Malware Analysis Report

2025-01-18 23:50

Sample ID 241108-v98mcavrgv
Target https://steamcommunity.com/market/listings/730/Gallery%20Case
Tags
steam defense_evasion discovery evasion execution persistence phishing privilege_escalation
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file https://steamcommunity.com/market/listings/730/Gallery%20Case was found to be: Likely malicious.

Malicious Activity Summary

steam defense_evasion discovery evasion execution persistence phishing privilege_escalation

Creates new service(s)

Stops running service(s)

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Network Service Discovery

Adds Run key to start application

Enumerates connected drives

Suspicious use of SetThreadContext

Drops file in System32 directory

Detected potential entity reuse from brand STEAM.

Launches sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass

Drops file in Windows directory

Drops file in Program Files directory

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Access Token Manipulation: Create Process with Token

Enumerates system info in registry

Modifies registry class

Checks processor information in registry

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

NTFS ADS

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies system certificate store

Checks SCSI registry key(s)

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-08 17:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-08 17:42

Reported

2024-11-08 17:57

Platform

win11-20241007-en

Max time kernel

644s

Max time network

898s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steamcommunity.com/market/listings/730/Gallery%20Case

Signatures

Creates new service(s)

persistence execution

Downloads MZ/PE file

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\gldriverquery64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\gldriverquery.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\Steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\gldriverquery64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\gldriverquery.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Steam\steamservice.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x86.exe N/A
N/A N/A \??\f:\055293abc2f9c598b5f8897c7c91\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x64.exe N/A
N/A N/A \??\f:\a1978e901c0033ba9b6e\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\x64launcher.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\x64launcher.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\x64launcher.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\TheFarmerWasReplaced.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\UnityCrashHandler64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\GameOverlayUI.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\UnityCrashHandler64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\Steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\Steam.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{f65db027-aff3-4070-886a-0d87064aabb1} = "\"C:\\ProgramData\\Package Cache\\{f65db027-aff3-4070-886a-0d87064aabb1}\\vcredist_x86.exe\" /burn.runonce" C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{050d4fc8-5d48-4b8f-8972-47c82c46020f} = "\"C:\\ProgramData\\Package Cache\\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\\vcredist_x64.exe\" /burn.runonce" C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent" C:\Users\Admin\Downloads\SteamSetup.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\System32\GameBarPresenceWriter.exe N/A
N/A N/A C:\Windows\System32\GameBarPresenceWriter.exe N/A

Detected potential entity reuse from brand STEAM.

phishing steam

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\mfcm100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfcm100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100chs.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100kor.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100enu.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100esn.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100cht.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100ita.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100jpn.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100rus.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcr100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100rus.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfcm100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100enu.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100deu.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100fra.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100ita.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100kor.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\vcomp100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\atl100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfcm100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100chs.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100cht.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100jpn.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\msvcr100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\msvcp100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100deu.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100fra.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc100esn.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\atl100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SysWOW64\mfc100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\msvcp100.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\vcomp100.dll C:\Windows\system32\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\dualshock_4_swedish.txt_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_polish.txt_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_button_plus.svg_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_down_sm.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\bin\gldriverquery64.exe_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\steamapps\appmanifest_228980.acf.2154186699.tmp C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\bird_142-uhd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\player_415.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\spider_37-uhd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\GauntletSheet-hd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\bird_62.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\ship_81-uhd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\player_305-uhd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\robot_55.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\ship_63-uhd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\player_390-hd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_ltrackpad_right_sm.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_lstick_click_sm.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\PlayerExplosion_05.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\game_bg_26_001.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\dart_22-uhd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\dart_56.png C:\Program Files (x86)\Steam\Steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\resource\icon_steamvr_desktop.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\joyconpair_left_sl_lg.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\gjFont52.fnt C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\bird_140-hd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\ship_123-hd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\ship_58-uhd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_right_lg.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_dpad_down_md.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\GJ_popup-hd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\player_ball_112-uhd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\player_18-uhd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\player_79-uhd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\ship_132-hd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\ship_56.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\tutorial_02.png C:\Program Files (x86)\Steam\Steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0307.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\GJ_square02.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s788.ogg C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\spider_13-hd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\public\steamclean_french.txt_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\locales\nl.pak_ C:\Program Files (x86)\Steam\steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\PlayerExplosion_08.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\robot_60.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\2060160\TheFarmerWasReplaced_Data\Managed\UnityEngine.TerrainModule.dll C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\player_253-hd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\ship_03-uhd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\ship_20-hd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s288.ogg C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\swing_22-uhd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\player_ball_114-hd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\ship_49-hd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_touchpad_down_md.png_ C:\Program Files (x86)\Steam\steam.exe N/A
File created C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_mouse_r_click.svg_ C:\Program Files (x86)\Steam\steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\player_25-hd.plist C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\icons\player_388-hd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\player_298-uhd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\player_69-hd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\player_ball_62-hd.png C:\Program Files (x86)\Steam\Steam.exe N/A
File opened for modification C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\icons\robot_57.png C:\Program Files (x86)\Steam\Steam.exe N/A
File created C:\Program Files (x86)\Counter-Strike-1.6\cstrike\classes\glock18.res C:\Users\Admin\AppData\Local\Temp\is-NG1MF.tmp\Counter-Strike_1.6.tmp N/A
File opened for modification C:\Program Files (x86)\Counter-Strike-1.6\cstrike\gfx\env\morningdewbk.pcx C:\Users\Admin\AppData\Local\Temp\is-NG1MF.tmp\Counter-Strike_1.6.tmp N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI383B.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF0AFE51CA3363BF17.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI2B58.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5d2ae5.msp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF5B0BD7DEA6AE7B4C.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9992_1905103704\_platform_specific\win_x64\widevinecdm.dll.sig C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9992_1905103704\_metadata\verified_contents.json C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9992_1905103704\manifest.fingerprint C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
File opened for modification C:\Windows\Installer\MSI2CD0.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\e5d2ae5.msp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFD157D7A2338AE25B.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9992_1905103704\manifest.json C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
File opened for modification \??\c:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF10F884DE0860D209.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFE0CFDE803FF79A75.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF9D0D360B255628E0.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF14CDDA3041A699C3.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFA4DEF62C22282468.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFC6BD42C042DCCA4B.TMP C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF89A0AAE3A084FB8E.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI39C3.tmp C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9992_1905103704\LICENSE C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
File created C:\Windows\Installer\e5d2ade.msp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e5d2ade.msp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DFB6D2048AB0D8F308.TMP C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9992_1905103704\_platform_specific\win_x64\widevinecdm.dll C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\SystemTemp\~DF4A5F561B4E0FD7BD.TMP C:\Windows\system32\msiexec.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Subvert Trust Controls: Mark-of-the-Web Bypass

defense_evasion
Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Counter-Strike_1.6.exe:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Access Token Manipulation: Create Process with Token

