7af03f9f3e8d96c931d69b1ecd531ee976c6e504d678bbf44f553ffea8943291

Resubmissions

25-12-2024 14:03

241225-rcvsfavlhr 6

25-12-2024 14:01

241225-rb2jlavkez 3

Analysis

max time kernel
686s
max time network
686s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25-12-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SteamtoolsSetup.exe
Size

837KB
MD5

93ef55f275e12608889ba7c2e908e6d8
SHA1

969a31955b49a8bd82567fa582b3f29528ceb6f1
SHA256

7af03f9f3e8d96c931d69b1ecd531ee976c6e504d678bbf44f553ffea8943291
SHA512

fa3dfb36608777a5942cc3ffdb5d1599efd0420dbd436def11d860312b6dff64af6d9c3022964c78eaf34c3173a8907a3b58e88fda8f83a4e8e4063287ba7c53
SSDEEP

12288:GkNPWVmcf59WoYuEfR9hdAPS/OaoKDXE65hBWeSjpb1Bs7+5oQEEeTX:GGhu27maoKD0jeIpfs7xQAT

Score

6^/10

steam defense_evasion discovery persistence phishing

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation	SteamtoolsSetup.exe

Detected potential entity reuse from brand STEAM.
phishing steam
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\resource\filter_banned_bulgarian.txt.gz_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\filter_banned_indonesian.txt.gz_	steam.exe
File created	C:\Program Files (x86)\Steam\appcache\librarycache\391460_icon.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_dpad_down.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_dpad_left_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_click_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_lt_soft.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_dpad_right_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_r1_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_l_left_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_gyro_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_l2_soft_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_l2_soft.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_dpad_right.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_topofqueue.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_button_square.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_button_y_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_rstick_touch_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0400.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0324.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\FriendsPanelLeftBG_Over.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\layout\layoutdebugdialog_details.layout_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_l1_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_rtrackpad_ring_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\xbox_lb.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\offline_tchinese.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_050_menu_0303.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\steamaudio.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_vr_happy_down.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_touch_doubletap_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0220.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\switch_controller_indonesian.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_left_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_touch_doubletap_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_l_swipe_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_button_select_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\userdata\1037371635\config\localconfig.vdf~RFe5d6a07.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\appcache\librarycache\436520_library_hero.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\library.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\grid_top_focus2.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_swipe_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\hp_m1_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\friendsui_koreana-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\icon_blank.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_button_x_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\appcache\librarycache\41005_icon.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_button_b.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_color_button_b.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\userdata\1037371635\config\localconfig.vdf~RFe5e3e10.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0130.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\new_tab.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_button_square_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_r_up_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\chord_apple.vdf_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_dpad_left.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\templates\controller_mobile_touch_wasd.vdf_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0409.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_110_social_0304.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\friendsui_portuguese-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\steamui_finnish-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\overlay_polish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_button_y_lg.png_	steam.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10392_1465671428\_platform_specific\win_x64\widevinecdm.dll.sig	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10392_1465671428\_platform_specific\win_x64\widevinecdm.dll	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10392_1465671428\LICENSE	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10392_1465671428\manifest.json	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10392_1465671428\_metadata\verified_contents.json	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10392_1465671428\manifest.fingerprint	steamwebhelper.exe

Executes dropped EXE 22 IoCs

pid	Process
5840	SteamSetup.exe
2112	steamservice.exe
1136	steam.exe
10244	steam.exe
10392	steamwebhelper.exe
10424	steamwebhelper.exe
11964	steamwebhelper.exe
11772	steamwebhelper.exe
11472	gldriverquery64.exe
11412	steamwebhelper.exe
11328	steamwebhelper.exe
10960	gldriverquery.exe
10884	vulkandriverquery64.exe
10816	vulkandriverquery.exe
13228	steamwebhelper.exe
13784	steamwebhelper.exe
14316	steamwebhelper.exe
17248	steamwebhelper.exe
17872	steamwebhelper.exe
19736	SteamtoolsSetup.exe
20136	Steamtools.exe
20436	steam.exe

Loads dropped DLL 64 IoCs

pid	Process
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10424	steamwebhelper.exe
10424	steamwebhelper.exe
10424	steamwebhelper.exe
11964	steamwebhelper.exe
11964	steamwebhelper.exe
11964	steamwebhelper.exe
10244	steam.exe
11964	steamwebhelper.exe
11964	steamwebhelper.exe
11964	steamwebhelper.exe
11964	steamwebhelper.exe
11964	steamwebhelper.exe
11964	steamwebhelper.exe
11772	steamwebhelper.exe
11772	steamwebhelper.exe
11772	steamwebhelper.exe
10244	steam.exe
10244	steam.exe
11412	steamwebhelper.exe
11412	steamwebhelper.exe
11412	steamwebhelper.exe
11328	steamwebhelper.exe
11328	steamwebhelper.exe
11328	steamwebhelper.exe
11328	steamwebhelper.exe
10244	steam.exe
13228	steamwebhelper.exe
13228	steamwebhelper.exe
13228	steamwebhelper.exe
13228	steamwebhelper.exe
13784	steamwebhelper.exe
13784	steamwebhelper.exe
13784	steamwebhelper.exe
13784	steamwebhelper.exe
14316	steamwebhelper.exe
14316	steamwebhelper.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\SteamtoolsSetup.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamtoolsSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamtoolsSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
19972	taskkill.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\ = "URL:steamlink protocol"	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\DefaultIcon	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\DefaultIcon	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\ = "URL:steam protocol"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\URL Protocol	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\URL Protocol	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\Shell\Open\Command	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\steam\Shell\Open\Command	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steam.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steam.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\SteamtoolsSetup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
20136	Steamtools.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
5840	SteamSetup.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
10244	steam.exe
20136	Steamtools.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	4144	firefox.exe
Token: SeDebugPrivilege	5840	SteamSetup.exe
Token: SeDebugPrivilege	5840	SteamSetup.exe
Token: SeDebugPrivilege	5840	SteamSetup.exe
Token: SeDebugPrivilege	5840	SteamSetup.exe
Token: SeDebugPrivilege	5840	SteamSetup.exe
Token: SeSecurityPrivilege	2112	steamservice.exe
Token: SeSecurityPrivilege	2112	steamservice.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	10392	steamwebhelper.exe
Token: SeShutdownPrivilege	10392	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10244	steam.exe
10244	steam.exe
10244	steam.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe
10392	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
5840	SteamSetup.exe
2112	steamservice.exe
10244	steam.exe
4144	firefox.exe
4144	firefox.exe
4144	firefox.exe
20136	Steamtools.exe
20136	Steamtools.exe
20136	Steamtools.exe
20136	Steamtools.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 3020 wrote to memory of 4144	3020	firefox.exe	92
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 2500	4144	firefox.exe	94
PID 4144 wrote to memory of 644	4144	firefox.exe	95
PID 4144 wrote to memory of 644	4144	firefox.exe	95
PID 4144 wrote to memory of 644	4144	firefox.exe	95
PID 4144 wrote to memory of 644	4144	firefox.exe	95
PID 4144 wrote to memory of 644	4144	firefox.exe	95
PID 4144 wrote to memory of 644	4144	firefox.exe	95
PID 4144 wrote to memory of 644	4144	firefox.exe	95
PID 4144 wrote to memory of 644	4144	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe
"C:\Users\Admin\AppData\Local\Temp\SteamtoolsSetup.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3284

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1868 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f02a90f-9fdc-46b2-8705-6a8f324075ec} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" gpu
    3⤵
    PID:2500
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2400 -prefMapHandle 2388 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e2e3ca3-30c7-443f-985d-534ca7c82ac8} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" socket
    3⤵
    PID:644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3040 -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2616 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {99936df1-86e2-4d9e-ac27-5218cebdeeb9} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:1900
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4068 -childID 2 -isForBrowser -prefsHandle 4060 -prefMapHandle 4032 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {587699d6-4317-413f-ae93-c1f78c7eed12} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:2916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4852 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4884 -prefMapHandle 4880 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2484e1fa-8a8a-40e7-94e4-a6812c66c01d} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" utility
    3⤵
    - Checks processor information in registry
    PID:3136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5256 -prefMapHandle 5252 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ef2c073-c3b5-4d5d-8062-36de1ea84447} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:5844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5536 -childID 4 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {931efde2-5edf-450c-96a6-308b47d6ebc0} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:5856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5656 -childID 5 -isForBrowser -prefsHandle 4700 -prefMapHandle 4668 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00d1bfca-c252-4a59-92df-8d93416e5506} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:5896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6108 -childID 6 -isForBrowser -prefsHandle 6128 -prefMapHandle 6124 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {246e586c-c0f7-4827-ba60-b2ed165f73af} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:4468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4312 -childID 7 -isForBrowser -prefsHandle 4248 -prefMapHandle 5068 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b68e3064-b480-4524-ab92-1bb52891f2d7} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:3704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4576 -parentBuildID 20240401114208 -prefsHandle 4740 -prefMapHandle 4420 -prefsLen 34632 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fa8fa64-5465-4568-aaef-396ba2df3120} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" rdd
    3⤵
    PID:5548
- - C:\Users\Admin\Downloads\SteamSetup.exe
    "C:\Users\Admin\Downloads\SteamSetup.exe"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5840
  - - C:\Program Files (x86)\Steam\bin\steamservice.exe
      "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6300 -childID 8 -isForBrowser -prefsHandle 6488 -prefMapHandle 1420 -prefsLen 35050 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d89e4af-7e03-4b8f-910c-61ec5af8f6c2} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7464 -childID 9 -isForBrowser -prefsHandle 7092 -prefMapHandle 7448 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45a7284a-ad6a-4703-bbf8-715f466334f9} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:3760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8220 -childID 10 -isForBrowser -prefsHandle 7976 -prefMapHandle 7896 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac2f1f5c-8338-4d9d-b1e9-23b5e43c1f95} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:1740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8432 -childID 11 -isForBrowser -prefsHandle 8440 -prefMapHandle 8444 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4578e49-26ce-4e07-8890-d4711435cd7c} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8660 -childID 12 -isForBrowser -prefsHandle 8420 -prefMapHandle 8520 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0065c1d-2d57-4484-b699-c30866f3a9e7} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5352 -childID 13 -isForBrowser -prefsHandle 5416 -prefMapHandle 5368 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adc6f55c-faa6-49e2-8c12-fdb9f8047519} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:24472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8444 -childID 14 -isForBrowser -prefsHandle 8632 -prefMapHandle 5376 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10467454-5552-4a5d-9223-24c5bddfedff} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:24484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7900 -childID 15 -isForBrowser -prefsHandle 8676 -prefMapHandle 7928 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1300 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c90e3a6-c222-42b9-adb9-66288215a54e} 4144 "\\.\pipe\gecko-crash-server-pipe.4144" tab
    3⤵
    PID:17396

