Analysis

  • max time kernel
    1443s
  • max time network
    1451s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 17:28

General

  • Target

    SteamSetup.exe

  • Size

    2.2MB

  • MD5

    70f3bc193dfa56b78f3e6e4f800f701f

  • SHA1

    1e5598f2de49fed2e81f3dd8630c7346a2b89487

  • SHA256

    3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

  • SHA512

    3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

  • SSDEEP

    49152:2DcHcEngZtNm1LQRHH4PTwZX6kg9hsf4lcszpyu7d/TC:rngZtNm1G4Pw6dJzZNTC

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Detected potential entity reuse from brand STEAM.
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 39 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Program Files (x86)\Steam\bin\steamservice.exe
      "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:2696
  • C:\Program Files (x86)\Steam\steam.exe
    "C:\Program Files (x86)\Steam\steam.exe"
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2012
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef8169758,0x7fef8169768,0x7fef8169778
      2⤵
        PID:1444
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:2
        2⤵
          PID:3040
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:8
          2⤵
            PID:2112
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1516 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:8
            2⤵
              PID:3044
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2348 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:1
              2⤵
                PID:2484
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2364 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:1
                2⤵
                  PID:2288
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2716 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:2
                  2⤵
                    PID:888
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1432 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:1
                    2⤵
                      PID:1824
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3472 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:8
                      2⤵
                        PID:2792
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:8
                        2⤵
                          PID:2992
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3676 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:1
                          2⤵
                            PID:1500
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2528 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:1
                            2⤵
                              PID:520
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:8
                              2⤵
                                PID:1044
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3528 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:1
                                2⤵
                                  PID:2096
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2324 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:1
                                  2⤵
                                    PID:1696
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3004 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:1
                                    2⤵
                                      PID:2180
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=772 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:8
                                      2⤵
                                        PID:2288
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2404 --field-trial-handle=1272,i,10867266602035243966,3773965065831551270,131072 /prefetch:8
                                        2⤵
                                          PID:1340
                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                        1⤵
                                          PID:2556

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Program Files (x86)\Steam\bin\SteamService.exe

                                          Filesize

                                          2.7MB

                                          MD5

                                          2de3f7cf6020b3bb6bc4199459a63016

                                          SHA1

                                          8a30e5e333a353eb069ab961a4c1918fcbb44623

                                          SHA256

                                          f649f4a1d41cd442d5e3f079b1677442a2123eb494bda58ef866870b25915d7e

                                          SHA512

                                          5d1e016c731dd1bfaaf24fde9da4f453f71773a71db956290809eb82064fa0307874cd412be6ad98c4fdbb36e94cd8ae7aa27341aaa1f9f3f9e696afe0cca56e

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

                                          Filesize

                                          4KB

                                          MD5

                                          8ebd46495dd3b4ab05431c5c771d5657

                                          SHA1

                                          e426214322a729faddb5bc80053af5750c76683b

                                          SHA256

                                          70c39d5d5b16640165de19cee80da4a391035108cbc5f5009372a86954f0fe92

                                          SHA512

                                          53afd923f583eda4db580935a8cdd62413af8e830c04f2c12d15c55e905c114ec11a5e4483660601504c27e9350e9e47c6432f8f699464e11c5050fe846d7dc4

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

                                          Filesize

                                          6KB

                                          MD5

                                          239c03a3dc1c27993da724736d086cef

                                          SHA1

                                          ff88246f8ea3502873dcbdc622378f006c58a2e6

                                          SHA256

                                          b387e2fb971297d3438acca130c53dfdd202ae2ca5b52d6503333734cda4fbfc

                                          SHA512

                                          656922e8f2dec46ef36efba5c85088c47b02e89f62b27559611fcbe6ef85c6cd8462a4532e2d2d7f4faa977ab24f0de6f5f72e3075f8889db9e6e60baa162a32

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

                                          Filesize

                                          4KB

                                          MD5

                                          6def4d3cf1453d5fb69d22fca29892a4

                                          SHA1

                                          09fe62653e55668de75a9fc5b64949ea81eb4991

                                          SHA256

                                          60c29f3c57c44c58daf69be797bfede31967b1ddfc9bb68cb7ddaa0acda67c8c

                                          SHA512

                                          ee4f3f5dd8a8aadde9cff8f8aca8a45fa419c36fd8a4a7d3af9b71e1f7e5d9e1d01c329c70e6da53238822b536e35224e55004bf2e1af4ec17d5b56ccfc58549

