3bc6942fe09f10ed3447bccdcf4a70ed369366fef6b2c7f43b541f1a3c5d1c51

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
21-11-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SteamSetup.exe
Size

1.5MB
MD5

81448c2e730b50b597bbd5e43007ce6a
SHA1

4b1b85ec2499a4ce07c89609b256923a4fc479e5
SHA256

3bc6942fe09f10ed3447bccdcf4a70ed369366fef6b2c7f43b541f1a3c5d1c51
SHA512

c9125b79012e00fc9ee800592dece583a97756b5f4485c4649f3a11143afa673b4d386af256129032064f158186542bca7da70cd31770cd7eb4a3176c96e7124
SSDEEP

24576:QDliBd5TyliR0gWwOvTCU1z3zk51iq449nkU0/1COmcrOqpXzzE2YeshfLKB7:QD8tylwXoTCWi1iq1nkU09lRENhJLKB7

Score

9^/10

discovery persistence ransomware

Malware Config

Signatures

Renames multiple (5886) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 11 IoCs

pid	Process
3948	steamservice.exe
464	steam.exe
5544	steam.exe
13168	steam.exe
13232	steamwebhelper.exe
13412	steamwebhelper.exe
13528	steamwebhelper.exe
13736	steamwebhelper.exe
13936	gldriverquery64.exe
14160	steamwebhelper.exe
14268	steamwebhelper.exe

Loads dropped DLL 54 IoCs

pid	Process
2020	SteamSetup.exe
2020	SteamSetup.exe
2020	SteamSetup.exe
2020	SteamSetup.exe
2020	SteamSetup.exe
2020	SteamSetup.exe
2020	SteamSetup.exe
2020	SteamSetup.exe
5544	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13232	steamwebhelper.exe
13232	steamwebhelper.exe
13232	steamwebhelper.exe
13232	steamwebhelper.exe
13412	steamwebhelper.exe
13412	steamwebhelper.exe
13412	steamwebhelper.exe
13168	steam.exe
13528	steamwebhelper.exe
13528	steamwebhelper.exe
13528	steamwebhelper.exe
13528	steamwebhelper.exe
13528	steamwebhelper.exe
13528	steamwebhelper.exe
13528	steamwebhelper.exe
13528	steamwebhelper.exe
13528	steamwebhelper.exe
13168	steam.exe
13736	steamwebhelper.exe
13736	steamwebhelper.exe
13736	steamwebhelper.exe
13168	steam.exe
14160	steamwebhelper.exe
14160	steamwebhelper.exe
14160	steamwebhelper.exe
14268	steamwebhelper.exe
14268	steamwebhelper.exe
14268	steamwebhelper.exe
14268	steamwebhelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0407.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\shared_german-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_rtrackpad_ring.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\templates\controller_ps4_gamepad_fps.vdf_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\gridview_mask.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\platform_korean.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_trackpad_right_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_050_menu_0150.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\icon_cloud_dunno.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0210.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_down_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\sounds\steam_chatroom_notification.m4a_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_color_button_square.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_color_button_x_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\filter_banned_finnish.txt.gz_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0419.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\broadcast\broadcast_live_grey.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_trackpad_swipe_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_color_button_circle_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_rg.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\listview_placeholder2.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_rstick_up_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_color_button_a_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_up_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_vr_happy_down.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_touchpad_edge.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_sr_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_dpad_down.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\asyncnotificationsrequesteddialog.res_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_0050.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\flag_left.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_button_triangle_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_ltrackpad_left.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\ChatRoomDlgFriend.res_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\steamui_german-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_rstick_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\minithrobber08.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\xbox_rt_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_ltrackpad_click_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0403.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamui_koreana.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamui_polish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_dpad_right.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_ltrackpad_left_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_070_setting_0090.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\steampops_latam-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_rstick.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_r_touch_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_outlined_button_square_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\xbox_p2.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\dualshock_4_french.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_color_outlined_button_y_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_outlined_button_y.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_stop_down.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\platform_portuguese.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_buttons_e_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0040.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_dpad_swipe_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_touchpad_left_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\joyconpair_left_sr_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_button_select.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_ring_md.png_	steam.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	steamwebhelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\steam\Shell\Open	steamservice.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2020	SteamSetup.exe
2020	SteamSetup.exe
2020	SteamSetup.exe
2020	SteamSetup.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe
13168	steam.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3948	steamservice.exe
Token: SeSecurityPrivilege	3948	steamservice.exe
Token: SeShutdownPrivilege	13232	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	13232	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
13168	steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 3948	2020	SteamSetup.exe	80
PID 2020 wrote to memory of 3948	2020	SteamSetup.exe	80
PID 2020 wrote to memory of 3948	2020	SteamSetup.exe	80
PID 464 wrote to memory of 5544	464	steam.exe	86
PID 464 wrote to memory of 5544	464	steam.exe	86
PID 464 wrote to memory of 5544	464	steam.exe	86
PID 5544 wrote to memory of 13168	5544	steam.exe	87
PID 5544 wrote to memory of 13168	5544	steam.exe	87
PID 5544 wrote to memory of 13168	5544	steam.exe	87
PID 13168 wrote to memory of 13232	13168	steam.exe	88
PID 13168 wrote to memory of 13232	13168	steam.exe	88
PID 13232 wrote to memory of 13412	13232	steamwebhelper.exe	89
PID 13232 wrote to memory of 13412	13232	steamwebhelper.exe	89
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13528	13232	steamwebhelper.exe	90
PID 13232 wrote to memory of 13736	13232	steamwebhelper.exe	91
PID 13232 wrote to memory of 13736	13232	steamwebhelper.exe	91
PID 13168 wrote to memory of 13936	13168	steam.exe	94
PID 13168 wrote to memory of 13936	13168	steam.exe	94
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95
PID 13232 wrote to memory of 14160	13232	steamwebhelper.exe	95