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
PID:1136
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:10244
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=10244" "-buildid=1733265492" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:10392
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1733265492 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffd6571af00,0x7ffd6571af0c,0x7ffd6571af18
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:10424
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1584,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1588 --mojo-platform-channel-handle=1496 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:11964
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2364,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2368 --mojo-platform-channel-handle=2360 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:11772
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2720,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2724 --mojo-platform-channel-handle=2680 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:11412
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3200 --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:11328
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3916,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3920 --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:13228
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4100,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4104 --mojo-platform-channel-handle=3948 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:13784
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4268,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4468 --mojo-platform-channel-handle=4552 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:14316
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=4020,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4004 --mojo-platform-channel-handle=4016 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:17248
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4116,i,11611529232913166846,4882143764400874960,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4412 --mojo-platform-channel-handle=4712 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:17872
- - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:11472
- - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:10960
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:10884
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:10816

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x48c
1⤵
PID:11584

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:19552

C:\Users\Admin\Downloads\SteamtoolsSetup.exe
"C:\Users\Admin\Downloads\SteamtoolsSetup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:19736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /IM Steamtools.exe /F >nul 2>&1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:19956
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /IM Steamtools.exe /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:19972
- C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe
  "C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:20136
- - C:\program files (x86)\steam\steam.exe
    "C:\program files (x86)\steam\steam.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:20436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.2MB

MD5
33bcb1c8975a4063a134a72803e0ca16

SHA1
ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

SHA256
12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

SHA512
13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

Download Submit
C:\Program Files (x86)\Steam\aom.dll

Filesize
7.1MB

MD5
d764264518e77cc546a5876c3bcebad4

SHA1
ea17d45b396fa193a851bfd345e2b2c20ad60e12

SHA256
e78492de0ab575add50b925bfd44216d224d09904a9b14c17087a92fdcbc15cd

SHA512
7cf132ea5254a55c08186ffcf5e47360ef5ddd57d03d7051171f6753b22e3925304d183c2037bfd320ad56c08e079f9b2c4640db8cb3dbd38ff500c7a39e997f

Download Submit
C:\Program Files (x86)\Steam\appcache\librarycache\1161040_icon.jpg

Filesize
638B

MD5
7ecdaf8a54ec52b20640a88527512903

SHA1
3133a4d748ad3be61fe9db759339cd5de73339b5

SHA256
7bd8b75aec0a4d4a377f3ca3a023fd8b7c5fc7dc6a2a66d17f8cdfe5b731ab0c

SHA512
60ae2031eed0c38264f0d8db22a9b6efeb3f80c791e916e15a1730853162d56e0da014dbd93a5479bae4f3bdd5705ca89be70c90574a524abd1c276ed5c55a2d

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.5MB

MD5
ba0ea9249da4ab8f62432617489ae5a6

SHA1
d8873c5dcb6e128c39cf0c423b502821343659a7

SHA256
ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

SHA512
52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

Download Submit
C:\Program Files (x86)\Steam\bin\audio.dll

Filesize
183KB

MD5
63203b19d445107d45ad60e15c4dbf51

SHA1
0437eda1fa6acaea24dda0825982c4ed700205b8

SHA256
a02ebac018b3477e6d5c4f68672fb7bcfbcc19caff690447391eb5909067b6ac

SHA512
d13280fe2ff018bf324c58598cd40d7d290e0c3358d63ab1fc3dfc8f3cd3365e92cb971f808daf85f1e8e5cd5661a27a74e56b7e4b939842db6342a8a0eaacad

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\chrome_elf.dll

Filesize
1.3MB

MD5
0eeaea918f3603e5ff2bd955f9f0c0aa

SHA1
0404b3bd9324703a46d5f3e3d2471386951feee5

SHA256
3f49301338c33f40b3ca8528eaa40e9f7fc8f7952f59b8f4281ca5d3e1ddf25f

SHA512
0fa19dc76d28d449f2e96e4faf3ce57e7ad811b8888de2140152ba0355cc8d6ed787371ff90fbac0d1b0c900fcb1fd4ef1f45c8114b0f10ca5f97f05146ef945

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\d3dcompiler_47.dll

Filesize
4.7MB

MD5
c6c2fc1388f3d04c170417d733fcd52b

SHA1
fe74b15be9b5227cc3597471e4df0913b5acefb2

SHA256
8b575383ebaf641d7e29b85d010af232dfe008be800ec936d5b4d0c19ae47ca4

SHA512
e155cc3d0e1f1b2ad8992cc907c36923bcbce17cb53e731ea3d02e529bef11324219a86e461fbb6d0b9247d1638d14d558e083fdcdd2c6ef301160d00bc88fe7

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\dbgcore.dll

Filesize
211KB

MD5
e6bcc49fe10142480344ecf6f78f17f7

SHA1
fc8d3f1e85b2dc6934cbd4d2fb9250792eb991aa

SHA256
b4675afaff6fe2d9253a16e4bbeb376b0b4fdee087ce71419e11b78ca211ef2a

SHA512
9152d99fc8ab1a4a7f6d2f73fd3cde17c741620b42e7011fd4534315ce18ac12517846ee21f12327d6343e5c4f4a86d01e4b40a1ef1ffc803e4969f3629dfd36

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\dxcompiler.dll

Filesize
21.0MB

MD5
e3f531e75b63bcb3bbf8da1d5df8aa43

SHA1
9574e78e7ae36944687083923a9d09e15c593ebb

SHA256
fdf572f1b15982d6b6b0083026fad4a0352a5c99efe97f182e8ba72d682de610

SHA512
424fdc9da6518d5f269cf635aa66524161fa31771a8bc6dd91add826cdde9f0bed7879b259419c33a1d00155546d1a68aadc6a9acff32290b9543767dd04a9d3

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\dxil.dll

Filesize
1.4MB

MD5
8167a6e8cc35988d02938cfa3ae1c0dd

SHA1
1bb1b83c7dc957e074320b033aab83f015eb777b

SHA256
bf97fcfc4f107a98932ac6f9169d9fb936dbedaac5cc06005a87fae436b577cb

SHA512
bcb9e8fbc79c108ec525ec2a1d5d8bba7c2a295e39eabf48d8eba2095eeffcbb2a2b8f66219cda9786bae6a1fa6ff27f054f97ffa002957d16f2969018e62606

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\eventlog_provider.dll

Filesize
17KB

MD5
a73d3ef675f9a0840a4f08e71066f5b2

SHA1
bbe14a1ea609bf288a54b0299c74f8f8f66a1bab

SHA256
7359a29c5c6201c815ab3e58487f0f95617f766bd6cb2eda182dc8da5e058c8d

SHA512
30b34a9c91fd08f6f689271fc486e5a2d7f984f6bb0717aa68d4d1d8b58e3e18059cf24ff679893249f1b40d2514994a0b36143425e6dce02f1aee3751810958

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\libEGL.dll

Filesize
472KB

MD5
9a5749b691b3c345f4e313b06b127a94

SHA1
bad7c65d67e3d548e9ae757a7aa5bd5a079fd3b8

SHA256
682acd1cfa7390386d8cd8c8267e365ac0abbef1788587f8150b99e424e9b0e9

SHA512
4de9d18b4245105ea22520ee6b27cf7cb8f5ca0777408eb9993f4f97d1820582c6e3694e0142cdb373e8406e1117f568ae4f314b3027a0791d8866bd191b545f

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\libGLESv2.dll

Filesize
7.7MB

MD5
35f34351979e8aca52c09d674dde7345

SHA1
3fad78f021c78f8368823d6a26b81999d8b10ac9

SHA256
cdcd26fc7fc0c79b03726f66c235634f1a58de0ea2418281c157b9f05151f2ef

SHA512
5a1941c673d9fb101189e65bf3ca7d016baf0b75fd29ee2bbcb30270d27717c292b4c8ed08a646c022a87d94434cd29ef2719f8fc4388ef2be00b58f036f43d4

Download Submit
C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\msdia140.dll