defense_evasion privilege_escalation
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Steam\steamservice.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Steam\steamservice.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Steam\steamservice.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Common Files\Steam\steamservice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x86.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\is-NG1MF.tmp\Counter-Strike_1.6.tmp N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\f:\055293abc2f9c598b5f8897c7c91\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\steam.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\Steam.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\GameOverlayUI.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\Counter-Strike_1.6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Downloads\SteamSetup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\steam.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\f:\a1978e901c0033ba9b6e\Setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\bin\gldriverquery.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x64.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000235a573f571b962e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000235a573f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900235a573f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d235a573f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000235a573f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\steam.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\Steam.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\TheFarmerWasReplaced.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\GameOverlayUI.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\steam.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\Steam.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\f:\055293abc2f9c598b5f8897c7c91\Setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\f:\a1978e901c0033ba9b6e\Setup.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz \??\f:\a1978e901c0033ba9b6e\Setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\GameOverlayUI.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\steam.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\steam.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\steam.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\Steam.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz \??\f:\055293abc2f9c598b5f8897c7c91\Setup.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\TheFarmerWasReplaced.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink\ = "URL:steamlink protocol" C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\KB2524860 = "Servicing_Key" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steam\DefaultIcon C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Patches\Patches = 3400440035003400300037003600430045004400340046003500420041003300320042004200440033004500350046004100440031004300440034004300390000000000 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\4D54076CED4F5BA32BBD3E5FAD1CD4C9\SourceList C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink\Shell C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\Patches\Patches = 3200440030003000350038004600360046003000380041003700340033003300300039003100380034004200450031003100370038004300390035004200320000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList\LastUsedSource = "n;2;f:\\055293abc2f9c598b5f8897c7c91\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{f65db027-aff3-4070-886a-0d87064aabb1}\Dependents C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\FT_VCRedist_x86_KB2565063_Detection C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\ProductName = "Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219" C:\Windows\system32\msiexec.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe" C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steam\ = "URL:steam protocol" C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steam\DefaultIcon\ = "steam.exe" C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steam\URL Protocol C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12\Dependents\{050d4fc8-5d48-4b8f-8972-47c82c46020f} C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink\Shell\Open C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1D5E3C0FEDA1E123187686FED06E995A\VCRedist_x86_enu C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v12 C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steam\Shell\Open\Command C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\steam C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol" C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink\Shell\Open\Command C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink\URL Protocol C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink\DefaultIcon C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink\Shell\Open\Command C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\Dependents\{050d4fc8-5d48-4b8f-8972-47c82c46020f} C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\"" C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\SourceList\LastUsedSource = "n;2;f:\\a1978e901c0033ba9b6e\\" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1926E8D15D0BCE53481466615F760A7F C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1926E8D15D0BCE53481466615F760A7F\Version = "167812379" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\ = "{050d4fc8-5d48-4b8f-8972-47c82c46020f}" C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\DisplayName = "Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501" C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe" C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\system32\BackgroundTransferHost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\Steam.exe\" -- \"%1\"" C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\Steam.exe\" -- \"%1\"" C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\steam\Shell\Open\Command C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\2D0058F6F08A743309184BE1178C95B2\SourceList\Net C:\Windows\system32\msiexec.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Program Files (x86)\Steam\steam.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Program Files (x86)\Steam\steam.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files (x86)\Steam\Steam.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e650190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Program Files (x86)\Steam\Steam.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Program Files (x86)\Steam\steam.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 951920.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Counter-Strike_1.6.torrent:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 274522.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Counter-Strike_1.6.exe:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\Steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\Steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\Steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\SteamSetup.exe N/A
N/A N/A C:\Program Files (x86)\Steam\bin\steamservice.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steam.exe N/A
N/A N/A C:\Program Files (x86)\Steam\Steam.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Steam\steamservice.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x86.exe N/A
N/A N/A \??\f:\055293abc2f9c598b5f8897c7c91\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x64.exe N/A
N/A N/A \??\f:\a1978e901c0033ba9b6e\Setup.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe N/A
N/A N/A C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\TheFarmerWasReplaced.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2320 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 2844 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 3060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 2336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 2336 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2320 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://steamcommunity.com/market/listings/730/Gallery%20Case

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb355c3cb8,0x7ffb355c3cc8,0x7ffb355c3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 /prefetch:8

C:\Users\Admin\Downloads\SteamSetup.exe

"C:\Users\Admin\Downloads\SteamSetup.exe"

C:\Program Files (x86)\Steam\bin\steamservice.exe

"C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install

C:\Program Files (x86)\Steam\steam.exe

"C:\Program Files (x86)\Steam\steam.exe"

C:\Program Files (x86)\Steam\steam.exe

"C:\Program Files (x86)\Steam\steam.exe"

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=10228" "-buildid=1730853027" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1730853027 --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0x7ffb3518af00,0x7ffb3518af0c,0x7ffb3518af18

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1564,i,11457554991915657284,1918192217085543703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1568 --mojo-platform-channel-handle=1556 /prefetch:2

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --field-trial-handle=2140,i,11457554991915657284,1918192217085543703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2144 --mojo-platform-channel-handle=2136 /prefetch:11

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x00000000000004AC 0x00000000000004D4

C:\Program Files (x86)\Steam\bin\gldriverquery64.exe

.\bin\gldriverquery64.exe

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --field-trial-handle=2720,i,11457554991915657284,1918192217085543703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2732 --mojo-platform-channel-handle=2716 /prefetch:13

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,11457554991915657284,1918192217085543703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3108 --mojo-platform-channel-handle=3100 /prefetch:1

C:\Program Files (x86)\Steam\bin\gldriverquery.exe

.\bin\gldriverquery.exe

C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe

.\bin\vulkandriverquery64.exe

C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe

.\bin\vulkandriverquery.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6696 /prefetch:2

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3752,i,11457554991915657284,1918192217085543703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3756 --mojo-platform-channel-handle=3748 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --field-trial-handle=3716,i,11457554991915657284,1918192217085543703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3656 --mojo-platform-channel-handle=3680 /prefetch:12

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Program Files (x86)\Steam\Steam.exe

"C:\Program Files (x86)\Steam\Steam.exe"

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=9940" "-buildid=1730853027" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1730853027 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffb3518af00,0x7ffb3518af0c,0x7ffb3518af18

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1556,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1560 --mojo-platform-channel-handle=1548 /prefetch:2

C:\Program Files (x86)\Steam\bin\gldriverquery64.exe

.\bin\gldriverquery64.exe

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --field-trial-handle=2204,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2208 --mojo-platform-channel-handle=2200 /prefetch:11

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --field-trial-handle=2548,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2120 --mojo-platform-channel-handle=2712 /prefetch:13

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3052,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3056 --mojo-platform-channel-handle=3048 /prefetch:1

C:\Program Files (x86)\Steam\bin\gldriverquery.exe

.\bin\gldriverquery.exe

C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe

.\bin\vulkandriverquery64.exe

C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe

.\bin\vulkandriverquery.exe

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --field-trial-handle=3692,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3700 --mojo-platform-channel-handle=3704 /prefetch:14

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --field-trial-handle=3712,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3708 --mojo-platform-channel-handle=3880 /prefetch:12

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3960,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3972 --mojo-platform-channel-handle=3924 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4000,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4128 --mojo-platform-channel-handle=4136 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4188,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4180 --mojo-platform-channel-handle=4108 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4788,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4792 --mojo-platform-channel-handle=4780 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4812,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4816 --mojo-platform-channel-handle=4800 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4552,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4184 --mojo-platform-channel-handle=4636 /prefetch:10

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4700,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4636 --mojo-platform-channel-handle=4356 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4296,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4216 --mojo-platform-channel-handle=4244 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4676,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4668 --mojo-platform-channel-handle=4228 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4832,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4500 --mojo-platform-channel-handle=2024 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4756,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4996 --mojo-platform-channel-handle=4320 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4720,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4716 --mojo-platform-channel-handle=4128 /prefetch:1

C:\Program Files (x86)\Common Files\Steam\steamservice.exe

"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /installscript "C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\runasadmin.vdf" 322170

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x86.exe

"C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x86.exe" /quiet /norestart

\??\f:\055293abc2f9c598b5f8897c7c91\Setup.exe

f:\055293abc2f9c598b5f8897c7c91\Setup.exe /quiet /norestart

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x64.exe

"C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x64.exe" /quiet /norestart

\??\f:\a1978e901c0033ba9b6e\Setup.exe

f:\a1978e901c0033ba9b6e\Setup.exe /quiet /norestart

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe

"C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe" /quiet /norestart

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe

"C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe" /quiet /norestart -burn.unelevated BurnPipe.{71E496C4-DE59-4BBD-A61B-747C31895C9A} {57A104EA-FB04-4C33-AE2D-8E93B4008C59} 9180

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe

"C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe" /quiet /norestart

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe

"C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe" /quiet /norestart -burn.unelevated BurnPipe.{76D077C0-8864-408C-A967-C8121AADF733} {7CD0FE32-3F7C-4CCA-83DD-1A35FC3A2CFC} 2216

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe

"C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe"

C:\Program Files (x86)\Steam\bin\x64launcher.exe

"C:\Program Files (x86)\Steam\bin\x64launcher.exe" -hproc 1064 -hthread 10e0 -baseoverlayname C:\Program Files (x86)\Steam\gameoverlayrenderer64.dll

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe

"C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe"

C:\Program Files (x86)\Steam\bin\x64launcher.exe

"C:\Program Files (x86)\Steam\bin\x64launcher.exe" -hproc 1338 -hthread 12d0 -baseoverlayname C:\Program Files (x86)\Steam\gameoverlayrenderer64.dll

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4828,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4940 --mojo-platform-channel-handle=5084 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5004,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4468 --mojo-platform-channel-handle=2020 /prefetch:1

C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\TheFarmerWasReplaced.exe

"C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\TheFarmerWasReplaced.exe"

