24549c44d3156ac1a1409b8c052d1d977813462

                  • C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000012

                    Filesize

                    210KB

                    MD5

                    48d2860dd3168b6f06a4f27c6791bcaa

                    SHA1

                    f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

                    SHA256

                    04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

                    SHA512

                    172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

                  • C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT

                    Filesize

                    16B

                    MD5

                    46295cac801e5d4857d09837238a6394

                    SHA1

                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                    SHA256

                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                    SHA512

                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                  • C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

                    Filesize

                    41B

                    MD5

                    5af87dfd673ba2115e2fcf5cfdb727ab

                    SHA1

                    d5b5bbf396dc291274584ef71f444f420b6056f1

                    SHA256

                    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                    SHA512

                    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                  • C:\Users\Admin\AppData\Local\Temp\nsjA971.tmp\StdUtils.dll

                    Filesize

                    110KB

                    MD5

                    db11ab4828b429a987e7682e495c1810

                    SHA1

                    29c2c2069c4975c90789dc6d3677b4b650196561

                    SHA256

                    c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

                    SHA512

                    460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

                  • C:\Users\Admin\AppData\Local\Temp\nsjA971.tmp\System.dll

                    Filesize

                    22KB

                    MD5

                    a36fbe922ffac9cd85a845d7a813f391

                    SHA1

                    f656a613a723cc1b449034d73551b4fcdf0dcf1a

                    SHA256

                    fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

                    SHA512

                    1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

                  • C:\Users\Admin\AppData\Local\Temp\nsjA971.tmp\modern-wizard.bmp

                    Filesize

                    150KB

                    MD5

                    3614a4be6b610f1daf6c801574f161fe

                    SHA1

                    6edee98c0084a94caa1fe0124b4c19f42b4e7de6

                    SHA256

                    16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

                    SHA512

                    06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

                  • C:\Users\Admin\AppData\Local\Temp\nsjA971.tmp\nsDialogs.dll

                    Filesize

                    20KB

                    MD5

                    4e5bc4458afa770636f2806ee0a1e999

                    SHA1

                    76dcc64af867526f776ab9225e7f4fe076487765

                    SHA256

                    91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

                    SHA512

                    b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

                  • C:\Users\Admin\AppData\Local\Temp\nsjA971.tmp\nsExec.dll

                    Filesize

                    17KB

                    MD5

                    2095af18c696968208315d4328a2b7fe

                    SHA1

                    b1b0e70c03724b2941e92c5098cc1fc0f2b51568

                    SHA256

                    3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

                    SHA512

                    60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

                  • C:\Users\Admin\AppData\Local\Temp\nsjA971.tmp\nsProcess.dll

                    Filesize

                    15KB

                    MD5

                    08072dc900ca0626e8c079b2c5bcfcf3

                    SHA1

                    35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

                    SHA256

                    bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

                    SHA512

                    8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    7KB

                    MD5

                    6d5a1f17d4960a63a18ece67ce12e759

                    SHA1

                    ba6bd153b9a6ab3c64ec8104bdc166c0ae035cbb

                    SHA256

                    41169e0c22bf7c64875ce35368390b0e5666ec1913c91e00c07cd2a34c4ab619

                    SHA512

                    997ad75f0285d3b9f55e4b1daeb3708926d79e005e0904fe809842fe3b14b4b890af01e03441bbb2ce2416f7fc9a540aaa0fce48cca754a594454c88ceaf28cd

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    6KB

                    MD5

                    2b133243d62bd3e8c32e33dd1cc0b83d

                    SHA1

                    cafc8af80ae049494df73d7d740848250605bdf2

                    SHA256

                    4835fb1df24f0f1d3fa05b13e605fb6f6cd616139452625e8f19b69ceaf5a640

                    SHA512

                    4b4cf43aaf9ac689ff1d3db1f81c6104a7a05c87276772fa22b54a3b4c7959e20b1d43e27f5e2dff8860f49eca7621167ee2d2edeab09e4dfc1a34e99f9b1a83

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\db\data.safe.tmp

                    Filesize

                    5KB

                    MD5

                    df8b52e7b7e4fadde750b6de57c7311d

                    SHA1

                    c779b8bd382182e862208e00e55a67f46e67319a

                    SHA256

                    1317faefec8e77acb9cb3d070fe40e5b845ada4f1546f8e7eb83dfb8a3a822d9

                    SHA512

                    90c23a78263c03d47225d1574a01ddb6dd355530cac27af2acd5a0b0658189940f932415e4d92c588aa8096dabcad496be7d1bc224c1c14ba3b2e2238b1a4832

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\38b6c889-2ad3-4360-adac-8bf7718d17c4

                    Filesize

                    982B

                    MD5

                    d3dc4e08ecfe03343320787300f77f13

                    SHA1

                    ec672cdffccc4e2fff809ec363264528e9e021ee

                    SHA256

                    56171eb51b6345292fab3e5927c050343b8e13da2867199ad957f12922d558d8

                    SHA512

                    f6a7df9f5b7ac4574a13ec703f3a3330a9ba072fbc36f186b78b3f6a3726c93380fa5a7ad891069dd291c554ac90bc8359f983144f07499840ba01747056bf33

