Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/06/2024, 14:10

240602-rgvm8sed3z 9

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/06/2024, 14:10

General

  • Target

    DevCameraMod_1.dll

  • Size

    673KB

  • MD5

    c029288468a1e6f49e15a1326f8c7cb0

  • SHA1

    e5f4ccbe6690a61fa3259f4d98674459e9eaed80

  • SHA256

    ef40d5ffe0cba48e7c28cada829e95b4dcc98c4c669b4a21fc566b8dd4eecf08

  • SHA512

    b0a0483780735186640a8a1e0ba66fcee1083e00262ffb30fc65504b12e18645d59009aff581235c91cd3385071d1d01924e1f00b029707a31bf721a048a1209

  • SSDEEP

    12288:4sP2YrifZZ1jeQN+lkVXJOvKhfC3Sk35z0WBR+07O7G7QrI:482mSyDk8CcF0WiJi

Malware Config

Signatures

  • Renames multiple (51) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 50 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 39 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\DevCameraMod_1.dll,#1
    1⤵
      PID:3152
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffc05919758,0x7ffc05919768,0x7ffc05919778
        2⤵
          PID:520
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:2
          2⤵
            PID:3784
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
            2⤵
              PID:3688
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
              2⤵
                PID:3948
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:1
                2⤵
                  PID:4736
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:1
                  2⤵
                    PID:1320
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:1
                    2⤵
                      PID:4836
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4660 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                      2⤵
                        PID:5108
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                        2⤵
                          PID:4556
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                          2⤵
                            PID:4716
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                            2⤵
                              PID:3956
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                              2⤵
                                PID:4456
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3864 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:1
                                2⤵
                                  PID:2704
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2136 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:1
                                  2⤵
                                    PID:3960
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3872 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                                    2⤵
                                      PID:3888
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5508 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                                      2⤵
                                        PID:1544
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5284 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:1
                                        2⤵
                                          PID:364
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                                          2⤵
                                            PID:4092
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5772 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                                            2⤵
                                              PID:2992
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5780 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                                              2⤵
                                                PID:1096
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                                                2⤵
                                                  PID:4200
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6052 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                                                  2⤵
                                                    PID:1940
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5772 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:8
                                                    2⤵
                                                      PID:2800
                                                    • C:\Users\Admin\Downloads\SteamSetup.exe
                                                      "C:\Users\Admin\Downloads\SteamSetup.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Adds Run key to start application
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2176
                                                      • C:\Program Files (x86)\Steam\bin\steamservice.exe
                                                        "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Modifies registry class
                                                        PID:3108
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3956 --field-trial-handle=1636,i,3422995007646949952,13565407353006940937,131072 /prefetch:2
                                                      2⤵
                                                        PID:5000
                                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                      1⤵
                                                        PID:2176
                                                      • C:\Windows\system32\AUDIODG.EXE
                                                        C:\Windows\system32\AUDIODG.EXE 0x3c8
                                                        1⤵
                                                          PID:4904
                                                        • C:\Program Files (x86)\Steam\steam.exe
                                                          "C:\Program Files (x86)\Steam\steam.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Checks processor information in registry
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:2136
                                                          • C:\Program Files (x86)\Steam\steam.exe
                                                            "C:\Program Files (x86)\Steam\steam.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks processor information in registry
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3052
                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=3052" "-buildid=1716584667" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-userdatadir=C:\Users\Admin\AppData\Local\Steam\cefdata" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal"
                                                              3⤵
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks processor information in registry
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:5792
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1716584667 --initial-client-data=0x30c,0x310,0x314,0x2e8,0x318,0x7ffbf4baee38,0x7ffbf4baee48,0x7ffbf4baee58
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:3508
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1716584667 --steamid=0 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1432 --field-trial-handle=1560,i,10670850073448077633,11431491684599373252,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:2
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:1484
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1716584667 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=1984 --field-trial-handle=1560,i,10670850073448077633,11431491684599373252,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:5680
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1716584667 --steamid=0 --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --mojo-platform-channel-handle=2292 --field-trial-handle=1560,i,10670850073448077633,11431491684599373252,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:8
                                                                4⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:4964
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\cefdata" --buildid=1716584667 --steamid=0 --first-renderer-process --log-file="C:\Program Files (x86)\Steam\logs\cef_log.txt" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2716 --field-trial-handle=1560,i,10670850073448077633,11431491684599373252,131072 --disable-features=BackForwardCache,DcheckIsFatal,SpareRendererForSitePerProcess,WinUseBrowserSpellChecker /prefetch:1
                                                                4⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                PID:3572
                                                            • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                                              .\bin\gldriverquery64.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:5736
                                                            • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                                              .\bin\gldriverquery.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:5876
                                                            • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                                              .\bin\vulkandriverquery64.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:5948
                                                            • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                                              .\bin\vulkandriverquery.exe
                                                              3⤵
                                                              • Executes dropped EXE
                                                              PID:5840
                                                        • C:\Windows\System32\rundll32.exe
                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                          1⤵
                                                            PID:404