C:\Program Files (x86)\Steam\bin\x64launcher.exe

"C:\Program Files (x86)\Steam\bin\x64launcher.exe" -hproc 5db8 -hthread 3994 -baseoverlayname C:\Program Files (x86)\Steam\gameoverlayrenderer64.dll

C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\UnityCrashHandler64.exe

"C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\UnityCrashHandler64.exe" --attach 18348 1706022735872

C:\Program Files (x86)\Steam\GameOverlayUI.exe

"C:\Program Files (x86)\Steam\GameOverlayUI.exe" -pid 18348 -steampid 9940 -manuallyclearframes 0 -gameid 2060160

C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\UnityCrashHandler64.exe

"C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\UnityCrashHandler64.exe" "18348" "1706022735872"

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4768,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=5032 --mojo-platform-channel-handle=4728 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=2072,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4904 --mojo-platform-channel-handle=4752 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=4820,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=5080 --mojo-platform-channel-handle=2020 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=4108,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3768 --mojo-platform-channel-handle=1912 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=4916,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=5108 --mojo-platform-channel-handle=4752 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=4596,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4884 --mojo-platform-channel-handle=4196 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=4920,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4928 --mojo-platform-channel-handle=5112 /prefetch:1

C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe

"C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1730853027 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=4940,i,4133644663278243223,14657497851982009703,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4748 --mojo-platform-channel-handle=4868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6868 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2092 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7000 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6488 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7432 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7804 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7620 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5840 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8036 /prefetch:8

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6312 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8096 /prefetch:8

C:\Users\Admin\Downloads\Counter-Strike_1.6.exe

"C:\Users\Admin\Downloads\Counter-Strike_1.6.exe"

C:\Users\Admin\AppData\Local\Temp\is-NG1MF.tmp\Counter-Strike_1.6.tmp

"C:\Users\Admin\AppData\Local\Temp\is-NG1MF.tmp\Counter-Strike_1.6.tmp" /SL5="$603B8,784384,784384,C:\Users\Admin\Downloads\Counter-Strike_1.6.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C sc.exe stop fleshost

C:\Windows\SysWOW64\sc.exe

sc.exe stop fleshost

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C sc.exe delete fleshost

C:\Windows\SysWOW64\sc.exe

sc.exe delete fleshost

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C sc.exe create fleshost start=auto binpath=C:\Users\Admin\AppData\Roaming\Fleshost\Fleshost.exe

C:\Windows\SysWOW64\sc.exe

sc.exe create fleshost start=auto binpath=C:\Users\Admin\AppData\Roaming\Fleshost\Fleshost.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C sc.exe start fleshost

C:\Windows\SysWOW64\sc.exe

sc.exe start fleshost

C:\Users\Admin\AppData\Roaming\Fleshost\Fleshost.exe

C:\Users\Admin\AppData\Roaming\Fleshost\Fleshost.exe

C:\Program Files (x86)\Counter-Strike-1.6\hl.exe

"C:\Program Files (x86)\Counter-Strike-1.6\hl.exe" -steam -game cstrike -appid 10 -noforcemparms -noforcemaccel

C:\Program Files (x86)\Common Files\Steam\steamservice.exe

"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService

C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe

"C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update

C:\Program Files (x86)\Common Files\Steam\steamservice.exe

"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService

C:\Windows\System32\GameBarPresenceWriter.exe

"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 13640 -ip 13640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 13640 -s 1300

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 13640 -ip 13640

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 13640 -s 1300

C:\Program Files (x86)\Counter-Strike-1.6\hl.exe

"C:\Program Files (x86)\Counter-Strike-1.6\hl.exe" -steam -game cstrike -appid 10 -noforcemparms -noforcemaccel

C:\Windows\System32\GameBarPresenceWriter.exe

"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,1277713560987852477,9174646742723513471,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1