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

                                          Filesize

                                          4KB

                                          MD5

                                          03b664bd98485425c21cdf83bc358703

                                          SHA1

                                          0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

                                          SHA256

                                          fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

                                          SHA512

                                          4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

                                          Filesize

                                          4KB

                                          MD5

                                          31a29061e51e245f74bb26d103c666ad

                                          SHA1

                                          271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

                                          SHA256

                                          56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

                                          SHA512

                                          f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

                                          Filesize

                                          4KB

                                          MD5

                                          2fe6613e267857982d7df4368c9827ec

                                          SHA1

                                          d520c7427b283e3ff167b850ab15352e46d328d3

                                          SHA256

                                          2eba5f3f0b0dbcc2cd69c36c220a2355d1ba3cd67b6e25b5846c80e1604bcac0

                                          SHA512

                                          cf2fc8978adf54dce5700eda7d8beb4917c89bf5458131171eab95463e1b3a3315770f4baae07e498e8e36a8478f09e27054ca2d06b4542c86d8459360572be4

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

                                          Filesize

                                          4KB

                                          MD5

                                          594be5b10d9f551e551cf20eae0e6dfc

                                          SHA1

                                          191c20f5cb0c27ecc5a055fa2379694f5e27a610

                                          SHA256

                                          e350ca62e777da4da6d25885be96d48e7ce3acf021a74f2a4902354a1bf03fbb

                                          SHA512

                                          e27bf6593a177c22e16ddf5a44d82b34b02063645a7fd63943b936028d9c433c89628038768a300c296c2d3bcab2ef6b8532a19f7283952d041865c704f62b0b

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

                                          Filesize

                                          4KB

                                          MD5

                                          da69785dfbf494002f108dd73020183d

                                          SHA1

                                          34bb6061cdf120e7dced0402e588c3f712cf2dc0

                                          SHA256

                                          8cce22e7f13486f2bc612dcc8fa31d81038e6084a350fa10299d40c3a7f878c8

                                          SHA512

                                          db773783b63ed1d66a59272e05304c174b69f85d2838ae8049dffed6b6b30c2011fd9042dd652f9a1733a2b6891870b426cf1985d41921e5360c9b1ae1330e20

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

                                          Filesize

                                          4KB

                                          MD5

                                          395286db3e67a59868e2662c326c541a

                                          SHA1

                                          716014d76622612a1bde2d4e1744d024f6d0b830

                                          SHA256

                                          02e48ee4e10354a2b2741d2e57ef565404753779f847906b5ae5c98ede06c01b

                                          SHA512

                                          64cdf1e6701ea57474051e338eee74859fc0ff4acd71ee0718a9b8cd698e94a9793c1901b6791fc0fc268c53fbc1e7e2f94ac1024f3f8765bf713954c194b0fe

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

                                          Filesize

                                          6KB

                                          MD5

                                          b9e30df8cf272813b121133fcf259752

                                          SHA1

                                          16706f982f16d5feb9c808f94b8cfa50c23f5d80

                                          SHA256

                                          88919d7be26fb3e06401fc0254733d92fd743ecc56da4177b41613e1f094c3e8

                                          SHA512

                                          7beb65c0477b02742741a8ce23557f4f15e8cf1b1ef03a6bbadbf594bdf2cd686d7356d93719111d27b309a10ca75846765a13bb3eb4d0411785dfb13a675fc4

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

                                          Filesize

                                          4KB

                                          MD5

                                          18aaaf5ffcdd21b1b34291e812d83063

                                          SHA1

                                          aa9c7ae8d51e947582db493f0fd1d9941880429f

                                          SHA256

                                          1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

                                          SHA512

                                          4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

                                          Filesize

                                          4KB

                                          MD5

                                          8958371646901eac40807eeb2f346382

                                          SHA1

                                          55fb07b48a3e354f7556d7edb75144635a850903

                                          SHA256

                                          b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

                                          SHA512

                                          14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

                                          Filesize

                                          5KB

                                          MD5

                                          7e1d15fc9ba66a868c5c6cb1c2822f83

                                          SHA1

                                          bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

                                          SHA256

                                          fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

                                          SHA512

                                          0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

                                          Filesize

                                          4KB

                                          MD5

                                          d75580775d67a85353189736222a8878

                                          SHA1

                                          ccb2275c8f5d119640064fd533ca15f30d93f331

                                          SHA256

                                          10720923c1048502c5191d6d1d8580e35e707b24d457941dae94a87371af989a

                                          SHA512

                                          757dd94a1e3debb2520855a3d00e44e3a98b5764caf9c16c8d088fc1a1f1024eed742f1051635721f4bf2c00d1dac11fd975c09a7f5df78d1863de88f9bbf9fe