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\8de99606-255c-44df-b608-d9c461d2ac55

                    Filesize

                    671B

                    MD5

                    2cb43eb04925fa8d68bc482e7185dece

                    SHA1

                    e73cce23852f8c03bcd01e62a7d7174aa86c96cb

                    SHA256

                    fe43fd6cf20bffd8caedaa9db1b0cf1450262ea90cae801e34dbff2c9e206e76

                    SHA512

                    4ddca75b7c7698145a923154bd650b9dba0431c25d7e7a810cc5ed89d161cb005c20ec587ddca570943d36f57e6effd36934758bce66bb99ef17707a28f3e2af

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\a5dd7152-c834-4b4b-a5c7-849bd1c6edb3

                    Filesize

                    8KB

                    MD5

                    4da8f4573ce4a05f738bed56a030c849

                    SHA1

                    e61463b69eb5399a549adb5b44b93feba1b83d77

                    SHA256

                    773e1d88a7c1a84a3c3bb9f48b56d20dbf5f12f0743fd08c6922083ddf1ceda0

                    SHA512

                    6c9abb0d388d2d23b42372fa7ff4835400ec3717d29df7f437f19d97a943813c79ffba6aa99f1626376ae5b7f9f8fc2f5caf20b70b0eae160d3cb952d0c28cc0

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\datareporting\glean\pending_pings\d8c8a7d0-5a07-44fc-b47e-776de559cbdd

                    Filesize

                    30KB

                    MD5

                    fa6a6d387a1ad258bd01961f8f8fb371

                    SHA1

                    76a836557376198340213f627ed6d47e0a41ac16

                    SHA256

                    b52554135a2fa574289c3f337dd2d01ae41a237b0e962b4a53c02917705a1349

                    SHA512

                    9a14d390cf23c61d677a2fc65fabd28c54f9e844d923cd7c917ca4d87f002797ab5a43df67ff270a36e4dc6e5447690601d741abf2d3692fb8c1a295a7071963

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5utpapi8.default-release\prefs-1.js

                    Filesize

                    12KB

                    MD5

                    2a7cf4496c9200dabfd59e16e732a3f1

                    SHA1

                    8e5c9761aa0cbb7d0e105dd9c40eb87e9d8e8a9b

                    SHA256

                    e9a70dd0f5ea9233de119c50a4150822412c8ad9a2aa4bd39a645755d2809ed3

                    SHA512

                    e960260dc7b3f956ff593b8bf0361a594bb71bb29d4e735e720c0413a393d8c62534e00f56749dd2609631af541c1e34fd991d2bfd1f267bc70e54067115d43d

                  • C:\Users\Admin\Downloads\SteamSetup.QHv3ILqI.exe.part

                    Filesize

                    2.3MB

                    MD5

                    1b54b70beef8eb240db31718e8f7eb5d

                    SHA1

                    da5995070737ec655824c92622333c489eb6bce4

                    SHA256

                    7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

                    SHA512

                    fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

                  • memory/1440-13088-0x000000006FCC0000-0x0000000071039000-memory.dmp

                    Filesize

                    19.5MB

                  • memory/1440-13137-0x000000006FCC0000-0x0000000071039000-memory.dmp

                    Filesize

                    19.5MB

                  • memory/1828-12987-0x00007FFE15790000-0x00007FFE15791000-memory.dmp

                    Filesize

                    4KB

                  • memory/1828-13127-0x0000017E6CB90000-0x0000017E6CC2E000-memory.dmp

                    Filesize

                    632KB

                  • memory/1828-12988-0x00007FFE14BA0000-0x00007FFE14BA1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1828-13128-0x0000017E6CCC0000-0x0000017E6CD15000-memory.dmp

                    Filesize

                    340KB

                  • memory/2564-13126-0x0000026CAB400000-0x0000026CAB4A9000-memory.dmp

                    Filesize

                    676KB

                  • memory/5208-13135-0x000001FC30050000-0x000001FC300EE000-memory.dmp

                    Filesize

                    632KB

                  • memory/5208-13136-0x000001FC301A0000-0x000001FC301F5000-memory.dmp

                    Filesize

                    340KB

                  • memory/5736-13129-0x00000151E1C20000-0x00000151E1CBE000-memory.dmp

                    Filesize

                    632KB

                  • memory/5736-13130-0x00000151E1CC0000-0x00000151E1D15000-memory.dmp

                    Filesize

                    340KB

                  • memory/5944-13143-0x000002A80B5E0000-0x000002A80B67E000-memory.dmp

                    Filesize

                    632KB

                  • memory/5944-13144-0x000002A80B8A0000-0x000002A80B8F5000-memory.dmp

                    Filesize

                    340KB

                  • memory/6020-12948-0x0000000000F10000-0x00000000013C2000-memory.dmp

                    Filesize

                    4.7MB