Network

Country Destination Domain Proto
US 8.8.8.8:53 steamcommunity.com udp
GB 104.82.234.109:443 api.steampowered.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
N/A 224.0.0.251:5353 udp
US 23.192.21.216:443 store.steampowered.com tcp
US 23.192.21.216:443 store.steampowered.com tcp
US 151.101.67.52:443 cdn.steamstatic.com tcp
GB 2.23.210.82:80 e5.o.lencr.org tcp
US 151.101.67.52:443 cdn.steamstatic.com tcp
US 151.101.67.52:443 cdn.steamstatic.com tcp
GB 2.19.117.21:80 test.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
DE 155.133.250.20:27019 cmp2-fra1.steamserver.net tcp
DE 155.133.250.4:27020 cmp1-fra1.steamserver.net tcp
N/A 127.0.0.1:62292 tcp
N/A 127.0.0.1:62290 tcp
AT 146.66.155.85:27018 cmp2-vie1.steamserver.net tcp
AT 146.66.155.84:443 cmp1-vie1.steamserver.net tcp
GB 2.23.210.75:80 e5.o.lencr.org tcp
GB 2.23.210.75:80 e5.o.lencr.org tcp
AT 146.66.155.84:27018 cmp1-vie1.steamserver.net tcp
US 155.133.229.4:27024 cmp1-fra2.steamserver.net tcp
DE 155.133.250.20:443 cmp2-fra1.steamserver.net tcp
US 8.8.8.8:53 cmp2-fra2.steamserver.net udp
US 155.133.229.20:27024 cmp2-fra2.steamserver.net tcp
NL 155.133.248.43:443 cmp2-ams1.steamserver.net tcp
NL 155.133.248.43:27018 cmp2-ams1.steamserver.net tcp
SE 162.254.198.46:27021 ext3-sto1.steamserver.net tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 155.133.229.4:27020 cmp1-fra2.steamserver.net tcp
US 155.133.229.4:27019 cmp1-fra2.steamserver.net tcp
SE 162.254.198.46:27029 ext3-sto1.steamserver.net tcp
SE 162.254.198.104:27029 ext2-sto1.steamserver.net tcp
SE 155.133.252.69:27019 cmp2-sto2.steamserver.net tcp
SE 162.254.198.104:443 ext2-sto1.steamserver.net tcp
SE 155.133.252.68:27019 cmp1-sto2.steamserver.net tcp
US 8.8.4.4:443 dns.google udp
GB 104.82.234.109:443 api.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
GB 142.250.179.228:443 udp
US 8.8.8.8:443 dns.google udp
GB 216.58.201.99:443 tcp
GB 2.18.66.168:443 tcp
GB 92.123.128.137:443 r.bing.com tcp
GB 92.123.128.137:443 r.bing.com tcp
GB 92.123.128.137:443 r.bing.com tcp
GB 92.123.128.137:443 r.bing.com tcp
GB 92.123.128.137:443 r.bing.com tcp
GB 92.123.128.137:443 r.bing.com tcp
US 20.189.173.14:443 browser.pipe.aria.microsoft.com tcp
GB 92.123.128.191:443 www.bing.com tcp
GB 2.19.117.24:80 test.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
US 8.8.8.8:53 ext1-waw1.steamserver.net udp
N/A 127.0.0.1:62808 tcp
N/A 127.0.0.1:62807 tcp
PL 155.133.230.34:27025 ext1-waw1.steamserver.net tcp
PL 155.133.230.34:27028 ext1-waw1.steamserver.net tcp
PL 155.133.230.34:443 ext1-waw1.steamserver.net tcp
DE 155.133.250.20:27023 cmp2-fra1.steamserver.net tcp
DE 155.133.250.20:27018 cmp2-fra1.steamserver.net tcp
US 155.133.229.20:27020 cmp2-fra2.steamserver.net tcp
US 155.133.229.4:27023 cmp1-fra2.steamserver.net tcp
DE 155.133.250.4:443 cmp1-fra1.steamserver.net tcp
SE 162.254.198.44:27035 ext1-sto1.steamserver.net tcp
US 8.8.8.8:53 44.198.254.162.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:443 dns.google udp
JP 45.121.184.23:27037 ext4-tyo3.steamserver.net tcp
JP 45.121.184.21:27030 ext2-tyo3.steamserver.net tcp
JP 45.121.184.22:443 ext3-tyo3.steamserver.net tcp
DE 155.133.250.20:27023 cmp2-fra1.steamserver.net tcp
US 155.133.229.4:27019 cmp1-fra2.steamserver.net tcp
US 8.8.8.8:53 21.184.121.45.in-addr.arpa udp
US 8.8.8.8:53 22.184.121.45.in-addr.arpa udp
BR 155.133.227.34:27034 ext1-gru1.steamserver.net tcp
BR 155.133.227.50:27029 ext2-gru1.steamserver.net tcp
AR 155.133.255.100:27023 ext1-eze1.steamserver.net tcp
AR 155.133.255.164:27025 ext2-eze1.steamserver.net tcp
BR 155.133.227.50:443 ext2-gru1.steamserver.net tcp
US 8.8.8.8:53 ext2-scl1.steamserver.net udp
CL 155.133.249.164:27023 ext2-scl1.steamserver.net tcp
CL 155.133.249.164:27019 ext2-scl1.steamserver.net tcp
PE 155.133.244.34:27033 ext1-lim1.steamserver.net tcp
US 8.8.8.8:53 50.227.133.155.in-addr.arpa udp
US 8.8.8.8:53 100.255.133.155.in-addr.arpa udp
US 8.8.8.8:53 164.255.133.155.in-addr.arpa udp
US 8.8.8.8:53 164.249.133.155.in-addr.arpa udp
US 8.8.8.8:53 34.244.133.155.in-addr.arpa udp
PE 155.133.244.34:27035 ext1-lim1.steamserver.net tcp
US 8.8.8.8:53 ext1-scl1.steamserver.net udp
CL 155.133.249.180:443 ext1-scl1.steamserver.net tcp
US 8.8.8.8:53 ext2-par1.steamserver.net udp
FR 185.25.182.52:27034 ext2-par1.steamserver.net tcp
US 8.8.8.8:53 cmp1-iad1.steamserver.net udp
US 162.254.192.98:443 cmp1-iad1.steamserver.net tcp
US 8.8.8.8:53 e5.o.lencr.org udp
GB 2.23.210.75:80 e5.o.lencr.org tcp
US 8.8.8.8:53 52.182.25.185.in-addr.arpa udp
US 8.8.8.8:53 98.192.254.162.in-addr.arpa udp
US 8.8.8.8:443 dns.google udp
GB 142.250.200.14:443 tcp
GB 74.125.105.39:443 udp
HK 103.28.54.173:27020 ext7-hkg1.steamserver.net tcp
US 8.8.8.8:53 cmp1-hkg1.steamserver.net udp
HK 103.28.54.173:27034 ext7-hkg1.steamserver.net tcp
HK 103.28.54.100:443 cmp1-hkg1.steamserver.net tcp
JP 45.121.184.21:27038 ext2-tyo3.steamserver.net tcp
US 8.8.8.8:53 14.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 39.105.125.74.in-addr.arpa udp
JP 45.121.184.21:27036 ext2-tyo3.steamserver.net tcp
JP 45.121.184.21:443 ext2-tyo3.steamserver.net tcp
SG 103.10.124.5:27018 cmp2-sgp1.steamserver.net tcp
SG 103.10.124.4:27020 cmp1-sgp1.steamserver.net tcp
US 8.8.8.8:53 e6.o.lencr.org udp
GB 2.23.210.75:80 e6.o.lencr.org tcp
SG 103.10.124.4:443 cmp1-sgp1.steamserver.net tcp
US 162.254.195.75:443 cmp2-lax1.steamserver.net tcp
IN 155.133.225.21:27024 ext2-maa2.steamserver.net tcp
US 8.8.8.8:53 cmp1-atl3.steamserver.net udp
US 162.254.199.165:443 cmp1-atl3.steamserver.net tcp
US 8.8.8.8:53 4.124.10.103.in-addr.arpa udp
US 8.8.8.8:53 21.225.133.155.in-addr.arpa udp
IN 155.133.224.22:27034 ext1-bom2.steamserver.net tcp
IN 155.133.224.22:27038 ext1-bom2.steamserver.net tcp
IN 155.133.224.22:443 ext1-bom2.steamserver.net tcp
IN 155.133.225.21:27034 ext2-maa2.steamserver.net tcp
IN 155.133.225.21:27028 ext2-maa2.steamserver.net tcp
IN 155.133.225.21:443 ext2-maa2.steamserver.net tcp
AE 185.25.183.36:27019 ext1-dxb1.steamserver.net tcp
AE 185.25.183.36:27035 ext1-dxb1.steamserver.net tcp
SG 103.10.124.5:27019 cmp2-sgp1.steamserver.net tcp
SG 103.10.124.4:27018 cmp1-sgp1.steamserver.net tcp
DE 155.133.250.20:27018 cmp2-fra1.steamserver.net tcp
US 155.133.229.4:27024 cmp1-fra2.steamserver.net tcp
US 8.8.4.4:443 dns.google udp
GB 216.58.201.99:443 tcp
US 8.8.4.4:443 dns.google udp
GB 216.58.201.99:443 udp
N/A 10.127.255.255:27036 udp
GB 2.19.117.14:80 clientconfig.akamai.steamstatic.com tcp
GB 2.19.117.14:80 clientconfig.akamai.steamstatic.com tcp
GB 2.19.117.14:80 clientconfig.akamai.steamstatic.com tcp
GB 2.19.117.14:80 clientconfig.akamai.steamstatic.com tcp
GB 2.19.117.14:80 clientconfig.akamai.steamstatic.com tcp
GB 2.19.117.14:80 clientconfig.akamai.steamstatic.com tcp
GB 2.19.117.14:80 clientconfig.akamai.steamstatic.com tcp
GB 2.19.117.14:80 clientconfig.akamai.steamstatic.com tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
GB 2.19.117.27:443 steamstore-a.akamaihd.net tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
GB 2.19.117.27:443 steamstore-a.akamaihd.net tcp
GB 2.19.117.27:443 steamstore-a.akamaihd.net tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 8.8.8.8:443 dns.google udp
US 23.192.21.216:443 store.steampowered.com tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.23.210.82:80 r11.o.lencr.org tcp
GB 104.82.234.109:443 api.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 151.101.131.52:80 shared.steamstatic.com tcp
US 151.101.131.52:80 shared.steamstatic.com tcp
US 151.101.131.52:80 shared.steamstatic.com tcp
GB 2.19.117.4:443 tcp
US 23.192.21.216:443 store.steampowered.com tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
US 151.101.67.52:443 shared.steamstatic.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
US 151.101.3.52:443 shared.steamstatic.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
US 172.64.145.151:443 shared.cloudflare.steamstatic.com tcp
US 23.192.21.216:443 store.steampowered.com tcp
US 23.192.21.216:443 store.steampowered.com tcp
N/A 127.0.0.1:27060 tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
US 151.101.3.52:443 shared.steamstatic.com tcp
US 151.101.3.52:443 shared.steamstatic.com tcp
US 151.101.3.52:443 shared.steamstatic.com tcp
US 8.8.8.8:53 cache13-lhr1.steamcontent.com udp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
GB 2.23.210.82:80 e6.o.lencr.org tcp
GB 162.254.196.26:443 cache16-lhr1.steamcontent.com tcp
GB 2.23.210.75:80 e6.o.lencr.org tcp
US 8.8.8.8:53 23.196.254.162.in-addr.arpa udp
US 8.8.8.8:53 26.196.254.162.in-addr.arpa udp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
US 151.101.131.52:443 shared.steamstatic.com tcp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
US 8.8.8.8:53 client-update.steamstatic.com udp
GB 162.254.196.26:443 cache16-lhr1.steamcontent.com tcp
GB 162.254.196.26:443 cache16-lhr1.steamcontent.com tcp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
US 151.101.3.52:443 cdn.steamstatic.com tcp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
US 151.101.3.52:443 cdn.steamstatic.com tcp
US 151.101.3.52:443 cdn.steamstatic.com tcp
US 151.101.3.52:443 cdn.steamstatic.com tcp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
GB 162.254.196.18:443 cache11-lhr1.steamcontent.com tcp
US 8.8.8.8:53 r10.o.lencr.org udp
GB 2.23.210.75:80 r10.o.lencr.org tcp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