Filesize
2.2MB

MD5
4aa30cedcc1b685865f518c70aa50bc7

SHA1
d457dd8fc0fdb1cc15879f7f09f2ffdcfbef8cba

SHA256
0b07dd35f63e959e25627ee7f439440bf59ce27b68eb2512eb68b8933cf734f2

SHA512
bef70d17dd68cd9060d1e4db9fe9a36ffccad5f2540a1e9587385d48484d021abc2e493397bc4284d40a44379be3c576a8244603388f20cfcd9e95d64f70adeb

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
15KB

MD5
71ac7717b82cb0aa000e5cbe4812acb0

SHA1
a67224906293a6c7002da43b034b0d96a63b756c

SHA256
90133338973a792ef35dd258b0b92f265fd445e3469c901890612add2c3621d2

SHA512
f2659d54c5fba7041f10bfdae31ae2f4a181b820905b350afbb537a4c687fd9ec4c5138b093d98b4883eaeb01aae5caba94b6be21526e90cff98041e2ab9bb6e

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
a2ec2e91c3ef8c42e22c4887d032b333

SHA1
e2c738a2e9400535b74e2263c7e7d1ecefe575f2

SHA256
8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

SHA512
b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf~RFe5c5953.TMP

Filesize
1KB

MD5
6e6a2b18264504cc084caa3ad0bfc6ae

SHA1
b177d719bd3c1bc547d5c97937a584b8b7d57196

SHA256
f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

SHA512
74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

Download Submit
C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe

Filesize
16.3MB

MD5
1a475aa5000d3958df447de17e0dc14b

SHA1
8a45a8a2b38a524633a99abc7994aa0ac46c03ce

SHA256
1208c4d240918ab0b4767bc6a5c0cbe83ee7f21408fb0c5ea68769ebea759b3e

SHA512
e86be352a5732d18db772f3fc80a70ebb223d68148057663ed18aab5c2221fe6d1cb48d4f4e22940419e9144aeacdc03ea05739352f86aed7ce967afd7e80911

Download Submit
C:\Program Files (x86)\Steam\crashhandler.dll

Filesize
347KB

MD5
7a93763803b9ea422e70015fcb23f981

SHA1
9765753a26e91b908acca2e88a3c1db9d57b2f53

SHA256
85b6c815533b6016062e3536eb04bbe0dfaed8e3c89eca8da1d586f12b780001

SHA512
0748982ce6f5db44c09e6f9a01ab343ec81adb775bf10ec1bcc84c51c7bc3710c165ec7286db587a4997815926b480f1c53a9b87f2762baa7b28ed4187a7396a

Download Submit
C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

Filesize
17KB

MD5
3595fa58c84427efbfadbb190ee9f226

SHA1
fd63622ca80cd1aa8fb15c9db394f8c9cced9c4f

SHA256
3726d94279c9932f31d92c214f4df2a801e5157bf6c006d807ace29b767631f6

SHA512
899f6940566070f174e2549e761a2c5cf88a26a18185619d93516dfee261b7fdf6daf77eaff67ba5401ce3162ff8ee4c434acca1fbf3fe8924e3a9208cdace39

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_metrics.bin

Filesize
2KB

MD5
287bde004c6a042d4529d3aa780e6f46

SHA1
5d405d6a742f3c62999631223063c4c7292cccf9

SHA256
2e796d0f2d2cc0b22f61675789be879691bb30cc47fc8f8829d7e454c7eee687

SHA512
ce025bfe692b5587f874e7de5595491146fb031144e3334612fb6f92ff2fdac6b21a90fb10cfefb86427666cc350c483f95c3af92ef14ee6592a28b6d49b7209

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.installed

Filesize
462KB

MD5
4521a6206cd321e2ab326d6afa9b363c

SHA1
461641c39fde053d494253e72ab2f22d84fabe50

SHA256
04d04c2c9b1d82949bb4d3724cc477a9e9a7f0873d4fe6fe9840ac3e0971ea24

SHA512
fe0bc85d077ba19584f6a02649c5b675efb8d0788a45c051aefc40b3120288abf68bd8cef7e62f35c2ceb21547c4aa7fba149441a66636d013821b18b4b3d5c8

Download Submit
C:\Program Files (x86)\Steam\package\steam_client_win32.manifest

Filesize
8KB

MD5
78079dd63939f7c2db1ae475b12cacb9

SHA1
a2dda051df71353b2fe2cd8600a6714650ee37ac

SHA256
529e2294203328f262b6fdc8a4b26077840aea72b8a1e752603ce8c625a1db77

SHA512
74d4f33c2eedada639378e9b32f1703cd67cede37dc4ce0dd733bfba9a6e6a63a3ff667c2a6616961c56c2900888288d7d2aa3070269ea6696771cdccc05b132

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
0340d1a0bbdb8f3017d2326f4e351e0a

SHA1
90d078e9f732794db5b0ffeb781a1f2ed2966139

SHA256
0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

SHA512
9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
4c81277a127e3d65fb5065f518ffe9c2

SHA1
253264b9b56e5bac0714d5be6cade09ae74c2a3a

SHA256
76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

SHA512
be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
2158881817b9163bf0fd4724d549aed4

SHA1
c500f2e8f47a11129114ee4f19524aee8fecc502

SHA256
650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

SHA512
f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
27993eb75894ca4894db266ad9b5e61b

SHA1
4def653ee04b0514822b690052598435ec25e686

SHA256
fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b

SHA512
eaebeee5b1a7dfb9bdf661623554793d7ef7e15d9f9cf01f94da1eb0b84b88c8f24176463d15c407ebf670c5b7fd4052daea33ba43e75c1de2979487c4987bab

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
9e62fc923c65bfc3f40aaf6ec4fd1010

SHA1
8f76faff18bd64696683c2a7a04d16aac1ef7e61

SHA256
8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

SHA512
c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
10c429eb58b4274af6b6ef08f376d46c

SHA1
af1e049ddb9f875c609b0f9a38651fc1867b50d3

SHA256
a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

SHA512
d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
5c026fd6072a7c5cf31c75818cddedec

SHA1
341aa1df1d034e6f0a7dff88d37c9f11a716cae6

SHA256
0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

SHA512
f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
189ba063d1481528cbd6e0c4afc3abaa

SHA1
40bdd169fcc59928c69eea74fd7e057096b33092

SHA256
c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

SHA512
ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

Filesize
4KB

MD5
1514d082b672b372cdfb8dd85c3437f1

SHA1
336a01192edb76ae6501d6974b3b6f0c05ea223a

SHA256
3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

SHA512
4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
202b825d0ef72096b82db255c4e747fa

SHA1
3a3265e5bbaa1d1b774195a3858f29cea75c9e75

SHA256
3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

SHA512
e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
58e0fcbee3cca4ef61b97928cfe89535

SHA1
1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

SHA256
c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

SHA512
99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
4KB

MD5
6367f43ea3780c4ee166454f5936b1a8

SHA1
027a2c24c8320458c49cd78053f586cb4d94ee6f

SHA256
f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

SHA512
31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
6KB

MD5
e04ad6c236b6c61fc53e2cb57ced87e8

SHA1
e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

SHA256
08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

SHA512
0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
4KB

MD5
56dcf7b68f70826262a6ffaffe6b1c49

SHA1
12e4272ba0e4eabc610670cdc6941f942da1eb6a

SHA256
948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

SHA512
c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
4KB

MD5
66456d2b1085446a9f2dbd9e4632754b

SHA1
8da6248b57e5c2970d853b8d21373772a34b1c28

SHA256
c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

SHA512
196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
4KB

MD5
b2248784049e1af0c690be2af13a4ef3

SHA1
aec7461fa46b7f6d00ff308aa9d19c39b934c595

SHA256
4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

SHA512
f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
4KB

MD5
194a73f900a3283da4caa6c09fefcb08

SHA1
a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

SHA256
5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

SHA512
25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
7KB

MD5
53f7e8ac1affb04bf132c2ca818eb01e

SHA1
bffc3e111761e4dc514c6398a07ffce8555697f6

SHA256
488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

SHA512
c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
4KB

MD5
29f9a5ab4adfae371bf980b82de2cb57

SHA1
6f7ef52a09b99868dd7230f513630ffe473eddf8

SHA256
711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

SHA512
543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Filesize
6KB

MD5
cadd7a2f359b22580bdd6281ea23744d

SHA1
e82e790a7561d0908aee8e3b1af97823e147f88b

SHA256
3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

SHA512
53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

Filesize
4KB

MD5
f350c8747d77777f456037184af9212c

SHA1
753d8c260b852a299df76c4f215b0d2215f6a723

SHA256
15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185

SHA512
efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

Download Submit
C:\Program Files (x86)\Steam\steam.exe

Filesize
4.2MB

MD5
4bf015883412d366a1423e51ea534a21

SHA1
e89e0e631edc7aa0cde78463e3b5a1250e3a976d

SHA256
b5d588810e2b68f8a92de74b9741e0120f130d1e079144d50951c54cc04ed72c

SHA512
3610e464336b85793da07de2dc9a4940936bc47314b0aeddd910f2558a7669249fb4d588fb29d3b862ebddc5e3cd2883fbccbde9c35ef7215c1c864525bfa4be

Download Submit
C:\Program Files (x86)\Steam\userdata\1037371635\7\remote\sharedconfig.vdf

Filesize
164B

MD5
beab8bd40622d6878f3e2be63a7c5fc3

SHA1
0df0ca1bbd41055a1ecf5f39c8d260ed726a0b19

SHA256
c116fa31200dbe1f5ed50c0a67ceeda8fc962af7986e0baec1c3c950efda1eef

SHA512
8ed3226d0372315883607105e16c358b9d1a79e0ffbab7f841d405e899942b8e3ad327757d16f9e94afec0abe8ed30b2417a4c9bccf800d36f1e860da2d8953b