C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Program Files (x86)\Steam\bin\steamservice.exe
  "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3948

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:464
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:5544
- - C:\Program Files (x86)\Steam\steam.exe
    "C:\Program Files (x86)\Steam\steam.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:13168
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=13168" "-buildid=1731433018" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:13232
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1731433018 --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x7ffdc889af00,0x7ffdc889af0c,0x7ffdc889af18
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:13412
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1592,i,7731733360741543243,10950126762415593382,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1596 --mojo-platform-channel-handle=1584 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:13528
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=2176,i,7731733360741543243,10950126762415593382,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2180 --mojo-platform-channel-handle=2172 /prefetch:11
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:13736
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=2760,i,7731733360741543243,10950126762415593382,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2764 --mojo-platform-channel-handle=2728 /prefetch:13
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:14160
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,7731733360741543243,10950126762415593382,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3152 --mojo-platform-channel-handle=3144 /prefetch:1
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:14268
  - - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
      .\bin\gldriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:13936
  - - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
      .\bin\gldriverquery.exe
      4⤵
      PID:14640
  - - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
      .\bin\vulkandriverquery64.exe
      4⤵
      PID:14664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x000000000000047C
1⤵
PID:13716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\Steam.exe

Filesize
3.1MB

MD5
565d90cdc73f2cbc03d5c184c70fc524

SHA1
a676fab0be82968b922df4f611eda4dda63b7806

SHA256
70bde9e88aa386aa5139cac0c8a78b5576f1bed9e5f719c4e620d5c0cf7d5cbf

SHA512
7723098706d990259f6fcfc96c3dad15de951148b7122004b39e2e8c6db87f64d91cf45b693af88e1d0837824d96ec05dfba54ab7a02088a0b3f9052c2c335c2

Download Submit
C:\Program Files (x86)\Steam\aom.dll

Filesize
7.1MB

MD5
d764264518e77cc546a5876c3bcebad4

SHA1
ea17d45b396fa193a851bfd345e2b2c20ad60e12

SHA256
e78492de0ab575add50b925bfd44216d224d09904a9b14c17087a92fdcbc15cd

SHA512
7cf132ea5254a55c08186ffcf5e47360ef5ddd57d03d7051171f6753b22e3925304d183c2037bfd320ad56c08e079f9b2c4640db8cb3dbd38ff500c7a39e997f

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
1.6MB

MD5
3e654318b9c1203beb7f4aefb2f6d839

SHA1
5b147ca8d77e4985298c63d0ed09a217149fe665

SHA256
2cdb8a21456df3dbc46c23460be079bf285b1352bd6b131f572d4cb52bacf252

SHA512
0cde534c2f0d350c21b1ac994c9530e9692c9738921393c9c61ca7e1af8d8587fae7b8bfa1038fead9a630c0fc0a257967a962cbb55c6bfa776162b3b6678e6a

Download Submit
C:\Program Files (x86)\Steam\bin\audio.dll

Filesize
183KB

MD5
bc83f9686398c71c4c574a408aae7dc9

SHA1
f11656e4faaad6d5c3a3c9d9f282352cee63d4e0

SHA256
7115452974e926c0358b04d24ddf061ad39bba4fe97287fdaec836fb9fdad297

SHA512
432cc5ed06a906c753b94e85033b8b4d7d0ef7277c58659df7a504d9bf2644c6a284ef75748d24f66dd515d19156c0212e9afb3dea7554a9e8ecb7e2288192e4

Download Submit
C:\Program Files (x86)\Steam\bin\chromehtml.dll

Filesize
1.4MB

MD5
402b256302979c23697675744d0d9928

SHA1
a9b9af0efb89ec55cf9993226acd69daa557fcca

SHA256
ed5c3bc27b61cecbb55a7a71bbdd8d22c55c3da1102af1ea0af9de0444c77bf7

SHA512
a5131fdef028cfa76d517b4d9fb4cade0e2226693f5ca4c93ed75b24064492ec87a65f091e617a4d333cff44d68406bee75edda4947d5cabe502267b54e9c54e

Download Submit
C:\Program Files (x86)\Steam\bin\drivers.exe

Filesize
7.2MB

MD5
ef801f4408581f653cfbebc626497efd

SHA1
dd5567e76186cb3ee562326da4a948724b49ba77

SHA256
ab5830db258a4857abca8c999ddc8562ac1a1f1a1d27af758be1d11c08e9dce3

SHA512
c152af5fd8b3b243d68f3db69711e03238fa96f3152095b985d47ab5da1d751eefbf45649dde4b52fb64788a2b29452a1ad5eb26268ec4f617e4cbbc0ea4e067