GB 162.254.196.26:443 cache16-lhr1.steamcontent.com tcp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
GB 162.254.196.26:443 cache16-lhr1.steamcontent.com tcp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
GB 162.254.196.26:443 cache16-lhr1.steamcontent.com tcp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
GB 162.254.196.26:443 cache16-lhr1.steamcontent.com tcp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
GB 162.254.196.18:443 cache11-lhr1.steamcontent.com tcp
GB 216.58.201.123:443 steamcloud-us-east1.storage.googleapis.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
US 8.8.8.8:53 123.201.58.216.in-addr.arpa udp
NL 20.209.10.193:443 steamcloudams2.blob.core.windows.net tcp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google udp
US 23.192.21.216:443 store.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
US 8.8.8.8:53 cdn.steamstatic.com udp
US 151.101.67.52:443 cdn.steamstatic.com tcp
GB 162.254.196.23:443 cache13-lhr1.steamcontent.com tcp
GB 162.254.196.8:443 cache1-lhr1.steamcontent.com tcp
GB 162.254.196.26:443 cache16-lhr1.steamcontent.com tcp
GB 216.58.212.251:443 steamcloud-us-west1.storage.googleapis.com tcp
US 3.5.13.106:443 steamcloud-us-east.s3.dualstack.us-east-1.amazonaws.com tcp
US 3.5.13.106:443 steamcloud-us-east.s3.dualstack.us-east-1.amazonaws.com tcp
GB 216.58.201.123:443 steamcloud-us-west1.storage.googleapis.com tcp
GB 216.58.201.123:443 steamcloud-us-west1.storage.googleapis.com tcp
GB 216.58.201.123:443 steamcloud-us-west1.storage.googleapis.com tcp
US 20.157.180.96:443 steamcloudquincy.blob.core.windows.net tcp
US 20.157.180.96:443 steamcloudquincy.blob.core.windows.net tcp
US 3.5.13.106:443 steamcloud-us-east.s3.dualstack.us-east-1.amazonaws.com tcp
FR 13.249.8.192:80 ocsp.r2m01.amazontrust.com tcp
US 8.8.8.8:53 96.180.157.20.in-addr.arpa udp
US 8.8.8.8:53 106.13.5.3.in-addr.arpa udp
US 8.8.8.8:53 26.200.245.18.in-addr.arpa udp
US 8.8.8.8:53 90.193.84.52.in-addr.arpa udp
US 8.8.8.8:53 192.8.249.13.in-addr.arpa udp
US 8.8.8.8:53 51.201.222.52.in-addr.arpa udp
GB 216.58.212.251:443 steamcloud-london.storage.googleapis.com tcp
GB 216.58.212.251:443 steamcloud-london.storage.googleapis.com tcp
AE 185.25.183.163:27046 udp
AU 103.10.125.155:27046 udp
US 162.254.193.71:27052 udp
HK 103.28.54.182:27023 udp
ZA 155.133.238.194:27021 udp
BR 155.133.227.35:27056 udp
DE 162.254.197.37:27038 udp
SG 103.10.124.120:27039 udp
SE 155.133.252.89:27020 udp
NL 155.133.248.36:27019 udp
ES 155.133.246.34:27024 udp
FR 185.25.182.51:27033 udp
AT 146.66.155.67:27023 udp
GB 162.254.196.85:27053 udp
PL 155.133.230.102:27052 udp
FI 37.27.120.223:27079 udp
SE 162.254.198.51:27036 udp
US 155.133.253.54:27044 udp
US 162.254.199.180:27027 udp
US 147.75.193.63:27039 udp
US 162.254.192.73:27053 udp
US 173.237.26.52:27035 udp
US 162.254.195.70:27026 udp
US 205.196.6.211:27035 udp
IN 155.133.224.21:27025 udp
FI 37.27.120.223:27015 udp
IN 155.133.225.19:27059 udp
US 147.75.193.63:27032 udp
PE 155.133.244.51:27034 udp
US 8.8.8.8:53 223.120.27.37.in-addr.arpa udp
US 8.8.8.8:53 102.230.133.155.in-addr.arpa udp
US 8.8.8.8:53 51.198.254.162.in-addr.arpa udp
US 8.8.8.8:53 54.253.133.155.in-addr.arpa udp
US 8.8.8.8:53 180.199.254.162.in-addr.arpa udp
US 8.8.8.8:53 63.193.75.147.in-addr.arpa udp
US 8.8.8.8:53 70.195.254.162.in-addr.arpa udp
US 8.8.8.8:53 52.26.237.173.in-addr.arpa udp
US 8.8.8.8:53 73.192.254.162.in-addr.arpa udp
US 8.8.8.8:53 211.6.196.205.in-addr.arpa udp
US 8.8.8.8:53 21.224.133.155.in-addr.arpa udp
FI 37.27.120.224:27079 udp
US 147.75.193.65:27057 udp
US 147.75.193.63:27034 udp
US 8.8.8.8:443 dns.google udp
US 23.192.21.216:443 store.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
IE 52.92.1.178:443 steamcloud-dub.s3.dualstack.eu-west-1.amazonaws.com tcp
GB 142.250.180.27:443 steamcloud-london.storage.googleapis.com tcp
FR 13.249.8.192:80 ocsp.r2m01.amazontrust.com tcp
US 8.8.8.8:443 dns.google udp
GB 104.82.234.109:443 api.steampowered.com tcp
GB 104.82.234.109:443 api.steampowered.com tcp
US 23.192.21.216:443 store.steampowered.com tcp
US 23.192.21.216:443 store.steampowered.com tcp
US 151.101.67.52:443 cdn.steamstatic.com tcp
US 104.18.42.105:443 shared.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 shared.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 shared.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 shared.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 shared.cloudflare.steamstatic.com tcp
US 104.18.42.105:443 shared.cloudflare.steamstatic.com tcp
US 23.192.21.216:443 store.steampowered.com tcp
US 151.101.67.52:443 cdn.steamstatic.com tcp
US 151.101.3.52:443 cdn.steamstatic.com tcp
US 23.192.21.216:443 store.steampowered.com tcp
GB 2.19.117.6:443 tcp
GB 92.123.128.134:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
GB 92.123.128.186:443 www.bing.com tcp
GB 92.123.128.186:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
GB 92.123.128.186:443 www.bing.com tcp
GB 92.123.128.186:443 www.bing.com tcp
GB 92.123.128.186:443 www.bing.com tcp
GB 92.123.128.186:443 www.bing.com tcp
GB 92.123.128.186:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
GB 92.123.128.169:443 www.bing.com tcp
US 104.21.74.83:443 counter-strike-download.lt tcp
US 104.21.74.83:443 counter-strike-download.lt tcp
LT 109.235.67.100:443 www.hey.lt tcp
GB 142.250.200.14:443 www.youtube.com tcp
GB 142.250.200.14:443 www.youtube.com udp
GB 142.250.179.246:443 i.ytimg.com tcp
US 216.239.32.36:443 region1.google-analytics.com tcp
GB 216.58.201.98:443 googleads.g.doubleclick.net tcp
GB 172.217.169.78:443 www.youtube.com tcp
GB 172.217.169.78:443 www.youtube.com udp
GB 216.58.201.98:443 googleads.g.doubleclick.net udp
GB 216.58.204.74:443 jnn-pa.googleapis.com tcp
GB 142.250.179.230:443 static.doubleclick.net tcp
GB 142.250.180.4:443 www.google.com tcp
GB 142.250.187.225:443 yt3.ggpht.com tcp
GB 216.58.204.74:443 jnn-pa.googleapis.com udp
US 8.8.8.8:53 4.180.250.142.in-addr.arpa udp
US 8.8.8.8:53 230.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.187.250.142.in-addr.arpa udp
GB 172.217.16.238:443 www.youtube.com tcp
GB 172.217.16.238:443 www.youtube.com udp
US 104.21.74.83:443 counter-strike-download.lt tcp
GB 142.250.180.2:443 ep1.adtrafficquality.google tcp
GB 142.250.179.225:443 ep2.adtrafficquality.google tcp
GB 142.250.179.225:443 ep2.adtrafficquality.google udp
GB 142.250.180.4:443 www.google.com udp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 172.217.169.33:443 tpc.googlesyndication.com tcp
GB 142.250.180.4:443 www.google.com udp
GB 172.217.169.33:443 tpc.googlesyndication.com udp
GB 142.250.180.2:443 ep1.adtrafficquality.google udp
LT 91.211.246.7:443 fleshas.lt tcp
US 104.21.72.71:443 cs-boost.lt tcp
GB 172.217.16.238:443 www.youtube.com udp
US 74.125.34.46:443 www.virustotal.com tcp
US 74.125.34.46:443 www.virustotal.com tcp
GB 142.250.187.195:443 www.recaptcha.net tcp
GB 142.250.200.3:443 recaptcha.net tcp
US 216.239.32.36:443 region1.google-analytics.com udp
GB 142.250.200.3:443 recaptcha.net udp
GB 142.250.180.4:443 www.google.com udp
US 74.125.34.46:443 www.virustotal.com tcp
US 74.125.34.46:443 www.virustotal.com tcp
GB 216.58.201.98:443 googleads.g.doubleclick.net udp
LT 91.211.246.7:443 fleshas.lt tcp
US 104.21.74.83:443 counter-strike-download.lt tcp
US 104.21.72.71:443 cs-boost.lt tcp
US 104.21.72.71:443 cs-boost.lt tcp
GB 216.58.201.98:443 googleads.g.doubleclick.net udp
GB 142.250.200.14:443 www.youtube.com udp
US 172.67.176.20:443 cs-boost.lt tcp
US 172.67.176.20:443 cs-boost.lt tcp
US 104.21.72.71:443 cs-boost.lt tcp
US 172.67.176.20:443 cs-boost.lt tcp
US 72.165.61.189:27030 tcp
GB 142.250.200.2:443 googleads.g.doubleclick.net udp
US 72.165.61.189:27030 tcp
US 172.67.176.20:443 cs-boost.lt tcp
US 72.3.184.153:17475 tcp
BR 208.111.171.83:27017 udp
US 208.111.133.85:27017 udp
US 68.142.91.34:27017 udp
US 72.165.61.185:27017 udp
US 208.111.133.84:27017 udp
US 208.111.158.53:27017 udp
US 69.28.145.171:27017 udp
US 72.165.61.188:27017 udp
US 72.165.61.189:27030 tcp
US 68.142.91.35:27017 udp
US 72.165.61.186:27017 udp
BR 208.111.171.82:27017 udp
US 69.28.145.170:27017 udp
US 208.111.158.52:27017 udp
US 72.165.61.187:27017 udp
US 8.8.8.8:53 34.91.142.68.in-addr.arpa udp
US 8.8.8.8:53 85.133.111.208.in-addr.arpa udp
US 8.8.8.8:53 185.61.165.72.in-addr.arpa udp
US 8.8.8.8:53 188.61.165.72.in-addr.arpa udp
US 8.8.8.8:53 35.91.142.68.in-addr.arpa udp
US 8.8.8.8:53 186.61.165.72.in-addr.arpa udp
US 8.8.8.8:53 82.171.111.208.in-addr.arpa udp
US 8.8.8.8:53 170.145.28.69.in-addr.arpa udp
US 8.8.8.8:53 187.61.165.72.in-addr.arpa udp
US 8.8.8.8:53 52.158.111.208.in-addr.arpa udp
US 69.28.151.178:27038 tcp
US 72.3.184.153:17475 tcp
US 69.28.151.178:27038 tcp
US 72.165.61.190:27030 tcp
US 72.3.184.153:17475 tcp
US 72.165.61.190:27030 tcp
BR 208.111.171.83:27017 tcp
US 68.142.88.34:27038 tcp
US 72.3.184.153:17475 tcp
US 68.142.88.34:27038 tcp
US 69.28.153.82:27038 tcp
US 72.3.184.153:17475 tcp
US 69.28.153.82:27038 tcp
US 68.142.72.250:27038 tcp
US 72.3.184.153:17475 tcp
US 68.142.72.250:27038 tcp
US 72.3.184.153:17475 tcp
US 72.3.184.153:17475 tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 30a3d46144770a2ddc321ed69a8ace2b
SHA1 97b5ad312b5ea5be2d74389467bc9b19e6844f69
SHA256 33b42bb3fd35b5602f994b0557b4fa6d6613decce4e50f1d7d33c2c7f1556f76
SHA512 64bd2f4ff346b68d92a4730763e33f9dafb2af03bf71b619c6f9b393f02dfaa7d378b72c93b33d731417394c373ab7be51c3bbeaa93802302e5ec68fd7f7ff45