Download Submit
C:\Program Files (x86)\Steam\userdata\1037371635\config\localconfig.vdf

Filesize
3KB

MD5
0a6d85d9853c7dc287de62fc89d69baf

SHA1
4f354da3de6461f6b193e80b1d210552f1f36bf2

SHA256
bb32496457c17387541f3244519c25b30ceadc54268dfa79033bb5f6de80c42a

SHA512
6c832c30029c26cac4c1a75e5c1af9f4e04e71e918bb9b86a095cb0283f018f798322343404b19a2647054753de4371ad9ec5c8e9f5bc57e1f7998a6b479c942

Download Submit
C:\Program Files (x86)\Steam\userdata\1037371635\config\localconfig.vdf

Filesize
3KB

MD5
57e04158ca32f32fdda2aa45eae33af6

SHA1
1a1bbda261430be9a0df4bf4e8d18d56fd653093

SHA256
82346461f8a2f46f5479d4d91ac8762c4f9633daaa520cf2967db4b10e1d7c9a

SHA512
11093bff6d328fd59299ba23ad0c1179a24d91867c863fac95afa93d97d3abdaada64e1fe30344e4fb45dda05063606324613ae6ec83978741c346bdd3b121fc

Download Submit
C:\Program Files (x86)\Steam\userdata\1037371635\config\localconfig.vdf

Filesize
36KB

MD5
69d18f0fca8fa67da9943a447a60ad67

SHA1
5cbd00073a1d38b42142186934caff456f1cbc73

SHA256
f68528522339de22e351e59db2eb31ca2ea63bd0685fa583c43b44a5b9baecf6

SHA512
19f7d9db6eead40f1ecb08e9fa27e9771f29c868fedafe58c8aeb9dcfe18d7dccd4dd79707181d8eb034cc6648ec1883a287dc05a487b6797af743b825598b0b

Download Submit
C:\Program Files (x86)\Steam\userdata\1037371635\config\localconfig.vdf

Filesize
7KB

MD5
d921fa8df25b3eba094f41cb2fce33d8

SHA1
4b36d469b29a5b8bd37574aae747d1c6e6aa0675

SHA256
e83d961a28f41ecb5e2edfd352fa8aab1f95028c20875b560a6e35597e8ce037

SHA512
09a93f1074bc8c0de49d202dcc16d363c52fe49a8e19692093429f2c33701056ca86d8d7e2042358e0e830f9c6067983eda4c2e61ea1e4b082924eedf40e0240

Download Submit
C:\Program Files (x86)\Steam\userdata\1037371635\config\localconfig.vdf~RFe5d5239.TMP

Filesize
259B

MD5
68d401dd5549c56bb0c5809421dc74e0

SHA1
442dd4a17ec2663abd545720f59e0dc8387dd15f

SHA256
4be0079a1aecae068eb484c33fc131c078a4d205b6fed53300ff62845729dd69

SHA512
215d12b8c68eee78fb04a8507d74e9123127ae91123c0a9795f18579ef3bcfdd241117bfb666e8b4391086f976fdd9fcc5c05c651e0f6bbf676d63b6d630d476

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\activity-stream.discovery_stream.json

Filesize
18KB

MD5
e2a194dbb8e0acfb9ddb29f8835bc6d2

SHA1
b7c368bcea85f7caacc2ed3311b4f29a95d33f00

SHA256
f742e0612b909763200047a655dc65f1a9669b297e580e6afb838dc35ad7872f

SHA512
cae937f1671c1c8e3b04d42b37f6eaa0743882df8997c44ca2447170d530ffef88087a27ee201603910db2449012103fe8ddeb53ebf2c273ec9d070aeba1d404

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\372A6DFC891AC4957E252744A9F8E5852C642568

Filesize
24KB

MD5
aa240d6329e659bce05b2ff993ea488d

SHA1
c9824024501ed295d241bcb0430c719fc83ad7c1

SHA256
4ae07d4bf15c64a98ae3745d8c1d2e5df7ace6579eec08f9c581f2c1f4d66479

SHA512
a4e3782d402ac8ebb924b724448aa6e459b98b78c886c4519ef9d57ca7ff81405df2eb90cce42fbfc7b491b0fa2c9c3f9f214fc835c8bacb7e8a5246025d29a2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
14KB

MD5
f60db34652a1bf95c54b0c5201a84467

SHA1
3ccc27a5b0aac01fb39e1cded5fe69101313182f

SHA256
37f91d0dff0dfeea01d96b4c857f15ca3cfa0037e0cb0f7b2add7af046930083

SHA512
9e847cb5282039728e3d593973f3d0ed3b8e1a6c2ca95765e436f67db454011b0eb92a411c6737e72e046f52f3588beccf7b1a07db9ac7bb0618aad07d011b8a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\743442CEE21D9EC40D80198FAF80EC04DFED017A

Filesize
13KB

MD5
d48107fda91472e912e3092e7fcc7d6d

SHA1
c6ebec02d4cdd87e48be80abf9d32e74db480685

SHA256
2c118998db5078041f09660b33ba8b1c319c085a66a24d4448039bd566227f65

SHA512
523d15c5371de6d04b93f6ceae3283542b6818ee4753a09c1605d5d4c8750709229f6b27671afb04994ee77355ec3b4669d2bcf2f6ed31b6928c040c6b4f4f79

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\8230CAB94F0E955AEA858AC2F5BA178F81152CF3

Filesize
76KB

MD5
c9cb74e4f663a4ab8678b05cd98943d4

SHA1
a91bf3e978673dfb7aa64f9403dcd5d50c440665

SHA256
ab540480613e0f1c2bd2a9423559bf8f618e19603b2624c027fa1911e0b21581

SHA512
fc3916e5e493fc33f566ba8ab3c47f8ff7fbb07fae8b5473a8e838684b0440da8ed05ca7721cf09faccb3721af4426d117a940b20b9d0fddd9679886d1af294f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\D376FFF554DE2392E2C6CA71F374FE8E7A1B40CC

Filesize
17KB

MD5
13b09eff46e2c9d68fe52db0ff9031b4

SHA1
f96c82a055a3c6545ea692ac8a9dbe55bbe4ca4f

SHA256
2f030081997d2314efd3f1f27905293afafc1ce0e23f3d981c04889ed9804458

SHA512
8ac7d3d77d7fcb54fb9944ed83693a283fc4161eb7c30f72ccf7b9a5fefb3ff662a07aeaf13300515811aec4eb43bea93ce11df99a3f6028b98679565d5ddfde

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\EF7F2055FD20253B1BB892601B56D3AECF790E72

Filesize
29KB

MD5
a4e9b90482a1b3e302c56c3591ccaf84

SHA1
941265a4721cccd6b27ccde1fe832708eb8cf432

SHA256
f1dad120c0870a3f1b5160c8272ff250be11eeccb5ec43bfc6e5cf8368c738e2

SHA512
c5fcadd8b62dd91c40b71d54db1fdf37f01a8e4a0bd536b7e2a934e7871b984ffc79e30eda1f37fd44b7d8aa0d19bca061e3de1268e4977633b9b965a6af6bc6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\cache2\entries\F26896CF1526DB7C55E6229C46694C3A0D39AB8D

Filesize
17KB

MD5
ce109fc0285e83061ab8edeaa0020ab2

SHA1
7c65b105a3ef73dd43fee7a46bb759acd34fc4f3

SHA256
f9a84bd4e0f3a01b616a844693b8221f14ced3cba8c136fe440b24d339962db2

SHA512
376f4edd8ee2f1fec51e759a6746f258b43279e1c492390b2907313cf207909503f1811b7b255d71bb7a272998bf114d98092d907c1ab7e6fd3738812e74d6f3

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000002

Filesize
19KB

MD5
6b831f3db51767ddc21f287180bc828c

SHA1
218035edf4f39635f755a25341d6f0ce5fbe6a65

SHA256
ee2a079993d679fed7cdba20f20eacab7466cb6c35e8ff9106a409c6b2a68a08

SHA512
4bbc07b86590429b903385a5af76cd62aa2f1b0e130d0a2816f587e2819f76ceed88af1089f172851d7a505a9e2a97938fb220c33c5b024839f2cfeaf5da51a1

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000003

Filesize
24KB

MD5
b201e8da90ef456598b8b3bb0e31bf53

SHA1
8bb524c8e9b17920c83d9a06c0b305e41cfca560

SHA256
2c8b630d1edafb8cc8c8cd73fff10c8ab6d06232929a4d458ec34628920f1665

SHA512
50126ac5b7800f5a848ef49ebc8e71d78cb5ee9c1602486b30e697ce57af32c868e46795ac2c157cdfd7fe65c03133c7a752813d520a9106adc3e50620b473f3

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000004

Filesize
40KB

MD5
0c9f37673dd9c878a4b5bb419ee24b5d

SHA1
d973a8e073c1f76068f0947d495998f7f823d76e

SHA256
c1e12f630e7f356d154ffe4a7a3873e7e136e41c1c37e6c0fa4d2c52f1d269dd

SHA512
b361afedb4a910b12f7dd7b5b33d2914be39528bf4d1486661d0107c24135cff3a5393df1af85cd7d1551f0e601ea9d2ad4b147e56f469691e2b11906fd1514c