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
6e6a2b18264504cc084caa3ad0bfc6ae

SHA1
b177d719bd3c1bc547d5c97937a584b8b7d57196

SHA256
f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

SHA512
74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf~RFe5a134b.TMP

Filesize
184B

MD5
3cdebc58a05cdd75f14e64fb0d971370

SHA1
edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe

SHA256
661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7

SHA512
289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

Download Submit
C:\Program Files (x86)\Steam\crashhandler.dll

Filesize
347KB

MD5
8a181eb1ea07abb3919d7c3d90393410

SHA1
8a21841c78c2402339570b79d8fed8f1dc600633

SHA256
468f40c0e25b884584ccb97deddf4d519ff519e6c02d41de11f98733772bf62d

SHA512
59bdb6d023b4a3d196644b46eb6ab303851c5a647c3b8e0c7ad4373f6154f36fd5762cdf843fc7bd6e970515cbf53b828be9b85521dc8c736426d0d1c89e98ac

Download Submit
C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

Filesize
18KB

MD5
2d8fa34c84537d4d107115947f6cf261

SHA1
9890291c7ad073d9aba3dbe8b43d72d3de56f0fa

SHA256
69db988338420b7810b49e0c24a6a79e27d4b279aa29fedf4f36b31359d977b6

SHA512
96f3125df9fb3392f0a0483e941399e90baf670770dd121f8acef529ba04a922ca5ebc7eb357a24468872692c08297db5c6b2fdd7c87bfb5c4bab51d974b3673

Download Submit
C:\Program Files (x86)\Steam\package\bins_codecs_win32.zip.vz.3000ad5fcbb54e75449390a364f797b531a3a474_5615812

Filesize
5.4MB

MD5
07b152db13b0b0b3707a56b03d4072f7

SHA1
3000ad5fcbb54e75449390a364f797b531a3a474

SHA256
993111c0025f9dd8c88f5ecfb3431c5939c5d88b87e567597f8debdbf347f2a8

SHA512
cd8e691a8512c7f7a8a2345eeed7df90c801a98753cf07adaadb8d7afc31a6d683309c5cdceda76e31809e6be539838fed00cd3ab25af3605054d31a16d8f488

Download Submit
C:\Program Files (x86)\Steam\package\bins_misc_win32.zip.vz.8418fddfe3c7dc8b1ecacd1d80d5416ad8a36e7e_10740491

Filesize
10.2MB

MD5
873110ea59beaa0e94399d757d834dba

SHA1
8418fddfe3c7dc8b1ecacd1d80d5416ad8a36e7e

SHA256
68227a80adf90fc4179144a1092297c3aa907f2d63f1ec4de696b3a2767e9e23

SHA512
bb25e73fbe8c98f84c59fef71d1c148587f479189b528b46d76450783ee9e20fd1af81b5f78992f0553e043809eac7ee0e695296e94470d3492f1569a57870d4

Download Submit
C:\Program Files (x86)\Steam\package\bins_win32.zip.vz.cc171ecaa100c8dc330ec357e34a53afbbd81e38_28580966

Filesize
27.3MB

MD5
2e3fdfdb1c048060ceb76f6187f1fef2

SHA1
cc171ecaa100c8dc330ec357e34a53afbbd81e38

SHA256
abf47ce45b722210a75098c2d32412474159b53a7ec302f7c211c116aff33ebe

SHA512
6de7e958549c020ba3c9258a3cec968840da8e0333cc924d896fd772f17688e93ced8af1378c2c2883c27a0a0cfd9a85ad21da5a3efb208711c69ae8783b83bd

Download Submit
C:\Program Files (x86)\Steam\package\public_all.zip.vz.9278fb89cc7d24f86341f1398ae3c7d578e4148c_23328700

Filesize
22.2MB

MD5
2ce270f2d636b82e24a136958fb11144

SHA1
9278fb89cc7d24f86341f1398ae3c7d578e4148c

SHA256
d87d7160720c974979ab8a84862bb982834c8add3eccf9790dccda9d952a0dae

SHA512
e226509ffbff403c7ec3b9160dd2d0ae7014660417e5212624087e0d61fe8163b49b59951a1fa8ce90c674bd881c64a3792e6a45c0c3b443bf3e584ebd91d436

Download Submit
C:\Program Files (x86)\Steam\package\resources_all.zip.vz.3c8b3203e5c69d75ea0684c2409b86fe4d0d6f83_2856188

Filesize
2.7MB

MD5
fe163eba99df9a4ddcce37613ccb648f

SHA1
3c8b3203e5c69d75ea0684c2409b86fe4d0d6f83

SHA256
2dcce4e5888c857fbb7d931f2d03c134abba0f024edde20244477012c5994ddd

SHA512
0e7b7495aa83921ff1bb939d526a2f46f1954229e0de9c02afcd33f5566420b06a3c68299f334141e6fa96ded3ba93b24ffda0a9b36e03e700dae84e4ea3fde7

Download Submit
C:\Program Files (x86)\Steam\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342

Filesize
55KB

MD5
a207adc9a20f0a199494a0be559f423f

SHA1
3de815c3117712cb9eeb7ea4c8b275faf481dcfd

SHA256
e9cfba9af633e9d216a0cde97b1177d4cbca2a1aca7e83aaf38655dbd9be4b7d

SHA512
7ae69b616f5a581fa483f4cb02f41d4010896866f28ea3e8b024f1fc917718f0a26f59baee13e27b617ce35e444f401278a6f8ebb8611e9aa9dc100d984716c9