\??\pipe\LOCAL\crashpad_2320_IRIYAHWIZFILZRSU

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 d53f4d836e2571ad2df7e03d177a3090
SHA1 92b8403445936b304bda8ec0e6ac2d61f98b5fc4
SHA256 84cd2d6ddd480bf3e6d7dd87d830026d18da0588e831c27e21f365d3d9cb40a3
SHA512 f96ea17c87b58eb7840b4accff2006eb0c4721bd00ee4103bebb8bf680e6085ed522f5f5e0b20b8f99b00f38f468c58d72fd324a8d7e7a4d766a7c5a7a4de0f2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 29bfcb6d7e41c5d3812cb497d41ba469
SHA1 d4f6e9b9003443643b04a98ca5ca5b2c4986195d
SHA256 9f7080a68d62b75b73aafaf5f27e76f1f601d07f2f197d1c09acbaee8431814a
SHA512 d56b75b75b2aa61ddf49b78bb38c023f02733895e7f61780ef17df2b701a02a757060fc891726da4fe78a750e86e16742d1f044f8ae029bce9af3d8e36a4259a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 42d86fbb69959397fae4c7f899092746
SHA1 ad7e8e0b50484fb497549b36c8d97316b7379e3d
SHA256 3cd501a0527e24a442cd305c84b8dca1278f45d95fea0d5d8a45260bd7e303bb
SHA512 999265ba0d5257018df6afb27387ae0b3b252a32698ecfa6823681300c2409fc30be7a41f4a46c1a8e4b39ed0a0a6e8de5884879d8daea4dbeaa018dd4ded7b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 ca62b8656fbbd6a24bd7e120234fb528
SHA1 4be3ed85148d101c9d0508611e4779e377807fc6
SHA256 594d166eaebead417b7b16bcc0d7320cb00b0c2b7cf4ffb6bc1d2c86dea92b34
SHA512 839d0a3d18c6ecf5cab13dc2d65a59563b0cd18f16a970f9414e42d2037654b3c66dbeb8803f6fc4f95977353c58edde2db53aaf8073db182834ed7f07ddf7e9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 dc785cefd19b82f9d2db56f22249003e
SHA1 dec5216149767ccbeaa713c8bb74aa27bcfd396f
SHA256 730edb21e78df15dd9db7b13fb4bad0c0184a75469f0c431f6c5965c7f6fbb6a
SHA512 f3bb0510b6359204522516d076994e764fc418fe6623e17984ce771ef42dbf0f4335e6b890036f763b2e33a69a5b35f101fa3b9cef89790c4312a41ab7cb691f

C:\Users\Admin\Downloads\Unconfirmed 951920.crdownload

MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 57d8f01847cf04e32a99c3f4bc26dcdd
SHA1 b9f5437e5a3ff236bcef997d5a468875a76f92be
SHA256 9e9237237be99c899d05eb107ebd5ee58b7c0c8f9c5b9a7afb195144eaf50bae
SHA512 0e111d0fd776985a55097f91072f3281db59c8c7304d35a9998ad012fb6cb8f75f9d26b70f8d9c5d8b38ceac885b5de9097e7e48fa195f0197e78c2a5c4708e0

C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Temp\nsw225A.tmp\System.dll

MD5 a36fbe922ffac9cd85a845d7a813f391
SHA1 f656a613a723cc1b449034d73551b4fcdf0dcf1a
SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
SHA512 1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

C:\Users\Admin\AppData\Local\Temp\nsw225A.tmp\nsDialogs.dll

MD5 4e5bc4458afa770636f2806ee0a1e999
SHA1 76dcc64af867526f776ab9225e7f4fe076487765
SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
SHA512 b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 b2b4a558a5ac343b3bdb6dc7ee156e1e
SHA1 e6d90b44299f5540844cee6ff3f08ad1b7c65bb2
SHA256 d421d5213f74cf6c1dd6dcc960be73c2180397bec51199a28d167a8a232dada4
SHA512 07adf3196df0bc6ab57826fad22ab5d5f766b7b81b9aa1698c7d44bbf8bc3fe639fefe508586bf19469059e31419f34dab702602057528cb05c39dc2bd4f4f97

C:\Users\Admin\AppData\Local\Temp\nsw225A.tmp\nsProcess.dll

MD5 08072dc900ca0626e8c079b2c5bcfcf3
SHA1 35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
SHA512 8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

C:\Program Files (x86)\Steam\Steam.exe

MD5 33bcb1c8975a4063a134a72803e0ca16
SHA1 ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65
SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
SHA512 13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