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Program Files (x86)\Steam\Steam.exe

                                                            Filesize

                                                            4.2MB

                                                            MD5

                                                            33bcb1c8975a4063a134a72803e0ca16

                                                            SHA1

                                                            ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

                                                            SHA256

                                                            12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

                                                            SHA512

                                                            13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

                                                          • C:\Program Files (x86)\Steam\bin\SteamService.exe

                                                            Filesize

                                                            2.5MB

                                                            MD5

                                                            ba0ea9249da4ab8f62432617489ae5a6

                                                            SHA1

                                                            d8873c5dcb6e128c39cf0c423b502821343659a7

                                                            SHA256

                                                            ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

                                                            SHA512

                                                            52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

                                                          • C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

                                                            Filesize

                                                            15KB

                                                            MD5

                                                            577b7286c7b05cecde9bea0a0d39740e

                                                            SHA1

                                                            144d97afe83738177a2dbe43994f14ec11e44b53

                                                            SHA256

                                                            983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

                                                            SHA512

                                                            8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

                                                          • C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

                                                            Filesize

                                                            20KB

                                                            MD5

                                                            00bf35778a90f9dfa68ce0d1a032d9b5

                                                            SHA1

                                                            de6a3d102de9a186e1585be14b49390dcb9605d6

                                                            SHA256

                                                            cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

                                                            SHA512

                                                            342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

                                                          • C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

                                                            Filesize

                                                            23B

                                                            MD5

                                                            836dd6b25a8902af48cd52738b675e4b

                                                            SHA1

                                                            449347c06a872bedf311046bca8d316bfba3830b

                                                            SHA256

                                                            6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

                                                            SHA512

                                                            6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            0340d1a0bbdb8f3017d2326f4e351e0a

                                                            SHA1

                                                            90d078e9f732794db5b0ffeb781a1f2ed2966139

                                                            SHA256

                                                            0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

                                                            SHA512

                                                            9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            4c81277a127e3d65fb5065f518ffe9c2

                                                            SHA1

                                                            253264b9b56e5bac0714d5be6cade09ae74c2a3a

                                                            SHA256

                                                            76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

                                                            SHA512

                                                            be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            2158881817b9163bf0fd4724d549aed4

                                                            SHA1

                                                            c500f2e8f47a11129114ee4f19524aee8fecc502

                                                            SHA256

                                                            650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

                                                            SHA512

                                                            f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            03b664bd98485425c21cdf83bc358703

                                                            SHA1

                                                            0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

                                                            SHA256

                                                            fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

                                                            SHA512

                                                            4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            31a29061e51e245f74bb26d103c666ad

                                                            SHA1

                                                            271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

                                                            SHA256

                                                            56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

                                                            SHA512

                                                            f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            da6cd2483ad8a21e8356e63d036df55b

                                                            SHA1

                                                            0e808a400facec559e6fbab960a7bdfaab4c6b04

                                                            SHA256

                                                            ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

                                                            SHA512

                                                            06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            9e62fc923c65bfc3f40aaf6ec4fd1010

                                                            SHA1

                                                            8f76faff18bd64696683c2a7a04d16aac1ef7e61

                                                            SHA256

                                                            8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

                                                            SHA512

                                                            c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            10c429eb58b4274af6b6ef08f376d46c

                                                            SHA1

                                                            af1e049ddb9f875c609b0f9a38651fc1867b50d3

                                                            SHA256

                                                            a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

                                                            SHA512

                                                            d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            5c026fd6072a7c5cf31c75818cddedec

                                                            SHA1

                                                            341aa1df1d034e6f0a7dff88d37c9f11a716cae6

                                                            SHA256

                                                            0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

                                                            SHA512

                                                            f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            189ba063d1481528cbd6e0c4afc3abaa