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

                                          Filesize

                                          4KB

                                          MD5

                                          7913f3f33839e3af9e10455df69866c2

                                          SHA1

                                          15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

                                          SHA256

                                          05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

                                          SHA512

                                          534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

                                          Filesize

                                          4KB

                                          MD5

                                          5462f47e56b978659ef56f196db013f4

                                          SHA1

                                          4749824d4e909369f59217d4980963ff17353f3f

                                          SHA256

                                          cbfbe91d4a4661df814ea447c03f4ca872ef3e27073a1eb746faccbfe75afc8a

                                          SHA512

                                          5a437968fc06619cf553ced32dba9c7c948f4364f02c8017986e9a4f09e9832b849c7e0567485ca1beba34a258d29b2612ea3ed6045c81777e9a5201139f81a3

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

                                          Filesize

                                          4KB

                                          MD5

                                          9b0b0e82f753cc115d87c7199885ad1b

                                          SHA1

                                          5743a4ab58684c1f154f84895d87f000b4e98021

                                          SHA256

                                          0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

                                          SHA512

                                          b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

                                          Filesize

                                          4KB

                                          MD5

                                          eb8926608c5933f05a3f0090e551b15d

                                          SHA1

                                          a1012904d440c0e74dad336eac8793ac110f78f8

                                          SHA256

                                          2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

                                          SHA512

                                          9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

                                          Filesize

                                          4KB

                                          MD5

                                          31bd3d4d8de5af4642b21d586d5ee54d

                                          SHA1

                                          552bebb93c71cd8acd72558db1810530909fb276

                                          SHA256

                                          52f256ded29ce22945b5bc0ef7a227189dfa91da69265ec13283a7067c239071

                                          SHA512

                                          cea49fc70b18a1294ec7e564ff7f4d1ff7efeb0db1cf1b088da6adcecc282569380f225e9a150d1666c5c1977ba4de0a5d9d667c72cfb8569a50546b978e9132

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

                                          Filesize

                                          6KB

                                          MD5

                                          e04ad6c236b6c61fc53e2cb57ced87e8

                                          SHA1

                                          e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

                                          SHA256

                                          08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

                                          SHA512

                                          0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

                                          Filesize

                                          4KB

                                          MD5

                                          56dcf7b68f70826262a6ffaffe6b1c49

                                          SHA1

                                          12e4272ba0e4eabc610670cdc6941f942da1eb6a

                                          SHA256

                                          948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

                                          SHA512

                                          c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

                                          Filesize

                                          4KB

                                          MD5

                                          e9b8fccdb78bf9d275b79c75b2ff3e7b

                                          SHA1

                                          4b549411ed4db0f0a3699e76531353c226b06a76

                                          SHA256

                                          41ecfe0ffd6043a66a41bf9ea032712f2d1bbc19b434c6c666a107ee379f21e4

                                          SHA512

                                          4ce905a31f3a410712722271abd7e0a9a6c43646b61a321912b4a8e8f6fab68ab69add1d701c501bb069b8ecb65ecaf3bfa9be983933d0234a8c81c24bc6601f

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

                                          Filesize

                                          4KB

                                          MD5

                                          b2248784049e1af0c690be2af13a4ef3

                                          SHA1

                                          aec7461fa46b7f6d00ff308aa9d19c39b934c595

                                          SHA256

                                          4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

                                          SHA512

                                          f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

                                          Filesize

                                          4KB

                                          MD5

                                          5c7bc92e0d948e3bba3f26f64a22fe7e

                                          SHA1

                                          bd259397a312bee9b8262058c30e0e354eeea93a

                                          SHA256

                                          5e6b0978fe8e2d14905f46e089b06681d6dfe76dd0c1551c168171ac4de75969

                                          SHA512

                                          8a6e18ce3d38a9658172b1871255a9941c572114137e468f130956c73ff13f282a46074a1dda6404dbdbf317ecdaadf01324194b8f8c081f862037784f4946ba