C:\Users\Admin\AppData\Local\Temp\nsw225A.tmp\nsExec.dll

MD5 2095af18c696968208315d4328a2b7fe
SHA1 b1b0e70c03724b2941e92c5098cc1fc0f2b51568
SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
SHA512 60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

C:\Program Files (x86)\Steam\bin\SteamService.exe

MD5 ba0ea9249da4ab8f62432617489ae5a6
SHA1 d8873c5dcb6e128c39cf0c423b502821343659a7
SHA256 ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d
SHA512 52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d0f01e9445ada9f539b7eaeab95a1af6
SHA1 348e000c860821329e2167aa4fcb78c07017153f
SHA256 ffc798ee32064c3d5174f1a6d2af78f364d7d7152b8bf62bf2ea6a021be24311
SHA512 6508e0726581d2cdee3b588fc9e3b4431f288a1488d483911a4ff248b0c8f00588b3775d095d77c3c4cbf8c30419e8a2c77c8f12f3e5d928409af7a323319546

C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

MD5 31a29061e51e245f74bb26d103c666ad
SHA1 271e26240db3ba0dcffc10866ccfcfa1c33cf1cc
SHA256 56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192
SHA512 f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

MD5 7913f3f33839e3af9e10455df69866c2
SHA1 15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25
SHA256 05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c
SHA512 534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

MD5 202b825d0ef72096b82db255c4e747fa
SHA1 3a3265e5bbaa1d1b774195a3858f29cea75c9e75
SHA256 3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314
SHA512 e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

MD5 7e1d15fc9ba66a868c5c6cb1c2822f83
SHA1 bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7
SHA256 fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265
SHA512 0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

MD5 8958371646901eac40807eeb2f346382
SHA1 55fb07b48a3e354f7556d7edb75144635a850903
SHA256 b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585
SHA512 14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

MD5 1514d082b672b372cdfb8dd85c3437f1
SHA1 336a01192edb76ae6501d6974b3b6f0c05ea223a
SHA256 3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4
SHA512 4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

MD5 18aaaf5ffcdd21b1b34291e812d83063
SHA1 aa9c7ae8d51e947582db493f0fd1d9941880429f
SHA256 1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5
SHA512 4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

MD5 189ba063d1481528cbd6e0c4afc3abaa
SHA1 40bdd169fcc59928c69eea74fd7e057096b33092
SHA256 c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695
SHA512 ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

MD5 5c026fd6072a7c5cf31c75818cddedec
SHA1 341aa1df1d034e6f0a7dff88d37c9f11a716cae6
SHA256 0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382
SHA512 f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

MD5 10c429eb58b4274af6b6ef08f376d46c
SHA1 af1e049ddb9f875c609b0f9a38651fc1867b50d3
SHA256 a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13
SHA512 d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

MD5 9e62fc923c65bfc3f40aaf6ec4fd1010
SHA1 8f76faff18bd64696683c2a7a04d16aac1ef7e61
SHA256 8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7
SHA512 c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

MD5 da6cd2483ad8a21e8356e63d036df55b
SHA1 0e808a400facec559e6fbab960a7bdfaab4c6b04
SHA256 ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6
SHA512 06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

MD5 03b664bd98485425c21cdf83bc358703
SHA1 0a31dcfeb1957e0b00b87c2305400d004a9a5bdb
SHA256 fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115
SHA512 4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

MD5 2158881817b9163bf0fd4724d549aed4
SHA1 c500f2e8f47a11129114ee4f19524aee8fecc502
SHA256 650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7
SHA512 f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

MD5 4c81277a127e3d65fb5065f518ffe9c2
SHA1 253264b9b56e5bac0714d5be6cade09ae74c2a3a
SHA256 76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9
SHA512 be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

MD5 0340d1a0bbdb8f3017d2326f4e351e0a
SHA1 90d078e9f732794db5b0ffeb781a1f2ed2966139
SHA256 0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544
SHA512 9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

MD5 9b0b0e82f753cc115d87c7199885ad1b
SHA1 5743a4ab58684c1f154f84895d87f000b4e98021
SHA256 0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32
SHA512 b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

MD5 f350c8747d77777f456037184af9212c
SHA1 753d8c260b852a299df76c4f215b0d2215f6a723
SHA256 15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185
SHA512 efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

MD5 cadd7a2f359b22580bdd6281ea23744d
SHA1 e82e790a7561d0908aee8e3b1af97823e147f88b
SHA256 3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99
SHA512 53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

MD5 29f9a5ab4adfae371bf980b82de2cb57
SHA1 6f7ef52a09b99868dd7230f513630ffe473eddf8
SHA256 711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f
SHA512 543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

MD5 53f7e8ac1affb04bf132c2ca818eb01e
SHA1 bffc3e111761e4dc514c6398a07ffce8555697f6
SHA256 488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83
SHA512 c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

MD5 194a73f900a3283da4caa6c09fefcb08
SHA1 a7a8005ca77b9f5d9791cb66fcdf6579763b2abb
SHA256 5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6
SHA512 25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

MD5 b2248784049e1af0c690be2af13a4ef3
SHA1 aec7461fa46b7f6d00ff308aa9d19c39b934c595
SHA256 4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690
SHA512 f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

MD5 66456d2b1085446a9f2dbd9e4632754b
SHA1 8da6248b57e5c2970d853b8d21373772a34b1c28
SHA256 c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4
SHA512 196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

MD5 56dcf7b68f70826262a6ffaffe6b1c49
SHA1 12e4272ba0e4eabc610670cdc6941f942da1eb6a
SHA256 948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f
SHA512 c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

MD5 6367f43ea3780c4ee166454f5936b1a8
SHA1 027a2c24c8320458c49cd78053f586cb4d94ee6f
SHA256 f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998
SHA512 31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

MD5 eb8926608c5933f05a3f0090e551b15d
SHA1 a1012904d440c0e74dad336eac8793ac110f78f8
SHA256 2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04
SHA512 9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

MD5 58e0fcbee3cca4ef61b97928cfe89535
SHA1 1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b
SHA256 c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425
SHA512 99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

MD5 e04ad6c236b6c61fc53e2cb57ced87e8
SHA1 e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4
SHA256 08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e
SHA512 0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

C:\Users\Admin\AppData\Local\Temp\nsw225A.tmp\modern-wizard.bmp

MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

C:\Users\Admin\AppData\Local\Temp\nsw225A.tmp\StdUtils.dll

MD5 db11ab4828b429a987e7682e495c1810
SHA1 29c2c2069c4975c90789dc6d3677b4b650196561
SHA256 c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376
SHA512 460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c9856a9555af63745b53238709a60576
SHA1 2dedb4dc5e0e245211650f5b32d778f5bd294f97
SHA256 52b8117fd07183a8df94c69cef2bc48f2cd20b3a06d9a16af4018ea91757a0d4
SHA512 9b32683a04468965e6ad764b5a6016d81fc170d134aec4c25a73a1d1d52c1acd09c247f7f0bed22535c3202c93896981f30eb42027352b6697460c042e549b39

C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5b85025cae0724f9544c60f6ef7b6029
SHA1 2089f2ed27c941422048e17dd3ec1cb75a641c38
SHA256 f15769da2ddc906c0c4327fc54d5c0b13da1275c1f8da01410e8f6c31259ed7f
SHA512 84a567072738b90e3cff5829c434f4b6743a5e8ab33084f1fecd864e3588250ec74a8642e9443489f2196e9d046854ad4de9baf7dcf9062eadae1044f1ab27b3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 14670d980bd59f8d86be38cfcab865c8
SHA1 a50e4e5bc211da1a27a8c97e18d286b4909b473c
SHA256 2ae977b9bb8c876e99aa8588180f32e51b5535c3cc3333f9b134a7f60b70cb7f
SHA512 48fae62acb3ca8b2edbc0181eae66a781e64c9d34e4410a43432c4cadd4c038b494720f2ca209e4cd279b2efa8fb67cfec362222e60d81be6cf0b85e9e7bf07d

C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

C:\Program Files (x86)\Steam\steam.exe

MD5 52d06173e5995fdb588e56840ac7343d
SHA1 0e3a1de21cfa9652adec0e9385db153e494f07f0
SHA256 0ab4f7c0d72361c9c37c5ce59f1df39f1a138f258c380a9bc1328ce146651721
SHA512 7e6e0159afa4fd02d9bec216d6861e425cf44d15e2742c05454aeccf4408be36cb43d57ec89094e5ba64e25c1282f912a956a66e297ef8e62b130a809dcd5693