Download Submit
C:\Program Files (x86)\Steam\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876

Filesize
2.1MB

MD5
aa34041580654fb4136750fcbb4be63a

SHA1
e86a975545f3ab21a77373870cb311ef93934b8c

SHA256
5e9ca0aac16b4d5caa2ac77ab2ce239e8dbcabe5ba6f0565112239ebb127ab2b

SHA512
fbca612cb005f70057840af54a99f9f1327ad27c53bf7c0ff49a397b11493d6f3ec25f43a11c4dd5660bc029f6cdf5984eb8910fd9385351798c7cc65fe46fe0

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.installed

Filesize
461KB

MD5
021e3f7056a9d5c63364d0815aae01e5

SHA1
ac822be3032c15d156e5b464e0815ddcb9918586

SHA256
788faf2c9914a0fc2958f4d31bf505bd7b54897b45c67f6d87875009d7cd4f88

SHA512
3889fda6989d046aeb52b7c41f24fb3b14c93450cb4062869cf3192d634fee3710288eca2f900ff9bf11d2012d9649d3afcb73069d71c5e505dedd8466946111

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.manifest

Filesize
8KB

MD5
fe5170d0df394c0f68f44b56c5dd9954

SHA1
bd8b3761e204f4190120a2d0ba8111fa6d4b8007

SHA256
d9128bf6e56002320a8fde94681a3a4614b44a960d4b2578571deeac0b6a9aeb

SHA512
a91b3bc4d2dc3b258c5e12f946fcc2a1fb3f5d55d720c4b000c2c1a78c0f6497611ccc8c5d0d3ef2c6f96a933b0fb09c85acdc46acb47af31d143081811a4ce7

Download Submit
C:\Program Files (x86)\Steam\package\steam_win32_steamrow.zip.vz.9c50872ffc9ecd5ebbc256b24226f7aad5af9c12_1810681

Filesize
1.7MB

MD5
83504c156d50dac1602754564e487855

SHA1
9c50872ffc9ecd5ebbc256b24226f7aad5af9c12

SHA256
9499dc5f31316812bd2b046cda2bc22ee533a1573d316887bb48d10d1180c6be

SHA512
7fa3cca09bdd4ce7d84694807d191bc56b9033f986a010cca837fc546d1b67f417548dc5c032e5481c5a609e9776a70a79d804260cc65188df478424a6d11eb3

Download Submit
C:\Program Files (x86)\Steam\package\steamui_websrc_all.zip.vz.1e4d6be476cd43a361c600932f15e441d4d42512_24875485

Filesize
23.7MB

MD5
3b7128f6ed6ee7f186ffd61c937fae55

SHA1
1e4d6be476cd43a361c600932f15e441d4d42512

SHA256
debc0eec42b6b6c185986c246ca6bc5453eaa6174d332474b21923bdb1ce58f3

SHA512
50f07e9604fde11c4ae3f8a7d82735fc624974a69a3a0caf0982038a48b8e113492761a86f16c69add38aae8078775082c3620e01919918f0e03c3d23f71acec

Download Submit
C:\Program Files (x86)\Steam\package\steamui_websrc_movies_all.zip.4d2183b0476852dfb695b8d70192a0ccece8c7d0

Filesize
7.2MB

MD5
9a91f0809ea36c6006822c940f070f7a

SHA1
4d2183b0476852dfb695b8d70192a0ccece8c7d0

SHA256
8097700c88b888ae09506d3150116a318ee4577242327a142422e129b7194033

SHA512
fbf5b6a0baba088d67ec5be8e6633c53be0d8d742da35801e6d33b4345c08b18c8289bb1dd3a4f52bd7616919b16ef4be0d239235b2ff9f1591556c8fa5c7f78

Download Submit
C:\Program Files (x86)\Steam\package\steamui_websrc_sounds_all.zip.vz.a2b25775b33d943e54c45d176558de379111ef5f_3220470

Filesize
3.1MB

MD5
413cbb900e31c49de33221f5ff8d08d9

SHA1
a2b25775b33d943e54c45d176558de379111ef5f

SHA256
6779c1a758435a0f926a66137f6a57d1e6fac14281f92209cd70d5818a598878

SHA512
31f6377b3b3cfc94d440071714980c75326c15896eeef189c0ab419b8d20d0d153c03556943711b2cd6ad10da700cfa3e28d9bd48f793d81ffd7becd4ffb8c8d

Download Submit
C:\Program Files (x86)\Steam\package\strings_all.zip.vz.c904f95b8996c66336305408448b8bede03956d6_2006928

Filesize
1.9MB

MD5
c5dd7737501e2487e655628eabf83faa

SHA1
c904f95b8996c66336305408448b8bede03956d6

SHA256
4548f9f2ec3ce6f7d412a8c86aac74a06fff1f7aed74ff0c6a3e8fa8c7fef592

SHA512
bb4dd1e3dc7ebd9c59b3ba2f0a0827eb21489df764c89c2aa028d1c14b1820d953ec920d540fb3e86c2b8cc8e3af1b8c145decffbb20e9849a7b2380fe5dfca3