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000006

Filesize
32KB

MD5
31b05e57c066452d73ab005bb42865f7

SHA1
2a8efd5d7753dd756c539ad66831b01f603fb13c

SHA256
84d0be622ddeef6d0793df5d274965d6d13a756979b4b484185dc7a051eb4071

SHA512
f793863cec23493b58311d37720fe7d48e21c92da5cbc9c5d4562e47a046e33be4584d58a1c031513298c55a9c33f5e591fd5ce831c9c33af9c2594bb071c277

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000007

Filesize
36KB

MD5
9d69a62bc96e67bf779bae3744a8f693

SHA1
bd8a95a103317e66551c2129fe392998dc45c7ad

SHA256
39ee252af15a86d1d4d54a5c3fb9ed2678ef2ecae9ad9d711290acce7a7a611e

SHA512
e1fe5393201c37a9c34196fb986e818d5a94545009c6536b3c6b1a1bf71d528d458039ef1f30eb1c064e233b7238b72f7cd69d204827ba8cdf3f783aa012ca10

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000008

Filesize
19KB

MD5
280188959917fc5a7ce9cbca5ba6fc05

SHA1
f651c19d05fb115f031342f12b36337d866c0034

SHA256
430750b0cb0ab5213be051d447bd370fa4afb2c0ca0275cd4f1beb8e0bec8f15

SHA512
fd0c1159142cfe42617bdfff51613aa6f72119e35d21bd1ef01a76697cbb8ecfff6059e52e8218be0e2fa37389a7e5582f5d6e9e0d80c2b00602337be5125eab

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000009

Filesize
19KB

MD5
48ffef4fc267c7350a37339001bd1a02

SHA1
9379041d4d542c116b420d014c7ebb68137a008a

SHA256
254467e453cf3cae3c70085b41462cd71b233c247b5e212f444347537b4c4873

SHA512
34b459dde39b3056e2f0a4c593b342d32829c9eebb2b01f146aefa0d54f0b52ecf4954873cf76b424abb25f84370d0b5ac06fdac734b397a7444b4b64b4d52f6

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000a

Filesize
150KB

MD5
52344bfd16b4f6d1dc61922468458ce0

SHA1
142e9ec2e44f56e7e97f243624655decd4ee75ca

SHA256
d4636d2d08503bfd82c4e2a614efaac77ed9aaa38793703e16cf8f73b445aefa

SHA512
4bdf08a37c220abdb1ff30a30b10573082960ea9ad4118d3a9abe3e0334aefbcbe07eb60cf17d9f8f4539c5f719a67c803a452a4e79ab64e71e7c7b83c0de172

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000b

Filesize
268KB

MD5
9b9f102b995fca5d0a0f265e0c187a43

SHA1
a0338d8ecb007c7ae97afb5f82a4e8b31e53abdd

SHA256
c76ebf55f90e72f7a9dd1b8649ea15b18e49cb96be63b8eb3ab2931624636043

SHA512
787f907c0e965bb2e3182e58bae720ae5cf12db6d700f9e9ecaf7c1ff7d51059560e5cad3fa5bb5b109cd475fee95e68a88d5ddaabb54c10334302055482c64d

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000c

Filesize
55KB

MD5
ce335bacf4db939b82f16fec2d7b977f

SHA1
488c973be8e1cd0b9127e5d49d7fc2b1846c1446

SHA256
cfbf6982cc5e8f43ae37093ce99d77faa0ee306d9c6d4f9c4da48bcc4d0b7c11

SHA512
9ca25b51b229cd88236ab1e4c97b100f688d2b35a0042f4ea584d336c5515140a6929586ff2af5c7b1ec199ae83f21bda848eafe890a8f0e4212c5a8d9c9a5c2

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000d

Filesize
48KB

MD5
debd8144c2ffd2a9aa8cad719675a051

SHA1
74b6d1816ff86b6c058a8b9adcca6062b5df7dc5

SHA256
f1b27141cf12a63ce528a64e82f07f2e0c42b37d1871f0e4869c76cea22bcc2f

SHA512
6e25807f2d299147a7d3e14bdaf8f84ac6db78f5c0826971f3affa157b167b8992994d758197c05f9b8b91bb5ecdadbfaf9505b89146aca751fc73f890b14738

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000e

Filesize
17KB

MD5
fb8793329dfef8cabe9a3fe1daec8347

SHA1
a7c26a54d2e919426f22f280af2166f7cd66b000

SHA256
7727c9986dad1956275a100cf7ecd27ebe3bdb5f442280fed6c2e16c2a68e591

SHA512
1de10e3e77c73d93db2b22c92b266ba0e8f7018a3ac1505a25e8f283b02adfe2b19799fa23e33db07fe6281ee04306e141486f4e7f994f5bbe6a55393151f556

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000011

Filesize
74KB

MD5
b6d9c262c1455daa23f2b3c942686a8a

SHA1
6325ce70ead89bfb10990841bb6b8594cffb42ec

SHA256
9f5e992c9a4f1847a97ceab4ee7dc43135ca2eec04db932f768b5ff1c166d266

SHA512
330a8167a25f6ca6c5002b00d56ef9a2095d4ae1d205a1ec9fc11177b85d619ebaaa138319b4dfb0740f0586de35c88bcff75efceafe57d22a5e30de2340b2bd

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000014

Filesize
26KB

MD5
25dfb8546d8041c0008ef3de00b798a8

SHA1
798ead6ad103af76509c0eb18a53d25c529a30d4

SHA256
62bd7575527c19c8020ab2a83eaab3d9ea7d0f8666bb356f95004562e449fe49

SHA512
4adbfce592b8d66d34e23ae7a600689fed3cc8ed5b64935819a27641fad62daa302fb3681778899673e8e686724a856195d7c313e75afcf82c5260a8359276dd

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000015

Filesize
37KB

MD5
a4f3a7734749a019b22fe82824274a42

SHA1
75a3d717f8ed2dafc2164fa1ddcf54e2ceefab0f

SHA256
8cf89971bc77d3c9e62039815b7d143cdbb6a6cc291d77f82b01773260f69d02

SHA512
a214696f588e367b5b626c3a506f15ef13bbb68915e2f2e39d2da9f9ff0595a930cf2ebfe3b5ad7e3aae36163e671370f06ec81ec48153211581e5bcac680435

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000016

Filesize
39KB

MD5
9073f6d5de45616ed054cf767f52c0e4

SHA1
4ccd030aba1f500f947d12fb0fb176310aa06a73

SHA256
23ac2ca3a4798e3e43aaad20134dc8bf9c800743a939656e7d3214e5fdca2c4b

SHA512
2eab3a7fd29c1211faca241f62516959997340440911e55b6214709e48e536a24953d8a285e1f51267f393e4c32d3c2051239c27b526411d1a65a2c24472b8df

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000017

Filesize
137KB

MD5
ea20a1e71ac270ef488f392d49d6bbaf

SHA1
7d65e7e300f7525afcbc7d96b2e7da6520ce2c2c

SHA256
60dc54440d5f9905e864d685c9c7c3c87a5656f5dbb955178091d01b29b013cf

SHA512
6ceb66d5786bbd0c033658cddfa471f640d9a14a6de82f7bcd5fe7e5a48673b2dfac3c216b68b537297ebed92184d34764627cc60a76709aa0ed3844c4e47ed4

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00001c

Filesize
119KB

MD5
57613e143ff3dae10f282e84a066de28

SHA1
88756cc8c6db645b5f20aa17b14feefb4411c25f

SHA256
19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14

SHA512
94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000027

Filesize
861KB

MD5
c965be39dd2b48db956c6c9b097142e7

SHA1
aa60262794045a488de7b6b2f628c4322fa34a3e

SHA256
026996418fca294712229e41898dd26b761820965e30034c0358008ccc9002e7

SHA512
69d062c1e8d514fa41c9741ea36ceaf56b1415fc578ccefd4f00d0b424360d89c15694c0d3494ec5e3508d45cbf510cd20796dd4692b748960bb68a63ed5cba8

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000063

Filesize
539KB

MD5
e7b432e258a691c4d297701d458cf5ed

SHA1
7d58b7f8ab47f5baa66b6d7b8e269118c0cb1c28

SHA256
b0dddeb70c3ba9acdf163e0af2462b8b5b5300edd8bac685555d524f838dca30

SHA512
27e155ad42af14953aa1609913b6dffe0529d3a2d54d2043a54995e2d218c461f39915eff8befbd264e76175c207ff6ca52cedeb8dcf23860c000895628747db

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9fb9e1f2e1bd3676953d9cd17a9bca7f

SHA1
21ec76efc310b4f3f6ac5bbaa742ea2feb24d077

SHA256
9382dcd1fdd95a3225f13383d5862c7b2604d1e224409d479d6755e25cf4c3e3

SHA512
6d6e7c465bf5a2579f8cfb044720f4e17fa93b8e444e613d8c20119ef6da13e3a20be89afd837447e6bf34abeab6d0a9a1e6605b6e823605747cb92ddb461ad1

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
583c3f9b3c09e2ccf73cc53fe6457909

SHA1
8709556e558f4dd34940d88d8ac67db509b827d0

SHA256
f738f0f2958ee2f7de0e93278ad7dd2ce7224d8067ac334e323c70e73106b5c0

SHA512
c171b5a2264afed92e682dd2029bc20c3e31e852ef71ed32578e92ceedb09513ecb91c7730ba11bb90084e45bbff552ff346e8dc9c3e95bcfecb2eb9f5401751