                                                            SHA1

                                                            40bdd169fcc59928c69eea74fd7e057096b33092

                                                            SHA256

                                                            c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

                                                            SHA512

                                                            ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            18aaaf5ffcdd21b1b34291e812d83063

                                                            SHA1

                                                            aa9c7ae8d51e947582db493f0fd1d9941880429f

                                                            SHA256

                                                            1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

                                                            SHA512

                                                            4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            1514d082b672b372cdfb8dd85c3437f1

                                                            SHA1

                                                            336a01192edb76ae6501d6974b3b6f0c05ea223a

                                                            SHA256

                                                            3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

                                                            SHA512

                                                            4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            8958371646901eac40807eeb2f346382

                                                            SHA1

                                                            55fb07b48a3e354f7556d7edb75144635a850903

                                                            SHA256

                                                            b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

                                                            SHA512

                                                            14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

                                                            Filesize

                                                            5KB

                                                            MD5

                                                            7e1d15fc9ba66a868c5c6cb1c2822f83

                                                            SHA1

                                                            bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

                                                            SHA256

                                                            fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

                                                            SHA512

                                                            0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            202b825d0ef72096b82db255c4e747fa

                                                            SHA1

                                                            3a3265e5bbaa1d1b774195a3858f29cea75c9e75

                                                            SHA256

                                                            3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

                                                            SHA512

                                                            e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            7913f3f33839e3af9e10455df69866c2

                                                            SHA1

                                                            15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

                                                            SHA256

                                                            05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

                                                            SHA512

                                                            534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            58e0fcbee3cca4ef61b97928cfe89535

                                                            SHA1

                                                            1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

                                                            SHA256

                                                            c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

                                                            SHA512

                                                            99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            9b0b0e82f753cc115d87c7199885ad1b

                                                            SHA1

                                                            5743a4ab58684c1f154f84895d87f000b4e98021

                                                            SHA256

                                                            0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

                                                            SHA512

                                                            b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            eb8926608c5933f05a3f0090e551b15d

                                                            SHA1

                                                            a1012904d440c0e74dad336eac8793ac110f78f8

                                                            SHA256

                                                            2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

                                                            SHA512

                                                            9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            6367f43ea3780c4ee166454f5936b1a8

                                                            SHA1

                                                            027a2c24c8320458c49cd78053f586cb4d94ee6f

                                                            SHA256

                                                            f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

                                                            SHA512

                                                            31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            e04ad6c236b6c61fc53e2cb57ced87e8

                                                            SHA1

                                                            e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

                                                            SHA256

                                                            08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

                                                            SHA512

                                                            0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            56dcf7b68f70826262a6ffaffe6b1c49

                                                            SHA1

                                                            12e4272ba0e4eabc610670cdc6941f942da1eb6a

                                                            SHA256

                                                            948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

                                                            SHA512

                                                            c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            66456d2b1085446a9f2dbd9e4632754b

                                                            SHA1

                                                            8da6248b57e5c2970d853b8d21373772a34b1c28

                                                            SHA256

                                                            c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

                                                            SHA512

                                                            196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            b2248784049e1af0c690be2af13a4ef3

                                                            SHA1

                                                            aec7461fa46b7f6d00ff308aa9d19c39b934c595

                                                            SHA256

                                                            4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

                                                            SHA512

                                                            f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            194a73f900a3283da4caa6c09fefcb08

                                                            SHA1

                                                            a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

                                                            SHA256

                                                            5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

                                                            SHA512

                                                            25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

                                                            Filesize

                                                            7KB

                                                            MD5

                                                            53f7e8ac1affb04bf132c2ca818eb01e

                                                            SHA1

                                                            bffc3e111761e4dc514c6398a07ffce8555697f6

                                                            SHA256

                                                            488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

                                                            SHA512

                                                            c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            29f9a5ab4adfae371bf980b82de2cb57

                                                            SHA1

                                                            6f7ef52a09b99868dd7230f513630ffe473eddf8

                                                            SHA256

                                                            711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

                                                            SHA512

                                                            543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            cadd7a2f359b22580bdd6281ea23744d

                                                            SHA1

                                                            e82e790a7561d0908aee8e3b1af97823e147f88b

                                                            SHA256

                                                            3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

                                                            SHA512

                                                            53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

                                                          • C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            f350c8747d77777f456037184af9212c

                                                            SHA1

                                                            753d8c260b852a299df76c4f215b0d2215f6a723

                                                            SHA256

                                                            15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185

                                                            SHA512

                                                            efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            ef71883a5fe650da463b8a7851a710a4