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

                                          Filesize

                                          7KB

                                          MD5

                                          1a537a1d30fba1d3db449a9207b63835

                                          SHA1

                                          ab6903b4c8d6bd3571960b1218714b8d76b1880d

                                          SHA256

                                          49b6b664d50a1ae0c732bcfbbdd1db1812ddccf00bcf5f40200f0e7cff5542ee

                                          SHA512

                                          1215b0d017a6e3ea207edafe8edd500a91a7a971b2f989d8006fa65e475ae32ec00df3e8ec06b4077f64f5b789c536bfb9d8b9945ca0e0731d68e48876bd8459

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

                                          Filesize

                                          4KB

                                          MD5

                                          29f9a5ab4adfae371bf980b82de2cb57

                                          SHA1

                                          6f7ef52a09b99868dd7230f513630ffe473eddf8

                                          SHA256

                                          711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

                                          SHA512

                                          543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

                                          Filesize

                                          6KB

                                          MD5

                                          cadd7a2f359b22580bdd6281ea23744d

                                          SHA1

                                          e82e790a7561d0908aee8e3b1af97823e147f88b

                                          SHA256

                                          3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

                                          SHA512

                                          53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

                                        • C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

                                          Filesize

                                          4KB

                                          MD5

                                          f8a86b74ce3b446e3111d1480b5feaf7

                                          SHA1

                                          af21c55fd6ac99e65db55af9b8f4ffe790c4382c

                                          SHA256

                                          8a049b6126e904dcb9ba5d8af21cc0ab25ca55221cf2cd48eea45504fe23083b

                                          SHA512

                                          70f8009f5940b10b77a6c152c8c73f3dd425fb9ac917014504e8116ef00032888de686271e0262cbe7a55c6e605e837dcfbeb54ece71e49646b1030195fa0845

                                        • C:\Program Files\Google\Chrome\Application\Dictionaries\en-US-10-1.bdic

                                          Filesize

                                          441KB

                                          MD5

                                          4604e676a0a7d18770853919e24ec465

                                          SHA1

                                          415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f

                                          SHA256

                                          a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100

                                          SHA512

                                          3d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\78e171f3-36ee-4e05-9209-a0d2802ca9eb.tmp

                                          Filesize

                                          353KB

                                          MD5

                                          1287dcde073a1661a744f21458c054e8

                                          SHA1

                                          c3f7843a67b9d58a60fcadf2870acd59acbd7999

                                          SHA256

                                          c590077098a42d722c7f142f3fb767c7a883543940eb16f65034f09d59a631d7

                                          SHA512

                                          b729a4879492da482532b95c113b7e441ecd69efc2a0ecd7f4d7dc4883c271f165bebca22989b6327c4b0eff5365a1de4f666c203bed9f677e45ecae99a3ec21

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                          Filesize

                                          264KB

                                          MD5

                                          f50f89a0a91564d0b8a211f8921aa7de

                                          SHA1

                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                          SHA256

                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                          SHA512

                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          3KB

                                          MD5

                                          e4032738a81a9266449ed66548a95c2f

                                          SHA1

                                          a338d1270b82a8dbb6e8715bd09ffae0c8ff8315

                                          SHA256

                                          8aef7ccae7492c6c866b78cf3c8b4303be58f216dc6e57c19ee2bd1f074ba0f0

                                          SHA512

                                          bc0f8fd76b3d318d72ff2df6da6e9099b22c1515aa2c72963626cc00fa2f428bc50b840c8765a0559f15b19fd08351edb0b97761139f92d1453a476141b69e1f

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          ccc0cdf4c4037a6e2219cd15d4ac573b

                                          SHA1

                                          d28206692b3e0354f93e3dc6f05d33107061f0fa

                                          SHA256

                                          02056c8bbbca5c810a66f94b56b1db74d69b4287cbc8591724de4a68a146a454

                                          SHA512

                                          ba6c759ec513b5fa8fd0da173844ac78e6b34a53c299974369e90a90f9c6860694a2ebb4a388c90beab703c2cc04cbcf4fd6b3a27dc416f06ae96b311602fa42

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          685B

                                          MD5

                                          edb8289d804f2eca7358035d19bd160a

                                          SHA1

                                          dbea1859fc691f919706853acf522957e7acf7a6

                                          SHA256

                                          71bfbee28e50a677288b39385a2cf8f25951a0db13340149a6bdb5e59a3b4f4e

                                          SHA512

                                          a2043c8e3fba7c5fba8164de14b9346a309fdb0abc89cdb66adacd28e9107db7bace3675843b039ac9a775f50d7aa6edca758f90aa1cbbf7f17561af3b48d410