Download Submit
C:\Program Files (x86)\Steam\package\strings_en_all.zip.147798246441b35c9a4dbdeecef8d6c4ffda4346

Filesize
110KB

MD5
33fa5979b12ca698fad11e2ad7f5999b

SHA1
147798246441b35c9a4dbdeecef8d6c4ffda4346

SHA256
bb6a1bee1a2f76a366a5dcb426be87da6198ad175e4bd555a4470d75e8042c44

SHA512
bae993585e8ba1cf3a9169d2e4cb56db17476717e3ebb8c3be72c345a307491fe31378c4c49f87708c3f6eb04745edecf91627f5b83f91d537165686af032bbf

Download Submit
C:\Program Files (x86)\Steam\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671

Filesize
5.3MB

MD5
ce671311034f93e30eef0e0998d15285

SHA1
193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7

SHA256
e1fee3beffa9d08a415a35ddc7d3141af6c44269c67e67aa0a3eea6e56889bd7

SHA512
25a0719450fbfbf09b1bd4e525e696e8f72c673cc0909bd196cc3fed823e7b0822f062dbd2855c6c2ac6e465232586da64abccf84e9976e02cea3b016a45a1c3

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOffBottom.tga_

Filesize
444B

MD5
89cb2bc5ccdab01b0653d4dbb3d6a062

SHA1
afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9

SHA256
ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9

SHA512
e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
6KB

MD5
5a5715177822e69c98aab578421ae78f

SHA1
175ea27d6ef6df27fae93a724c94b2c770f78205

SHA256
5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f

SHA512
b11d05dff7f9ce55c2b30de82709f5aa9b410734e1b88a6879e3489394a5b36a27389022de0a741a16f70d0639439d4f75942c3fd604567d63b9ec229d86b331

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_

Filesize
14KB

MD5
c4e538289a4c12da96cec77e7a3e36d8

SHA1
12d57144c0e79edbabc8033a9bf22b1720299f2f

SHA256
c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3

SHA512
db3eac8c05b7277a6ab9974c682b20350705fcf616040204bab053d98cf193c2d6fc416eb571ca67f7e53bda59ccaddc0351bf60310a64dba2d83fd9aa539ab1

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
92KB

MD5
323181f4e9013b8b341897abd322e56c

SHA1
85e2e4a5d38c515185415bd4aa8d24f32d428fa2

SHA256
e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab

SHA512
24fc5c82e25f2ee689b0888c6905f13ae74037e8db06a39b247d525071c858e8a284600dc5e33f006a2657d04c0b045c146c2af0951c7ecdceec34082a95d004

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdBottom.tga_

Filesize
48B

MD5
bd64c051ae2410eef96839a3cb7297f7

SHA1
95a5b0455d69127fe50e396153c795d9914ce0d4

SHA256
5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84

SHA512
ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793

Download Submit
C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync.ico_

Filesize
47KB

MD5
da277b7a17374bde018ffab02015238b

SHA1
ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd

SHA256
5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449

SHA512
5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53

Download Submit
C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync_posix.tga_

Filesize
64KB

MD5
be3a210738638c4f33aa7e01cb475e26

SHA1
02276a10cd77cfd57e4c796c45d69d526f8420bd

SHA256
fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8

SHA512
6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb

Download Submit
C:\Program Files (x86)\Steam\package\tmp\public\steam_tray.tga_

Filesize
1KB

MD5
7ecf5b072a3c49209af4710481dff5c9

SHA1
6b49560eb27b2d7cd169c066208d4fd3a4863f3b

SHA256
f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6

SHA512
ec9ed9d824471655a48b48324a023a7231560810f6403f0ded04af35b51dde4dcd244bd4147570ac9c5cf0c841af33caaf8de7d60cf20f6fcbedbd1717d6d262

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_schinese.txt.gz_

Filesize
33B

MD5
dd542d7ca2128ef0e7c3411b5ab9e8d3

SHA1
0a98ce0efdb5fd75d3c697f06f3c084d5882dc49

SHA256
77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b

SHA512
0d0c1801d0bdf69d2010b0e26ce0a156fa50baaa0370330bdcdb879cbd09a6146d7bc89de2d5ea6f3615123a60e1be87def44c07f92de24615974e3cae2cab85

Download Submit
C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_green.tga_

Filesize
2.1MB

MD5
1ed17a7d11da47608f99d98a8d249e6f

SHA1
ea3d9e0de541be2a346e93e63286f0265ac302fc

SHA256
a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427

SHA512
e423be766c3d615dee6f3ed8b0b7bb5735ec13617a93f6f5403a3e7c4c379b9ab87e9fd5f0c9fa9338f656e321488d0aba895ac9f77da413e27473b2218b9ac7

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
7KB

MD5
0fad7d2f29c625003ff68e645593f27e

SHA1
6d0d40c62d68ba1fa54239db61a98ae75d615a98

SHA256
e4149f2d2e2fe362241717e161838e6177a1ccc522e1b95746fbd7d05bb0749f

SHA512
3ed6b85098fc71bde283e6462d483a05ea217387b3de0fbbefedad1b81ba1f71ab42d35462eb836dbcde06f05ba2da14a6283fddf45ce7fc58d1b7b1f8ba5801