                                                            SHA1

                                                            90cbdaa65664ed33af4d3f9685530d0c36aefed8

                                                            SHA256

                                                            e07b67a4735d6a0842e76e7fccc8107083d4c8983845930d6cfcd4eeacaff463

                                                            SHA512

                                                            414bfae78d652d42ad140a648bd96f8b1c791604174d571f96e913b2025f6481b2fae56967e4afda3627427e1e0e9fc419b507d393480dbc1af5f691d3e44b88

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            eba74c68690fad1c3e37552d14c64f66

                                                            SHA1

                                                            82113d15ad222448331eadace5c98d3172396c8a

                                                            SHA256

                                                            08c20d1dfae369316be554e172848620d675607bcd9024acee17a7bc4ab84fea

                                                            SHA512

                                                            2003a600b378ad8d6eb9d3d65abad8c4d471145eb10b66a1629e11ba9d082064e397ad1bd6f8964d6a5fd5419c5a1b260f1960a4007c142c56d3d78c6e365e22

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                            Filesize

                                                            371B

                                                            MD5

                                                            b918c31ef6bd3d77c07403867fd59a99

                                                            SHA1

                                                            7efc327e4e8b60b1c4dbd9001aeaede48d4e55d9

                                                            SHA256

                                                            3208821fbdfa7d3e362870aceb85831949b6ade195a46dbedf433c70025c38d1

                                                            SHA512

                                                            e73546581552e63fbf4891792fc7cbcd7bcce6ed25a87305c2e4642cd738a8572e5beb6049a124110641f1526271a711bbc80217f9289ea6ab368865323a2246

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                            Filesize

                                                            707B

                                                            MD5

                                                            e9dd3b6e5b9b5a597065c364e94b146a

                                                            SHA1

                                                            3dab2d1be909b78249c35a06fff6b8c00e58711b

                                                            SHA256

                                                            bd5c48764e5507aa4a79d3513ca6843687f2faf2be0fd8992e3d7a7dc73d75c0

                                                            SHA512

                                                            3e3ea65668514b8c50cd3959b53832d2769afbf5edebd97ab5aa6ccc6e519b1183442d2693bb99c32d202513f06095a4aa03b542de2ca2a4081df085d5f28438

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            1b77e7d61762b3049df08c12b4c416d3

                                                            SHA1

                                                            9b369e070556d93f1dbeba1052c4b435426806bf

                                                            SHA256

                                                            0b947e6b5cea1d011da1531cc051c9d9816a2533f25daecc34afb70ecb091691

                                                            SHA512

                                                            91fc452fb27b5b7dc207e5b90a094943f753fa799a145d4e864d2085f99eec28eb56b2f18b0489e235a54dd4e8ebfcfb4a59b6d66c0b762a171cb426738f291b

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            2f8b2999f7a741b257587a066bbfd352

                                                            SHA1

                                                            276d74905e7c4d1426ba78b6352e530677c1f619

                                                            SHA256

                                                            cd867e815b304c71c1ae81b281a142549b7513dd75c1edece0fa41c07d6c6b88

                                                            SHA512

                                                            da01d54d1e00a30cf4e0ec04be761734d568f9307f77f0ed900a4c69f036349a45f2856bd19830b4c0bc7b525917701de656f83fd5f39e28f4cc574c905e8b0a

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            ae9022c6513f724513665641cad7ab88

                                                            SHA1

                                                            7e1fb29e2c1f0b46434a66cbea6181d4697f03cb

                                                            SHA256

                                                            bf1168e4576081185079b04bba53be7f5bc72ef6d30e953143a5ffabe894dcec

                                                            SHA512

                                                            6e530b01bbb9aab01229ed541477d1810c84aa9169bc85804032e9344e9760dc6869d81efe88038cb890137711a81ce90a23067f5d26dd16b92fdeed26381856

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                            Filesize

                                                            6KB

                                                            MD5

                                                            d909d228b1e22f03d17b941464013141

                                                            SHA1

                                                            e8d1b9cf1c930f3dc21baa27e71c053bf57882b3

                                                            SHA256

                                                            3216dfb7a4d0bf201caa0f23c2218296faa201685d23020df0471d5021ebe582

                                                            SHA512

                                                            ff370100d89ae663cda22892c4b075d75c4ebe411511ba8c379eafdc97c9e8aefed55bf44b8722fab562cd866558035daf897478bb2bd4d670dfc4e916301c82