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          846B

                                          MD5

                                          0a94ad0aafb207541aba1cb04386a3c1

                                          SHA1

                                          5ae010e048b3b1c3776f0c25150478c29cd44f26

                                          SHA256

                                          04e169469dabc516efc8146b141e5659f271f8e407dfaa0c41ddfb8cf38ecf44

                                          SHA512

                                          e39de29979480cb8ad0034abbacd7b6abefb51e251a2ca7353c4ecaaffc67374b8e5664194e310d820474f4153ad1f125866fabd5c8da7a7e71cf9c6f6be028d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          26a18c2b8f9c227bc4d7896d094a159c

                                          SHA1

                                          6a98958c680a9f473e995446008f0b93e34ad40f

                                          SHA256

                                          f7b6fa66b2c2a7eb27e7aae53904c8f1db7d9876fcfa9217986d14d9c303cc19

                                          SHA512

                                          a9035294815f8ae7e24ad19515f0ea1ee73fc20f20e883f84e34ba09cfd8e5fc12b5c902425f5c54079598553eb431b4430f2f1213058e2b64bc1ded86e7c99f

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          2a726a4bc29f2ce77fb6245c88ab1989

                                          SHA1

                                          05ed5b1f40ee569727b3b095b01d4cffe1938cbc

                                          SHA256

                                          0ef65c723b26198c4f30f7278de8c1e41e951fc9bb12fdf7c9fa8569c3a40209

                                          SHA512

                                          55b1d3fbcb00167744f1d9434cc870a07a82a91eff6d39c395fbf970171506c327742c704cf608da9dcc0749a28d53feaff82dc3e059e763e6984abcc084a3e1

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          2056305b32722bb0348a0e8c3099d172

                                          SHA1

                                          739276b0dda9bca4465cc23abdf170ec354461aa

                                          SHA256

                                          fcf185985b80e3d95eae5782e972c5b10415fb9365a158a94ac9fa661d72f110

                                          SHA512

                                          84f642df53caff678b5dcda5068c54cb171ad73e9fe6ceaf3dfd4ab922fdd53fb8c316183b387c54394d418b00f2d48390fda005cf9df2e0ecab9178b4fb0195

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          65c0b18e22e4f78a7eabdfb8e725b94c

                                          SHA1

                                          83374fb66a4d0d025f9cb1c57df6a44c7a9c1f67

                                          SHA256

                                          851a6ccc3f00a1b23459482f99cc003e1cee4e786fac9568818e4b4e2c52b715

                                          SHA512

                                          8f97fb633cdbbcd90f42df43e7bc9c98a6a2b072b5d87b1e250ff0310ed19351c4e74eec60a876bdbe534c6fef2e858664c973edd22d5e481990c53b01fb40c3

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          d9935de33db9e3981303c481f5931031

                                          SHA1

                                          4964ed87adfbb8d7cbfb52b40fdd9a84c1100560

                                          SHA256

                                          c6fb0144119bd9c6cb0cfe855fe9c668dbaf918267b90e925559ff19f64a137e

                                          SHA512

                                          deead9074fd659722d212eafcec20c7dfab8133ec4b239056e65100cfccdd99d203ab30180463b8d7ec0584b0a45be9c5dc448dfa515f8ebcefee5cb21e36bd3

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                          Filesize

                                          16B

                                          MD5

                                          18e723571b00fb1694a3bad6c78e4054

                                          SHA1

                                          afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                          SHA256

                                          8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                          SHA512

                                          43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          353KB

                                          MD5

                                          cd76014f4cc5d1a893b5beebccf39a9d

                                          SHA1

                                          4319770a97962c3de2a2bd06ad54bfbca81c026b

                                          SHA256

                                          b980a5bcfabf0d6bc34b26f7e33a8ffd268b32b7d58f5734901d62bb598f72bb

                                          SHA512

                                          9eb2800fe80552a1bb63dd7481c441a96c8cf80c25791e44e53b9832253ea7a7f782a5e08d59fcc9249dbcb0f1a084732f2bd6193c2a38c7fdb3a3d55230d758

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          353KB

                                          MD5

                                          638a3e6605b9c6dff76587a056493e4d

                                          SHA1

                                          05dd356cb6dc9d55db08a2cb7f3ee0e0900c7978

                                          SHA256

                                          382e947211152f4ae5245b375a516f38f8ba943ddb05ad30a912238e3389dd19

                                          SHA512

                                          7f8045017cd25592a41e8118d8a66746f0b79a4f46c46d2f191a863fe47692b1d3e5cd7b540baf96ed64ed1337a84e7214a92a5d07d84848f4506374cf5389ff