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe5ca2fe.TMP

Filesize
48B

MD5
1d68f79c42af8b87efe80c67ed2224f5

SHA1
debe9b2fd33fd35ee7499a4d9a4864d616b56e84

SHA256
32e16e92ab5f7ae66bc4417cc496120daf15d40f61cc705750ad74461e5ce7ca

SHA512
d7f6a5eb3b6f83913b9dea0338a7300382826b1c65658ca221c9f1fb2dd41297ef5d2c8c93a64b1488ff3336338342f1a7c7f6d727daa135e16ddacb98a11187

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
822B

MD5
a1de8d3ce272ac5d51c36ac3a61de78f

SHA1
bca136eb1c7a6a0241bd67b3ca2c25866c9d8a30

SHA256
299051df38513b52bf7b211f3d7c275c5a1b827b8e30fef51f5f4f1a8106be54

SHA512
359ee7a9dac8d43874f2e5b55c51959d0d86f46b3c4212a08b2159f64cdda8cc9ea25c4a1008086f9788ec00c0dfd7d7663ab231138307b70f881c3138878088

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
710B

MD5
eb06cf9d366e70525a5c201944f2b97b

SHA1
a4b8b93cb0982d69a5b40b5332c2aada824e0979

SHA256
990632b44cbe7fbf9cec6a736b6b46ad2bbf6d025405530a76671985d8a0c894

SHA512
1235f10c496f9c7fe254f590ac989724a1509e2f5acf01875bdf9230ce80a9b053ece540499f80c50b52f40c25d8211f7751f72dfdf487e3d813ba8b4e9edada

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe5d5c1d.TMP

Filesize
529B

MD5
ef5c252ca55fd7f40790c92e1875874a

SHA1
5f39ca796fe0df8ae4266d2b33dc2b896655125b

SHA256
ebabfe5b43f9f7fad2eb9df22819c91f2da38dc062bc98127b6630b550f3f5a5

SHA512
7e64708848617fedf4f0f60acf89cde3384cb58f9d935ce01e141d1fbf2eade12272162211601c773136f479acc4035a697e7707be82ecc4d17ea130466a018c

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
687B

MD5
beebd31d3d351bab49bd71eeefe5aa0c

SHA1
a1f0ec092f4504aa4827c9aa5c2590e8150f23fc

SHA256
707c7050f6accef43709739512478f88e93809bbf01acf324fb72bf6bf4af12b

SHA512
36fa6744f9d88e554d27d94002e8a44297cc0675b49f077523693e84b8b35a0e8c46b836562274dc05fc3339bc07dcda28aa5583daad656faf53e063ddedf4b7

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
d2c219158ce2bf58ef506616c0102b2c

SHA1
45b9da47be8d34b2af7ee921452d2291885cd28a

SHA256
e1726efbdf6b8ed70a81a1c16d09947ce89259c05697fbb5f879e781a92eebd1

SHA512
f6ff8f507511848be6ca89b6eda21c9a99224d2cbbd7a1673680c889296ca2b6afe0645ec9b03595aab01a93f8506c4e3a5f8169772545f7184c88c46b4585df

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe5d7041.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
692B

MD5
05fba52096b087a034d7f50f71135615

SHA1
2e900669ac1d39ed28fd8fb5ebe68a079cc1b1fd

SHA256
13d2b08b5dde484eb003db9c7ae35c8d6c70a55a42259fadd0c459282e36fad3

SHA512
1b8aa41ea8e2cc3c284c70320d8be5f8b9a6beae309ab982088874582f2f7378db49238935c7ce180690d7f57808d15853e7259718dffa8e59799075a9f1e865

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
692B

MD5
1e3e6791ada8900cf6d34e5ab7fb6db9

SHA1
dd97491015a6a1e27a7ee6560ac9b1cb3ef546ff

SHA256
75153b19e37f8abca06dcfab3cdced1153b46e50babd6c530c30ae09477a62bf

SHA512
cd115516a0db9521ac384ab6c843be811c220873304ef8cb3853a6075c40fea85c72ba7e0c97b77f45dd97b6a05d3ccf677d8c8477809ea86e903a59f187d571

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity~RFe5d8a60.TMP

Filesize
188B

MD5
b567e49e9fd6673c5aaacffd8057ee2c

SHA1
9780f16cd1a522a9f6735225bada51c66afa06e7

SHA256
892dd4e5649009eb773f139783207ae6fa2cf2c8c44228d4f2924a748af45e2a

SHA512
754487c1c6b438130e38bcf9601b3f70f03ddd76d033abc2a8184b17091404fe05ae284b4a7f38efdf8821ae89e300addfb846f96a3894bb4f16dcffaf77b4d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc5032.tmp\StdUtils.dll

Filesize
110KB

MD5
db11ab4828b429a987e7682e495c1810

SHA1
29c2c2069c4975c90789dc6d3677b4b650196561

SHA256
c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

SHA512
460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc5032.tmp\System.dll

Filesize
22KB

MD5
a36fbe922ffac9cd85a845d7a813f391

SHA1
f656a613a723cc1b449034d73551b4fcdf0dcf1a

SHA256
fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

SHA512
1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc5032.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc5032.tmp\nsDialogs.dll

Filesize
20KB

MD5
4e5bc4458afa770636f2806ee0a1e999

SHA1
76dcc64af867526f776ab9225e7f4fe076487765

SHA256
91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

SHA512
b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc5032.tmp\nsExec.dll

Filesize
17KB

MD5
2095af18c696968208315d4328a2b7fe

SHA1
b1b0e70c03724b2941e92c5098cc1fc0f2b51568

SHA256
3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

SHA512
60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc5032.tmp\nsProcess.dll

Filesize
15KB

MD5
08072dc900ca0626e8c079b2c5bcfcf3

SHA1
35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

SHA256
bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

SHA512
8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
accf75e7ab5796e86f7e8b4a51d1d17c

SHA1
30ff4ce677e7d264e3f70d48f748cc4b35da156f

SHA256
4e1379d3aca84787939885c51a25053de2b61a98206cff75ce3a31aefc635ff1

SHA512
176da2769beef802c6d8628e352d07b203436678f340de6c43d9bb1d11ea7ed67ba3fc74ba7e3929b52b74c22efc809d932b162bd758d42ad7a301ee15e2b742

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6H6ASR0XZ01BMVJDCGEE.temp

Filesize
18KB

MD5
79747b6ac0e8b77664a81eb624df376d

SHA1
a5150a379ad524e4c6feb20966618d301e6a0680

SHA256
009609c25fd27c2bfed6db2e7d832b4c2298af023f42b55032f1a1b116470bb5

SHA512
7d6fb2a2e9498e79db8d22e3f77c85cfa96bfb2e013268d71580c9de2054942052add2232b9eb9c2f300ba7fee80a71a69e1299fe16126effdfac30f7d473c46

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
6b705a1399756f2577b49b53dd7e3b83

SHA1
c9ceac6690fc28910f2e5924a4ec13a96db65e26

SHA256
ef1121b20718730e307c026058ace7b05e58b44a9773ffef846b0cf82b56e129

SHA512
74a44298c715f861a7f5a48f9c4520c69a14fc3f5e74572349c3281f749f34fb78105a49efdae21a5cbd51d91c7a35b95a523f3e181e89ce398eea8bdd31eb3b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
0ee670461f01f8696ef500ea2ad4a77b

SHA1
0637ad3d61d5e3b1d007d8994fc4741510557e38

SHA256
64f277bac5b5e959427d8c9d0bde0cf583e50632e2520134b657ba677f5d4ad5

SHA512
e533de33711471b68cd0affddac327e133b0e94900ec1dd9ba6b055e1a60390066eb04b0cce0b22ff0f55b519ac42241dd6f37f3ea1f0534f0c2359eaa302d4d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
baff0bc3ffd199f0ed81a30624ea58ef

SHA1
acbff9241b01cd9d6b5ecacf8d60a1daa8fbdbb1

SHA256
540443864a6a8bb552133cd0cdbc3e9658f75a6437e3510edfca6224c01cedea

SHA512
8273d859877f529be1e138eee5ce075ebf5454900c4d20f2b2f05315675656062e965958a40789493fc77518623bdfbdbe59e868fc8552beb1fae54fb58a25d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
6KB

MD5
54b286d7c3d10e94def26e9613e555eb

SHA1
33f323f7dfb8d53f36119312beccc05a5232fd6b

SHA256
76b536e2a3a98b3c899cfd303c04f01363fd23418eee72343620f862dd6fa978

SHA512
5ed6fca3b678485fe801641fa3938a0f3422c0168f69dca39ba647317ba1e4b847310452c9f1d141d7256b4b31650e0cff5775dff3c9e08f25789deef19aba83

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
66b5497e2ea44e6b635d955507207c34

SHA1
9dfae4f100d02d6969216cfb078405d98688bd03

SHA256
e08615a214473dd6399f4584a77541778d05dd9d5a85a9e741ba327429542653

SHA512
39edb002ee86bdbcbe1c4b67d74fc79e5df2f0b96383c0d68c457f1acaeafd05265f3ba32f2034a82075e98b5a425a37ef6a453a39b0c559c52f7e874d90e090

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
b54a053f1ae1706df23dcda06db902bd

SHA1
5f48f40a0b0d6e793250c6fee588838d4aaf17aa

SHA256
c4d8eb920e2f05ff036f7d21123179379215add7254376084ad948cac5137010

SHA512
2ddf5580a69b56f6d77dc9e3c9bed90fa5cf5eadd2f6b5cf4ff887845841c8620ffc08cf1ce953576c6e4fc85b30e44ba4276d8c3a33a15824a45f22dfc74716