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                            Filesize

                                                            12KB

                                                            MD5

                                                            36e70d44b14e24af3c384a5673de42d3

                                                            SHA1

                                                            2ed90b14e063e38b6162686c5df965e8d9858198

                                                            SHA256

                                                            e747513077b0b2ed366c6d5fef1e1fb9125ffb3d94ef39b1d9bf30c791227cea

                                                            SHA512

                                                            bbc5ba8c9892b44730a606a68c63c60f973367d9968455dcce71ce416fe8bea773be480697514af7c40733ff5cddd55af187c55a3fa9bc2a1378c0fc350013bc

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                            Filesize

                                                            278KB

                                                            MD5

                                                            07acc2e109b564f3f74e528d0d7a7f01

                                                            SHA1

                                                            51b336ae7f2f9554161bb66ae6000a32f2905cc4

                                                            SHA256

                                                            f5a5fcac8c7904f56d1830135168b68e75332545902cb5978ffcc3784d6f80fb

                                                            SHA512

                                                            80e4c418f502d253449a1f83b6e5dbc0089737167fbefc6b265ca6d5df6c0f8b52b29612b0f02d1e9d5fb9fe9c04e9f8839321de4eab9602ce63a243b527fee4

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                            Filesize

                                                            111KB

                                                            MD5

                                                            7343d733e75de3c3db9cdd6b2fa5fe7b

                                                            SHA1

                                                            1875c6e539621f00d91dbd982a0e67ddc5882062

                                                            SHA256

                                                            598a03f55caecffb98211c971cb66ed280f29e2257fe34ca5c95c6cfbcd3f160

                                                            SHA512

                                                            786ee4bdc7952cd4de09a0f90ae1d04a33fb7b8b3467f93867c20ce5ebdffc5eacf65db404b750d35bbbf2ee5f01383936c487d49e055273d1b32ffe44adedee

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5825f2.TMP

                                                            Filesize

                                                            92KB

                                                            MD5

                                                            455d832aaa5bacf069b5ed2deb4bf2c1

                                                            SHA1

                                                            4a6e7aaa461fee4dcce130b2b02971a0533ae3eb

                                                            SHA256

                                                            b2a7e18d670eb4187329a6af4981f77d77b1328781544aa24f5fc80b2fc316e0

                                                            SHA512

                                                            8eb446c9fe86ac11dbe1dd61f83931a2317bcdac13853fc64008bca4add4eaa1e4086b7c12f50f5353bf54de9a7de7ebc3d25d12cb7d0b4efbb35e2fd6f688f8

                                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                            Filesize

                                                            2B

                                                            MD5

                                                            99914b932bd37a50b983c5e7c90ae93b

                                                            SHA1

                                                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                            SHA256

                                                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                            SHA512

                                                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                          • C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            216B

                                                            MD5

                                                            f2f219edd759f990011d150f6e85e099

                                                            SHA1

                                                            24ba215088361a6ac14020062ab7fc38fb679698

                                                            SHA256

                                                            692d8e063a280c37a540130eec0e0a23d73cb80880c7f326867f265e714a4b25

                                                            SHA512

                                                            1f320d14ea56853243038a2254e9db2c13461267b6f38c031804777cd4bd0d5be2f4669ad6ed62a98206d8351721c4fbd80f7463f90d5af492e4cf60090ba2d6

                                                          • C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            48B

                                                            MD5

                                                            2b7735e605957e6880809f4baf48204c

                                                            SHA1

                                                            c85d350c965a0eff38dabb087d02ce1b64d9d680

                                                            SHA256

                                                            e8ae7a9d670a57a343197a0b313c61e0f7497913c75e6a38a86398fb67122077

                                                            SHA512

                                                            e540ba87a77961e69d7e82ae5890c989b1364a9e4682b7026b75e84a0b43c28bf1865519a96a1dde4f6af9647dda1bcd1d2be1afa22e1a7b4568174675a9a81e

                                                          • C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_0

                                                            Filesize

                                                            8KB

                                                            MD5

                                                            cf89d16bb9107c631daabf0c0ee58efb

                                                            SHA1

                                                            3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                            SHA256

                                                            d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                            SHA512

                                                            8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                          • C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_1

                                                            Filesize

                                                            264KB

                                                            MD5

                                                            f50f89a0a91564d0b8a211f8921aa7de

                                                            SHA1

                                                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                            SHA256

                                                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                            SHA512

                                                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                          • C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_2