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
9KB

MD5
84abaf1ca4bf7372acdc9f89d3b7592d

SHA1
e73b80ccb67610c4b2cfc1d7c308c836bc7ea08c

SHA256
8dd4d81cb374750de3d3df6ffd0cc238ec5d1e3946dfef4b4c8380bdd832d0fd

SHA512
a572f29bb203e590a3745c28084b20134b2e5159ce04b9177c4aa371f0b184e60c07d2bb39c1692d6040338014be77ae0464e31de40ffadc84808463aa9ddc70

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
7KB

MD5
b02ddd5e3b43e43ee9e51e13968b7a21

SHA1
38e224214aca0cd6931cbe72035bc912d0403f41

SHA256
81a445a3ceb495564829cc7b0280fa993974b33476b85edcdf87f738ca82705b

SHA512
7a9b46a45dcb871dc81a5c316464e3f13f51a877003cab53b811ab6fa7fa5e69b867ddc4dc2228052558bcedc2b5c5437856c9fc53f290c4e74192b13b275209

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
7KB

MD5
d01a820b7be78e208952a7bdea47e2a8

SHA1
170d1c12223470ffbc0b1e7c2cfd1edeec30cc7d

SHA256
a6ce02cd2a342a2e2e60b42b18417b006c681cf233877b51b59db44aea0ed620

SHA512
30e26e5341734070206c6058a66b1fc5e055dce8bb002ea37ee417eea30c49633cf13769f553f66a532a6398d071b2b79ee6e5199b6b8b9cc7af6b2aebd718ad

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
7KB

MD5
a24b4785c1da9b9838cca95099f973de

SHA1
73567a621fade953c308ac405a0bd9d0fc9bde08

SHA256
9c7b92b27cadcfe7ad1f47764cda4d6f5d9c64e30507463c277581e580858a43

SHA512
1b4dafe6a2ae68bb9469f1aaf20beb0b66aa3f1d0c8d548ff483fa30d1b419f75dbac2608a8dbc393e0e7dd84b72470e7146a3b518666f3cf9d6f952f912c8b2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
27993eb75894ca4894db266ad9b5e61b

SHA1
4def653ee04b0514822b690052598435ec25e686

SHA256
fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b

SHA512
eaebeee5b1a7dfb9bdf661623554793d7ef7e15d9f9cf01f94da1eb0b84b88c8f24176463d15c407ebf670c5b7fd4052daea33ba43e75c1de2979487c4987bab

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
3KB

MD5
6df4e3ebc6d7c96fe41c4c5213f17efa

SHA1
4dc2b996f828c1a1568a0f3a3fdfcbe5ca2fba2e

SHA256
6387f9aff0226a5226d5d4f0fbe77ac80797ca621f0892034f38f0bf2370e4e1

SHA512
e5eca80531c70d8c4ec7032885151dbc4072fa4a914a997796db8b62fcd27a42349987cd176bc5cc9ebf788ddcb125578b2306c02c1b27d44ac2dae0e2725aea

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
7KB

MD5
537fd7e53fd7c2c0bb5a2b26a0bf8867

SHA1
07d833c88ee67699c2d50cab18449621a545fed5

SHA256
fae3118f870c1adb564f641fee63ca1334a0f65213b16201511b343bbdaac544

SHA512
680b91571493813092f1b98e1ed03abe7f18af9639c7b3a2cc74ba968395994a96bcd9368020bf65f55729bb60214a676e27d6aa0bfb32de6b276499882e10ca

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
7KB

MD5
0182a05cf3aa48b0df12d899ee137ebd

SHA1
78ffdef2199e40fddfa253ff981c0602ae595b30

SHA256
46ce11c8add1fc89abe663b42a18e24c11ff8377a2ed2a4c35e835bb696701e1

SHA512
239e988e0020f4c3aec78932f865e1c7c21f68426e661e32386619b990b343065b46e023857c73f07d0c00410eedd5607427b67f32d483ced0b1be4a94778d1d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
7KB

MD5
825465df8bd77c7e0aeb03736d1096c2

SHA1
c716ef125e014136ae3817babffc2b7de91b99da

SHA256
6925960062dce683a30621506b4da178054df17144fb18fff387230d561c46d1

SHA512
acaa8d94eb99835db1dce248c490049df26b31ce843d53f0d8afc8615930e0f0273a9baaabb02095510fbb01f984baca5897dd48fda33cdd6254b0a2afc963b0

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
8KB

MD5
8bfaf948d2a968637202cfa810f6ff44

SHA1
d5c8f7c7ed891a7639148a91139fff69042785c6

SHA256
98205d4543eb8ea31dd97d6596d6d495b8b077c34ab3d2e525cdd3fd801f06be

SHA512
594e4f81f5037731b7e67b6b9232bab23a6318a155f2e587d7352fbb3ebf84785a7b8dc3856b3db2d8f6c94285bdec5596a9433a6aac54c03890183b2abb939b

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
7KB

MD5
9f40b6b09785b41f1518c86e1101dcf3

SHA1
db36e656fc7487504f5ae8ddc3a33d34b278512b

SHA256
82d9da0c4f4f1971ad133e61238c4dbd946b9a58e766efd36a949f975b96ed8d

SHA512
66d3746e6be2b96041e7b95ae955b1bc052476752106062e26c241d3198da9e3631c7346dc5140f772dd61ffd3291b6e6ec787b09061c2f41f9c5b8cdd8cea1e