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\AlternateServices.bin

Filesize
8KB

MD5
abf7f697468b674d4b93bd47fe04518d

SHA1
742a9f8e41f7b23b932a6e05c9fa83f8b3b9468c

SHA256
2bcb2e53d312f950a000dd82088a0076b6fb797107f30d64ad2487c7c9ca9fbd

SHA512
5a62df97ae894e7a419324bebeed4911d362dc1db49110e8e143223f6797a02dbff82daa8887731823d62f26e2c4969cf955409f7c3cb3ba043e7f4761b90d29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\AlternateServices.bin

Filesize
12KB

MD5
53b1b455d4b2cd4856e0a771c69fa4a1

SHA1
9cc967b78838a4fbbe91ccbd9e4c407a91f4c5f9

SHA256
b950bcc752989f0115f7a040d9f73e8549afd2c12be6bd93e9b7d2e22b9ea9b4

SHA512
81beed48fd640f1fd2d3fc84d59bdd79da9f64a7716bdea2a8c1cfa621c5a96e8ddcd7db546fe517c25a4be6ea0b8f4a6683d454eb473db7ba28e021995b16aa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\AlternateServices.bin

Filesize
35KB

MD5
e27a9a88579ba5df599fe02cf97a6d56

SHA1
036d39069d5a00baa725380e6e57b4af14c7f228

SHA256
94192bb0f434c1005a0039032718813e12bde667066176381043848d9e44c322

SHA512
fe0916cae8fe319a2f1f0f1113c7f7452ac68f56067dd3b435a12711df1da118db001f666960a105725b714034a3d5937b5679b67b54296289e8cebc92655a00

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
808d1924dc57c783721b7c6488d03fde

SHA1
643abeefa850e9130d5f8f2e642fd35906bfa907

SHA256
ff1159054fb41c7d3aeefed2965c5e548ceef36e21f274ca19ee11b3dc59642c

SHA512
9153c51ba98bfe9fb4e79ff5e2f1d29a4ecf1811f75b838965e172f02bc7168f731f0655648b7d99f117da8b7dc6d00e9210240b11efb0c0df6231d77670b86e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
92KB

MD5
44e6350cd0b05985a6c494bbfc7b39a0

SHA1
f2dc9d7e9100a76da1f5c7e2750618409b238491

SHA256
8c0c1e8de348e3bfef95b85cd26d639aba8599186f30c200303848bdf437d726

SHA512
67d78ba65df33bffcee6bfcdbb429624eec6e3877577bb39731e79083c4a13a6518deb8c69f6c7021a78dbba8579ecc172759d30090431d4b7d56df51db02122

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
40KB

MD5
586df9400204fa70e57177bf547d16d0

SHA1
baf214e52c6cbb57da2c607a8140a8efb3c89daa

SHA256
1813548f5afaa398d5f2c56a5f694a699a7abb793bfb2ef5e66bef1598a65f9d

SHA512
24460fd96f2da93762a86dfdf8bfcbd7d65b79ff09d182c89d9c191fc61fd4ad7dd696f5c63bd5e4b936fdb746d7a85449c28c7e770229b6b4870a06a0419d72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
91KB

MD5
c02760df04429df75e3706941e8e954d

SHA1
b9c4c738b345cbf4fa9718be49ecd054e5203a58

SHA256
79b073bb81c7fcd026d06dd275325bf4ca96e1a305640cfc6aca9d69a944b6e2

SHA512
30debe869c2090561c8ceafd691c016f9b7eb4753550d25a5d77ae3082ecc330f16d05b50261a34fc3069e16a6a954aa264acb1d96a44226ddaa7121e5333a1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\db\data.safe.tmp

Filesize
92KB

MD5
0aa8c5edd87cc1c9dbf752f7e216f8b7

SHA1
f3ee265d30c4ac6e7458a9fec7931901da11fbde

SHA256
499be9c02744d2cb1e8f7f321224ee3a3eeba2bbbfb28c73c503b9a1f8a6d9ea

SHA512
0a9c691726938619cd2441487b1d2f34159f5eed9c4c4934f76b35c51ea4219d52c279cd020d0f649bddb4ab6c9bd20fc5906428905c32779d5312a6ed8a1394

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\0a720a8b-a2e1-4a17-a07a-2b694667cbee

Filesize
26KB

MD5
9869933e545301ac37e6de37dfc13bb8

SHA1
de4ad4be7b963b6270d38d7481c0087f2434f93e

SHA256
150b9d6f1540032d8c42caa9306419e25e3aeb7833a0f880a98ac549dcd013eb

SHA512
1cee9915122d1f449e4f9bef330a2932e8e4070f47e01a59ed45f1af0d15969d850b503ed5bfe660a3a9256ac8b3104a4af45dd7bf4ba6fc09d358b689011134

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\975ecfa2-2149-4bd7-a3d6-5e8bf2d1a030

Filesize
982B

MD5
3fd529cb66b2dee0afcac9c8683ec965

SHA1
8d2b84a0fbc71be735693e4a7470949c6cc53efd

SHA256
75f3a3ff5dab98138962ab95320d3f2e3917b0670538d2d456fe7925e22331ff

SHA512
8c4247f4fc922d94eeec363f4f0491e96cc118c52cca8d6633b92ba8489683ce024320c8c7d7c140301e1570f8d0abbaa03901c0d0c8393025c0109e686a4d29

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\datareporting\glean\pending_pings\c57d008b-5a37-4f71-a01d-4417861b4798

Filesize
671B

MD5
c9b784f0ed20554177d1a395978494dd

SHA1
70078cdccf108f5d121a6beee58a95fbbe58c4e4

SHA256
df5e7163df2c192b4d625c60f235f40bde4d09e62bbaf4024d61d44ec3eac180

SHA512
af93b006f056005cf4be1c06f6e09d92f8222174236922085b3aeafea3a919e41cedcccebf8a0fb389902d04401ea78d7faf1f924b0a2d989eb4e939acabfd9b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs-1.js

Filesize
10KB

MD5
3fcd7f824f89176911183371a1a60c2a

SHA1
2265735d1e4c7c85d27f8a0aca5b6d8b961ac52c

SHA256
804e8100c6a90a9eb70e482563cca136664cb5df5f143ee0122a5eabc5d9fe36

SHA512
e7e8799eea1faab627f8f96def36c2a20c5e9f908405e4d312cf7703d216e7d00cd092569f8943ba6d7aa6e92935d511b745e469f924bdb487be9f2a0d4dd9b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs-1.js

Filesize
11KB

MD5
7c7bc3bb115b2e6623acbee4078a16c7

SHA1
cdf8ef15d4035e6914426d70273bb8e9e537f45b

SHA256
004eacbdb24c4dbc73f00349ae17ab51c67693c0815f3ba55a728382c72abc80

SHA512
6c2e7248f1a6f347f55ff73e4b6b79e925254f99d6710d5f7e67523daa81a611470203fa647f91e3e8d6373ccf3b668bf7a4139e1c8845c9e62ce58c41b4130f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
10KB

MD5
4fb04cfc26934dd378ff887a18f50910

SHA1
326aa8871efd4f41bcadcfb40da84f268943f388

SHA256
dea5e6870ddd37783074976771691e397a553a0cc6c8764298701c2027470bd8

SHA512
2c156f1a5dad3e99b3dbc4ae6d8a9360eec0cad8f930be7fddc950cc9ac94fcc560e3ed2a021976022104135721c7183329c59036001132605ec3d47b218d32a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
12KB

MD5
b9660acaade0f38ab58cdb031f8ca81e

SHA1
d7b23b8c663ccd0821456d28dc099ffcedbee5f2

SHA256
a8ed7e05dcef2ab131431e4b78ab827f987f3f43d78d2cdb6fd384379bd896c2

SHA512
b7002c082823d547a1aae33f8703a0cb1a68f5d6abfe54c37d0870f930901b86e7e93d72bf20d2c68d17633b6977c0c1c5f6394270c78ecbcbdf64f6e46b65a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\prefs.js

Filesize
12KB

MD5
46c61bf4f4cc0a8ac5f534316a4b10a6

SHA1
43f8e452711ef45acab50a169fdc279c453e1a61

SHA256
8c5684e0cd1a5bd1263e69c02488cdfda88e9abb8cb016af8ae58f5849f184d5

SHA512
ec25735424ff38d32260ce8e3d2a8b9b554f3adfc5bd73e3b7f379c52efc86a47aa696dfb4d419b2694f933a4f97a064034911d00d89d680a1014206187c6495

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
ba5a06721b97a39c4b1716a18be89242

SHA1
a43c28b80ac4f8c7cf97c04bff958dc8ac99dae4

SHA256
97767472de353f688d566e0f92cc3dc113b43da1b686d762162602f01361a763

SHA512
8391ba7d3b041786dcc5db5d0ae8cb014057131f9cad61f8b6968c66e314bb1d84736982f42afb75922003a0decc7dc3221d0a70ec93459ddc5a4efc7eecb1e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
09c3b43d653531678fa4a9bb01341a18

SHA1
f57e96cb2b1916b7d2e08d4cf4a4c67166009433

SHA256
80ac3800872c00a2e70dd94deb251f4fac72c9cc3372b963bcabf7d672cefc53

SHA512
7f91ffd2d8e2490c5dc955dd4fdeb17f191543ac6ffb852e3eaf8a9b81f13e1e4c47bba3d76f1246ba8bf1e123781b14b0ff8f3651c98bb17ee8fd45bc4e495e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
cd3c415e71d033ba6cbbca3dfe7c1bbe