                                        • C:\Users\Admin\AppData\Local\Temp\Cab76B8.tmp

                                          Filesize

                                          70KB

                                          MD5

                                          49aebf8cbd62d92ac215b2923fb1b9f5

                                          SHA1

                                          1723be06719828dda65ad804298d0431f6aff976

                                          SHA256

                                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                          SHA512

                                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                        • C:\Users\Admin\AppData\Local\Temp\Tar7860.tmp

                                          Filesize

                                          181KB

                                          MD5

                                          4ea6026cf93ec6338144661bf1202cd1

                                          SHA1

                                          a1dec9044f750ad887935a01430bf49322fbdcb7

                                          SHA256

                                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                          SHA512

                                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                        • C:\Users\Admin\AppData\Local\Temp\nseC3CE.tmp\modern-wizard.bmp

                                          Filesize

                                          150KB

                                          MD5

                                          3614a4be6b610f1daf6c801574f161fe

                                          SHA1

                                          6edee98c0084a94caa1fe0124b4c19f42b4e7de6

                                          SHA256

                                          16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

                                          SHA512

                                          06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

                                        • \Program Files (x86)\Steam\Steam.exe

                                          Filesize

                                          4.1MB

                                          MD5

                                          b4411620a3551834e4f699cc5a9b27e6

                                          SHA1

                                          5093960cc86613e310d13770b5adef00fe93f3eb

                                          SHA256

                                          3caf4a246169b2d30c6bf18fa0b7a4a01bbe933cfb781f3da4c6b3cb67b59d04

                                          SHA512

                                          47dde07212c2d5eea548d7794fc6bb9d86ced9a0848aaeab81fa8844fc5cab7eac58e386e96a81c663b914c85c0a7116033e2b2cfd18559d40aa6c83f9a6c024

                                        • \Users\Admin\AppData\Local\Temp\nseC3CE.tmp\StdUtils.dll

                                          Filesize

                                          99KB

                                          MD5

                                          98a4efba4e4b566dc3d93d2d9bfcab58

                                          SHA1

                                          8c54ae9fcec30b2beea8b6af4ead0a76d634a536

                                          SHA256

                                          e2ad7736209d62909a356248fce8e554093339b18ef3e6a989a3c278f177ad48

                                          SHA512

                                          2dbc9a71e666ebf782607d3ca108fd47aa6bce1d0ac2a19183cc5187dd342307b64cb88906369784518922a54ac20f408d5a58f77c0ed410e2ccf98e4e9e39a0

                                        • \Users\Admin\AppData\Local\Temp\nseC3CE.tmp\System.dll

                                          Filesize

                                          11KB

                                          MD5

                                          a4dd044bcd94e9b3370ccf095b31f896

                                          SHA1

                                          17c78201323ab2095bc53184aa8267c9187d5173

                                          SHA256

                                          2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

                                          SHA512

                                          87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

                                        • \Users\Admin\AppData\Local\Temp\nseC3CE.tmp\nsDialogs.dll

                                          Filesize

                                          9KB

                                          MD5

                                          0d45588070cf728359055f776af16ec4

                                          SHA1

                                          c4375ceb2883dee74632e81addbfa4e8b0c6d84a

                                          SHA256

                                          067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

                                          SHA512

                                          751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

                                        • \Users\Admin\AppData\Local\Temp\nseC3CE.tmp\nsExec.dll

                                          Filesize

                                          6KB

                                          MD5

                                          c5b9fe538654a5a259cf64c2455c5426

                                          SHA1

                                          db45505fa041af025de53a0580758f3694b9444a

                                          SHA256

                                          7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7

                                          SHA512

                                          f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa

                                        • \Users\Admin\AppData\Local\Temp\nseC3CE.tmp\nsProcess.dll

                                          Filesize

                                          4KB

                                          MD5

                                          f0438a894f3a7e01a4aae8d1b5dd0289

                                          SHA1

                                          b058e3fcfb7b550041da16bf10d8837024c38bf6

                                          SHA256

                                          30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

                                          SHA512

                                          f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

                                        • memory/2236-112-0x00000000007C0000-0x00000000007C2000-memory.dmp

                                          Filesize

                                          8KB