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
7KB

MD5
153ab0f90e90e2db5d89d5223fa23d28

SHA1
ff009664e4e9982639c488fe9a3750e58caa1ae3

SHA256
f79ec156b7a205a8b34714fa32b1d5f7523cf738daf8b216100cb2cfe8489396

SHA512
da816b48f2489b1f0438253fb200e2b80fbb093491ea591d91c7677500ed71d23bc71eed93f4545b6cfa4ca2e37353c4d12ac2dc6c741b2641adba0e9b90b7f3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
8KB

MD5
9c00f0cf5f52c9b6e1288abed68219b2

SHA1
f2381506a01c2d08532554de368be68b37c1bc05

SHA256
3e3cd5b49164d7fbfb16e1b0896955f2a8c50e1b1a0264f5b542df5be60d22ed

SHA512
ff92c247002cacd3c1b246320987ecdb398fce4bc84c2a26c2bf1c6d588b19d3f5a5a3c64655ae559aa0a369dc7470cde1a6e192c9185567e993c9222a1e49d4

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
7KB

MD5
ee823b913cae33aace5bde417e748c47

SHA1
f8c733ed0324898cbacff1920a86b99595f3736c

SHA256
b2b890baf9241a1e49adf9ba78bc70870265dbbc87d9523b47fa82da5238304d

SHA512
552a803802619039cc09e339f36708a3cbf78e16d1002c5e83522e6eaea10c04896d28d4b602b2226abc1cffb7f3fe96a68a2414c367a02729e573bcc0884894

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
7KB

MD5
845a648a8042cbca41977824a4356feb

SHA1
05bcedd9ef743f92ec8563247f9e3c269fea1e88

SHA256
80ae7f593db16f9d5d33b75d19d43f3f3bbf0cfe017fdb0148c0eecb0aac0232

SHA512
9860ece0ee2221e463356c2c578c2df429f20c6ae56c475f9bb9999ed69ebd611ed101de2a054c495ea4e3bfb9184542f47968e80ed07f8a29e8186808fe89aa

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
7KB

MD5
d0d360beca051a6150c638c814111884

SHA1
dfa0c223ff598095f1cd3b1bb31045c9474ee28f

SHA256
361fd526dee6c2f56084b6ca6079ca4ff1a52eea5878293d5dbcd8f7d6e9e2f1

SHA512
e92fe0abeaa21f662685658d1c4a02d50187d3fc55982567a8e39582ee1fbab57201bfa891bca6e76bd674f6daa51aa4fd5952f1e6a1d677fe6f0499e7f54909

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
7KB

MD5
4a32371d0b6a48d7a43e5c1dec5c4f6c

SHA1
b51c36fabf2f605b7c69c42d03124d6b3172daa7

SHA256
cf9bbc83e6e80f288abce4b16f10d1bec89d7116695076a81150ee6578a53e37

SHA512
03617a9c386961f6ba05d922b708181117095fe342b5fd753278bcc7b91cf839135c7c9760040e707dc95cb5997bfe2e0c344b0b2be4def1c8d82ce1c068d67a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
7KB

MD5
35f63d2eaf9c5031e0c38849e5e2846e

SHA1
150c6ec4f686f2611133a9451b829be2298d4235

SHA256
c1ae90b2b0eb2b6c0bdd18ee480ad8a55d48973f70577c7c6b387330b3aec0aa

SHA512
aa7508905f91ff69e1b9cdf16375309b038b0e864a04f0d1af19f28e44a0f31463202560f078b14eb61c88997dc540073c90a3bf5751a2fdeb7f065cf4327982

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
8KB

MD5
71ad4a77bc487de7bad27a795a1d1523

SHA1
c179512988d6c241e4867a4725c448232208f8ef

SHA256
5afefcfa874796394cecf88dc82e6efbbb8c5d7c0337309b253494856c384659

SHA512
6ed41c9066fc433df7d96b9b9a38a5b170621eda3f84a0cf3f9b1f3e964cf510845e4bbcd07e73d404959ca213e35a90d443793fedaacf65b06e74f1878072ad

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
7KB

MD5
d8f7880a0ab573162d50fd41e7ede586

SHA1
7791ac9ffcfb3a4d78c362b0df78903f8380d7e1

SHA256
dc70b1acce126b30f4dc246444e0e599aa3c5285136a62d9636514d4e2db479f

SHA512
f1f5753a665e96b5bb00fec95986483c880516701993bde8be9111e093816863be0881ffd78c01811bf84bd50de00827340cd470629b4ea700ad614d996804d6

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
7KB

MD5
3b5f0ab6990fb39fa4215c4b55f7d8fc

SHA1
c9f2ae1fb72edbf42193da053a3afff4cf8daf6e

SHA256
278eecab7d6d7c8639f0114c382343067f19288fe0cd2778bbc9b3cec50d7da3

SHA512
3a94a213e3ca3ff0e4f0fa7e5108064e23011bb6e5d19a4581c901bdea31f3780a092f93bbf1059a91a73929728066ecb855dff402f2de5b8b514afbd446131f