SHA1
72c2bf862198f182b33a9293892b35e7ca930633

SHA256
d646e27575cec7bffd118add02eb1fd872e54a8d824845e37a54e584ab477549

SHA512
4587c6b1ef36897e1d51bb273235314b01f52c08f7bb6c4215db22a9390edc52239058377a89b6e3a99ac6aa677f070f39ae956598e13100d4682321c7fc93ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
58KB

MD5
b0f244bf840f2c073918b3c7c81c32a7

SHA1
1ec367f2b2c0e76582811912714e126ff5b3f674

SHA256
a2b90756bdb13fd690100046765949fca48d39e58675cd33ca9454f0c4440830

SHA512
340182ee4a3005a7d280fe261950fbb81bf9a8a44c3b6a191cd6b260685b94464535ed94cce1ed421292d6f1a6a9d704d212ed0aaf5372d8986a88065e24b5d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
60KB

MD5
f33b6781dd570783528623589a29ee52

SHA1
0cfa05acc17f6e1947172ae9170ca58166434f1e

SHA256
f0507eba9da796d0ea53f63fdd8a7a31b6669fc259673dc1ebd263ddcd495a31

SHA512
9b8a1f147be9bc69794d44bc210ea76869e8541d7016e962a26b0b71de561dd98ebe917ef8bb40bf3a5b3b2e1e39d028107b971483043f1303eaa039d5a87057

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
60KB

MD5
31a47e8b96c6015d31590f13e1b16b33

SHA1
d22acf32acd346c2f27b662c742f99b0e522cc02

SHA256
35db760108ab76156b400e9342ef923031d84a08e96b381efddc7352ca2a46dc

SHA512
a6c5945f714510c9cac5bc0864e09c580ca2e4d0e5feae685a3dee89144216a9718629c1497b587910d1bf998a14f47f5d741ca3ee5785a0350367e716b28c21

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
60KB

MD5
4185ec2f28d2d9ed2e6328fc66d84575

SHA1
0986d2ff41a1ca559e933e317d527a80e05a4292

SHA256
a7854e1a459b8f01547301e96e98d41969ff532054a8f049a5f5fcf40c9c8ee6

SHA512
13fec24a47c18dc84687724c303d59bad241fe628479c76ad825b3ee4021c98032a2e40beeca4618a63227c47ffb4521018a117823482191b6e4ff8d92bcae91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
60KB

MD5
83845a9241a00d49227c8733c301ac9b

SHA1
cad0b8ad2ef92ab846a63a46d98c22bf7c096ab6

SHA256
69bdc8cc171743f8c632f3c2c9b50f369b718f964ef7207d156fbca5868d8be9

SHA512
d95651b9cdf3fe96f1f355849ec867c86497e2a2d65167113bb767dc6a8ec3eb7551c47ac3ea292541c18c69f86a6f92c1557088fd6a9c071b4a5935e5fba62a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
7fa11ed5d5bfc12856d2a86869173e7a

SHA1
fd618b66de19fa8703032de9555b45f742fc7d2b

SHA256
21ea002319537804f376f782a12a51f33b4929088447d612e0d9dc6e9fab9f7b

SHA512
110b2b2f3e0c68876f635fdb5cf5308afc24a307d251c2eb8258dfe68fbfef26a77a4fa95e770110af3cb444430ab4da72b4fb2c651a0ab5ab19fb98993ff465

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
48851e1d6a283bcdb786c806e26acb1f

SHA1
2badccaca120e6b1530c2c2975dd0edbe4a33c44

SHA256
f371c7853feb885674456eb76f47f909397292d96ff1cb8ca222a23d9bb46582

SHA512
617a7d590c0c6c7cfed5f5fdd27142d0af8a3de1a6d4227d5bc3b941cbc90bf891522895ce38332e57dd4f1c466851ef5dd9564eaad8f410af410531d13177f9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
58KB

MD5
fbd0a650890bcd5f0f2f5d7d43ba2290

SHA1
1b43d4ba67c58e22e6ed11c25e6e24cbf7d91095

SHA256
571cfb35600688621b617e0bbf68120662550555ac06909903c0cef4669718f8

SHA512
7530941aa894df077620c56f41afce9e981bd7eccfe35aa10317755f593ec4ffb73925ce009f5c8775efddb6f5835e84f2dac8dc90e07c7a37b2fc1dc149920e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
58KB

MD5
298c088dac77a55aca5499815eb34111

SHA1
1c2f7e13b48d7429a0a0157bc8f2509adc93f34e

SHA256
ab02e34921a7b6d5fd0d4d91a032dd6f1f0a672ba972d17b0d6f2b74ed0c2c61

SHA512
94a1963586e4388a896242fd714890afc28a2e2dd23344dc8d2f474ad76b5998e5bcb8d791a343646adbf9f36e56e69983d50d12f6e42f8848c043405c9b0f2d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
60KB

MD5
6b429da2b68fa1ac76fa25a3b041facb

SHA1
92aa6f5643389658b921b9c109d97271ff8dc2fe

SHA256
43bc7139aac83824144f280610480af2bd8cc587f403b9c450ab7c018702165b

SHA512
3c57a5c79e6d649f1035891434ce994efc953133579e3e1140cafe97d15d6afc735149e0695852cd14df02c2daa9f1536aeb9e34a649d0da01107efb9a2619a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\sessionstore-backups\recovery.baklz4

Filesize
60KB

MD5
ac4137aeb97f657e5385a05c0a9837a0

SHA1
357a5f083185ee6c79a1d7c1b29cf9b2d56a71b3

SHA256
13127a9e4df4776821ee1fb1b2b97f9d7297cfb77db97ad2f6a9d3cb7efed5fd

SHA512
0f2b5ab1f4e4f2916b1548fa60dc686d545e61ec121b7c25c37a5f1ace3272e5bba7d8725deb4ca7573ca1d0afe56b23af350ad9a1e03d4747d3e30ac4d23b01

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uhqcqu3c.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
600KB

MD5
341356656d80f624391ecfa6f3932ca3

SHA1
2ba8cd1297657f1adb0ae2ae231d9dba806072a0

SHA256
cd0cf1d33553c36fc3b35caeefc8dc43fe4796b19284b208ec09b3080dd2aa78

SHA512
360d2e5f3c379577552dbb33d9b42593d4d5a8f48d3d6a8976d16eef634c7650fe5867cebf6a4b0d68e5ccc0ebba123012294ce7166f51c0eed061d02ef62445

Download Submit
C:\Users\Admin\Downloads\SteamSetup.DLT8sYQ2.exe.part

Filesize
2.3MB

MD5
1b54b70beef8eb240db31718e8f7eb5d

SHA1
da5995070737ec655824c92622333c489eb6bce4

SHA256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

SHA512
fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

Download Submit
C:\Users\Admin\Downloads\SteamtoolsSetup.eNjkiE2t.exe.part

Filesize
837KB

MD5
93ef55f275e12608889ba7c2e908e6d8

SHA1
969a31955b49a8bd82567fa582b3f29528ceb6f1

SHA256
7af03f9f3e8d96c931d69b1ecd531ee976c6e504d678bbf44f553ffea8943291

SHA512
fa3dfb36608777a5942cc3ffdb5d1599efd0420dbd436def11d860312b6dff64af6d9c3022964c78eaf34c3173a8907a3b58e88fda8f83a4e8e4063287ba7c53

Download Submit
memory/1136-13554-0x00000000006C0000-0x0000000000B72000-memory.dmp

Filesize
4.7MB

Download
memory/10244-13761-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/10244-14382-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/10244-13743-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/10244-13766-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/10244-13771-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/10244-13727-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/10244-13789-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/10244-14520-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/10244-13858-0x000000006E340000-0x000000006F681000-memory.dmp

Filesize
19.3MB

Download
memory/11328-13942-0x000002391E5C0000-0x000002391E65E000-memory.dmp

Filesize
632KB

Download
memory/11328-13740-0x000002391E660000-0x000002391EDCC000-memory.dmp

Filesize
7.4MB

Download
memory/11328-13739-0x000002391E5C0000-0x000002391E65E000-memory.dmp

Filesize
632KB

Download
memory/11412-13611-0x00007FFD87080000-0x00007FFD87081000-memory.dmp

Filesize
4KB

Download
memory/11412-13612-0x00007FFD86820000-0x00007FFD86821000-memory.dmp

Filesize
4KB

Download
memory/11412-13737-0x0000027D6A350000-0x0000027D6A3EE000-memory.dmp

Filesize
632KB

Download
memory/11412-13738-0x0000027D6A420000-0x0000027D6AB8C000-memory.dmp

Filesize
7.4MB

Download
memory/13228-14415-0x000001F992300000-0x000001F992A6C000-memory.dmp

Filesize
7.4MB

Download
memory/13228-14408-0x000001F992260000-0x000001F9922FE000-memory.dmp

Filesize
632KB

Download
memory/13784-14233-0x000001A629310000-0x000001A629A7C000-memory.dmp

Filesize
7.4MB

Download
memory/13784-14232-0x000001A629270000-0x000001A62930E000-memory.dmp

Filesize
632KB

Download
memory/14316-14493-0x000001BBB16E0000-0x000001BBB1E4C000-memory.dmp

Filesize
7.4MB

Download
memory/14316-14492-0x000001BBB1640000-0x000001BBB16DE000-memory.dmp

Filesize
632KB

Download