                                                            Filesize

                                                            8KB

                                                            MD5

                                                            0962291d6d367570bee5454721c17e11

                                                            SHA1

                                                            59d10a893ef321a706a9255176761366115bedcb

                                                            SHA256

                                                            ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                            SHA512

                                                            f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                          • C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_3

                                                            Filesize

                                                            8KB

                                                            MD5

                                                            41876349cb12d6db992f1309f22df3f0

                                                            SHA1

                                                            5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                            SHA256

                                                            e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                            SHA512

                                                            e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                          • C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT

                                                            Filesize

                                                            16B

                                                            MD5

                                                            46295cac801e5d4857d09837238a6394

                                                            SHA1

                                                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                            SHA256

                                                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                            SHA512

                                                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                          • C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

                                                            Filesize

                                                            41B

                                                            MD5

                                                            5af87dfd673ba2115e2fcf5cfdb727ab

                                                            SHA1

                                                            d5b5bbf396dc291274584ef71f444f420b6056f1

                                                            SHA256

                                                            f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                            SHA512

                                                            de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                          • C:\Users\Admin\AppData\Local\Temp\nscFF22.tmp\modern-wizard.bmp

                                                            Filesize

                                                            150KB

                                                            MD5

                                                            3614a4be6b610f1daf6c801574f161fe

                                                            SHA1

                                                            6edee98c0084a94caa1fe0124b4c19f42b4e7de6

                                                            SHA256

                                                            16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

                                                            SHA512

                                                            06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

                                                          • C:\Users\Admin\AppData\Local\Temp\nscFF22.tmp\nsProcess.dll

                                                            Filesize

                                                            15KB

                                                            MD5

                                                            08072dc900ca0626e8c079b2c5bcfcf3

                                                            SHA1

                                                            35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

                                                            SHA256

                                                            bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

                                                            SHA512

                                                            8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

                                                          • C:\Users\Admin\Downloads\Unconfirmed 662700.crdownload

                                                            Filesize

                                                            2.3MB

                                                            MD5

                                                            1b54b70beef8eb240db31718e8f7eb5d

                                                            SHA1

                                                            da5995070737ec655824c92622333c489eb6bce4

                                                            SHA256

                                                            7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

                                                            SHA512

                                                            fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

                                                          • \Users\Admin\AppData\Local\Temp\nscFF22.tmp\StdUtils.dll

                                                            Filesize

                                                            110KB

                                                            MD5

                                                            db11ab4828b429a987e7682e495c1810

                                                            SHA1

                                                            29c2c2069c4975c90789dc6d3677b4b650196561

                                                            SHA256

                                                            c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

                                                            SHA512

                                                            460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

                                                          • \Users\Admin\AppData\Local\Temp\nscFF22.tmp\System.dll

                                                            Filesize

                                                            22KB

                                                            MD5

                                                            a36fbe922ffac9cd85a845d7a813f391

                                                            SHA1

                                                            f656a613a723cc1b449034d73551b4fcdf0dcf1a

                                                            SHA256

                                                            fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

                                                            SHA512

                                                            1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

                                                          • \Users\Admin\AppData\Local\Temp\nscFF22.tmp\nsDialogs.dll

                                                            Filesize

                                                            20KB

                                                            MD5

                                                            4e5bc4458afa770636f2806ee0a1e999

                                                            SHA1

                                                            76dcc64af867526f776ab9225e7f4fe076487765

                                                            SHA256

                                                            91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

                                                            SHA512

                                                            b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

                                                          • \Users\Admin\AppData\Local\Temp\nscFF22.tmp\nsExec.dll

                                                            Filesize

                                                            17KB

                                                            MD5

                                                            2095af18c696968208315d4328a2b7fe

                                                            SHA1

                                                            b1b0e70c03724b2941e92c5098cc1fc0f2b51568

                                                            SHA256

                                                            3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

                                                            SHA512

                                                            60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

                                                          • memory/2136-12698-0x0000000000F90000-0x0000000001442000-memory.dmp

                                                            Filesize

                                                            4.7MB

                                                          • memory/3052-12764-0x000000006F6D0000-0x00000000709E0000-memory.dmp

                                                            Filesize

                                                            19.1MB

                                                          • memory/4964-12718-0x00007FFC119E0000-0x00007FFC119E1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                          • memory/4964-12719-0x00007FFC0F570000-0x00007FFC0F571000-memory.dmp

                                                            Filesize

                                                            4KB