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
7KB

MD5
47ec6fb3d98e01976d7aa81658789f6e

SHA1
dd0843152cfa3a6423852bab804c41fd9065a6fd

SHA256
c8a63c827f343a5851a9ceb352e2cb9d3ffe16797390c132c0951c53be1a91ed

SHA512
f41a40852ee05920165eec44fe8d69a9fddd6bc79f094a61ce33477d02088c8c051c7b636624d76d8f0d269e29fc3875c3de1557e0520b7189df47e6e32f6cc2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
7KB

MD5
b076ad87c690eeab567e54c0b8db299b

SHA1
56a60078bc7926702fc2ff2b98f688160d3ae0ae

SHA256
ce35fcd84c8f2b288de110dc74e45544a9b61bef98d29612518a41a4ee7b6d30

SHA512
b89b49c0d086aeb7ad7d2dcd43fd646eda47cd0dfef35f37610c0e3e7449fdfd4feebe6322174e08361521cb872ea1f9c6de53a81fa9af707f2aa8a7049a51e6

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
9KB

MD5
1720daf2627ef4ad6626997665c74502

SHA1
2014ca6ab6473a9b2b95607189312e83aa493d09

SHA256
8eccfed053ba4881b6cd3ea518004ac98820eb6f049d9148fd74492d63d75095

SHA512
56808e7a542c6a414eabc2170846b6c4f13a3b54e1f73faa912d65c523b9fe7b5d36be9a6a81354a9329d4d70cc8d396c7bc9777c264dd7aa462328600e0a0e5

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
7KB

MD5
cc1a9b06de02d14dc28b5cb12fb805ad

SHA1
a2f2fd523ccb73833e41319a1305a26c82ee2e36

SHA256
70ddc7e39868e07b3737e648e279888865e8942c5736e7208d77597f96d8182b

SHA512
3aa0eb54a639032842f08f7a4a7dd933154f98ee84ca73b4d2cdb4e038a4a429b7307cfa4e1ce078318ff21710997e4d3311e5abd78caa000d1b130aa4ed9d12

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Filesize
8KB

MD5
f2ae05cc88dc6d7bc8e0e29a7622312e

SHA1
64366791878efac86ef7b5a4bea10a20daee45fa

SHA256
d1b6f19d7442784e3ea222e9506f0a45a9e981268a7035898d6c0e86932d3b9c

SHA512
309fa304e1b806fc17c2eceb97426b782c0194b607de4b1956b2bf2b0dfe3200cf39c077f349721f27811a978e44cad0fdba83e54672ee6c4d6bdc5106e1ce94

Download Submit
C:\Program Files (x86)\Steam\steam.exe

Filesize
4.2MB

MD5
d3484bb0997b56404bdc05122c8193fa

SHA1
fa96d4613a4865830e608093eb83b8eb8be8482a

SHA256
f5c97342e82c944e810094bc1097201f1bd41c64ba615aa3d68f7a9543a6d2a0

SHA512
157deb211acf9a0c2db0d392f2442889aec05aa90de3e08ebae6b784e12bbe4d4a20d187b085656410024f66609e2bac7449f6605c02249e57ce8d9ad8f165ab

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\temp-index

Filesize
48B

MD5
eaabdc0c955564fc331448dbfcd4b83c

SHA1
89e50af02afc6681e69f252e594ec2398e78702d

SHA256
f4af764406ed45081486006a262b84671dea72ed2ef8f5456afa113052a9eb97

SHA512
158ad16f0335b34110cb5a5cc9d1b868a9d961ff3891f1c2a1cf90d3d8847646cd4455c70325aeac4b7e8b188ce5d30855ebdc47dc662494fcd33d6c2f447742

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCC3B.tmp\StdUtils.dll

Filesize
99KB

MD5
98a4efba4e4b566dc3d93d2d9bfcab58

SHA1
8c54ae9fcec30b2beea8b6af4ead0a76d634a536

SHA256
e2ad7736209d62909a356248fce8e554093339b18ef3e6a989a3c278f177ad48

SHA512
2dbc9a71e666ebf782607d3ca108fd47aa6bce1d0ac2a19183cc5187dd342307b64cb88906369784518922a54ac20f408d5a58f77c0ed410e2ccf98e4e9e39a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCC3B.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCC3B.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCC3B.tmp\nsDialogs.dll

Filesize
9KB

MD5
0d45588070cf728359055f776af16ec4

SHA1
c4375ceb2883dee74632e81addbfa4e8b0c6d84a

SHA256
067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

SHA512
751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCC3B.tmp\nsExec.dll

Filesize
6KB

MD5
c5b9fe538654a5a259cf64c2455c5426

SHA1
db45505fa041af025de53a0580758f3694b9444a

SHA256
7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7

SHA512
f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxCC3B.tmp\nsProcess.dll

Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
memory/464-12128-0x0000000000F30000-0x00000000012A0000-memory.dmp

Filesize
3.4MB

Download
memory/5544-24127-0x00000000001A0000-0x000000000065A000-memory.dmp

Filesize
4.7MB

Download
memory/14160-24169-0x00007FFDE8A60000-0x00007FFDE8A61000-memory.dmp

Filesize
4KB

Download
memory/14160-24168-0x00007FFDE7860000-0x00007FFDE7861000-memory.dmp

Filesize
4KB

Download