C:\Program Files (x86)\Steam\crashhandler.dll

MD5 020ad894f0395691f728e74614adbd96
SHA1 d9c479da05f8cd20f42842ab9c6cb76170feaced
SHA256 ed97c4061db76f43a87aab8c226a6be0a68bbdf9cb331b3974bb9eb3da60a399
SHA512 db6bcf95135da7c247e7750e469c806c75c96622c1f765989d13e09439e3d52d434137cf9322470ffe3ad19b0bfb38ad23f8f015063511e7c77525173e6ee8a2

C:\Program Files (x86)\Steam\package\steam_client_win32.manifest

MD5 b1a967b318030e275d3bf19635f17644
SHA1 ab036db9ca9c485e64333333d18b1b27655461b2
SHA256 5b1efdcd684821cf4d00e8fb4c7133d1e6a8b40d511c62c7e6fca6e3fa2c9e36
SHA512 eab0a2fa354481a8db92bf503437ed0d200e4727fb454834aab7f5125cebb901ee53b9bea44227b44bdbb3bb1280290699b4cf8fdbf3bbbef8b121c621d95a85

memory/1708-12489-0x0000000000390000-0x0000000000842000-memory.dmp

C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

MD5 31fb5d721f87747e8bc9a7a2c3b465c8
SHA1 2b0b9a77165a72f5c3a32f51abc5153834447775
SHA256 aed229640ed1bfd193758a7c33661cdfd48386982c7b5b4b991d6e6b6dbfdc2f
SHA512 95a88746c811a8f13af07575fbdf050523e7749bf205a9ad438e5ac4be9b565b608f0cde3ef7b2578b16ac38926d97c823657c4e92710fcf7f952d025f24ff5c

memory/2444-12530-0x00007FFB439C0000-0x00007FFB439C1000-memory.dmp

memory/2444-12529-0x00007FFB42B70000-0x00007FFB42B71000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_1

MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Program Files (x86)\Steam\config\config.vdf~RFe590b31.TMP

MD5 3cdebc58a05cdd75f14e64fb0d971370
SHA1 edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe
SHA256 661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7
SHA512 289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

C:\Program Files (x86)\Steam\config\config.vdf

MD5 6e6a2b18264504cc084caa3ad0bfc6ae
SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

C:\Program Files (x86)\Steam\config\config.vdf

MD5 a2ec2e91c3ef8c42e22c4887d032b333
SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

C:\Program Files (x86)\Steam\config\config.vdf

MD5 cc9eb5c4acceb5d97eeb178c45ef39d4
SHA1 5d15c5412b7b843dfc55f83d24a852bcb06e1cae
SHA256 55e6f5c5758cdba70fc4ee72308788cb9587fb86b6ff28babb094e8f0af6b6e0
SHA512 b7e7a6272e57beedd7361029e2ec4a7e72ec45c5fe014fc0d154138a792f2249782f8fef8a9e52d24a3ac3d79a48acc121c8d96cfc313754dc8970d5cd901ec6

memory/10228-12650-0x000000006F110000-0x0000000070451000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 802a597cd640cee52e94d46b41fffb7d
SHA1 cd49c2946c2f6b11c6d6343996ccdff2b0d8eba2
SHA256 34968df42ba72d5e225983259293f9b6cfe721c5e8301b5e698434ab0d42424c
SHA512 ba6e6c96675983ac7a527e1a204536f5ec9b7b23fc31b30f4603a266d8ccbb1c2ebb39fdc825785946cfb51c2922b8f4292ba7383c32229cb054340ffc8ab934

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4105c63fcb6b7a24ae2bb9964fae79b2
SHA1 facff8cc72528e75b683dc6a280f6d691f6286f7
SHA256 d303196559724bc138a13b30e7498b429c5d8aabd48a403af844ed70a051b56e
SHA512 3e452052edc1b5f85afc3b4e175c6bfa12d8b86dcf06241491a10852e840547bf1f45dc421a9f3ee0b5253ca4fd11660fd83b8c5aa67f1bea48e308d6ec0bf36

C:\Program Files (x86)\Steam\config\config.vdf

MD5 d4a79c8ace96b892eaf99b134d323b83
SHA1 2a5db41ef54cc9e2ebb261509133eeb996d50a8a
SHA256 9819282b4a2cc916d1dd94b0d507f879e3cf35d5c6c05f8388921b8f0be61b62
SHA512 ae4fff0df061350a95f979bc264b2c318d1cfaab95b2ba11eab0cfa074186699b57f7f26957c1e4ecdc3c17e93777f867799c0cc78f5ea6dfd478ed9f3dff128

memory/10228-12692-0x000000006F110000-0x0000000070451000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 7a2add7784ef50bef05b94875a08fd8e
SHA1 841c32e9381874a750d990061ccb66fb7533fd72
SHA256 631d8ddcb09f12332efd94633138d1e1421a02073e389cef0c67255796e418fc
SHA512 6a4cedc7c133798ac2e7a5ee241dac4d8eab836eb70899d6545b3cad91b738548e31d5089d212e1282976b274d2e985cb8d00166d34246136c23327c24d231f2

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 2d0c0e17750e3d5cabaa7d39f73c9156
SHA1 cbdd81c3a7041951f9cca19788909ef6fa0dadf0
SHA256 3933bf0861037618283076e85c946d24f234d2681459f9f8935e0ce77b596a61
SHA512 d3e454f38b6f57beff6836ee8edd8a2565300d773d12c159190bbafe58e899c5e78ee1e6c27a760b2de7a92ff33e93f913594f2b2306443514815003e34b4144

memory/10228-12702-0x000000006F110000-0x0000000070451000-memory.dmp

memory/10228-12705-0x000000006F110000-0x0000000070451000-memory.dmp

memory/10228-12708-0x000000006F110000-0x0000000070451000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000002

MD5 ef94e26e09fd6962f86f29c1c30f7447
SHA1 c574353d60b5973522a96fe726b0d26092167386
SHA256 2c3a7f1d3f5524c76c35942871974ee222eb012c65ec7f19d83c392f87b50847
SHA512 77abdad3b1f76fdd8eaa4cb3b2dcb9e5e0c00f46f25b52420e24129c4b178b34103329de52c15b130c3dec214c77e25eecbd2294855c1b3ca39936c8c94a5b26

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000008

MD5 d45f521dba72b19a4096691a165b1990
SHA1 2a08728fbb9229acccbf907efdf4091f9b9a232f
SHA256 6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc
SHA512 9262847972a50f0cf8fc4225c6e9a72dbf2c55ccbcc2a098b7f1a5bd9ea87502f3c495a0431373a3c20961439d2dae4af1b1da5b9fade670d7fcaed486831d8c

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000009

MD5 57613e143ff3dae10f282e84a066de28
SHA1 88756cc8c6db645b5f20aa17b14feefb4411c25f
SHA256 19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
SHA512 94f045e71b9276944609ca69fc4b8704e4447f9b0fc2b80789cc012235895c50ef9ecb781a3ed901a0c989bed26caa37d4d4a9baffcce2cb19606dbb16a17176

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 c0652caf274bf88f1027fdb7ec5273cb
SHA1 d849450a8123dd9163c8076dd847975b6110d7b5
SHA256 dd374af66ce3d286da4f023ccb7b986eea27bf66a43af487f81bdbdca9ad1809
SHA512 ae884df7ea57bb50e4d3f8e6c7172fb7453430d9b626d36775a5883449287ebf13a73556df6763a899ca63c9587aa840773203dcaee7d1f68731823147749beb

memory/10228-12758-0x000000006F110000-0x0000000070451000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 d173ccec011f0627b964add182f236eb
SHA1 6e6e54c621f780c7e5023b3999f0fec1d40ec7b7
SHA256 c083dd2eba0e5f93886fc9b2fc2f61f66b7e8bb8c2bda543798f97ec0509be25
SHA512 ca6af50d5a90aaf292cecd962e84b4aee9574c7a532634b8af1b8354e872a2ad9c5d8aca6899d5b3e1e5514050d2a196ad5a7b629260848cc98a4475daa52a8c

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 d50c5b8eae99ca55755894c528c77bfc
SHA1 9b668c58a032854eca400ac72072db0e4b709408
SHA256 40a388d57529c1676d6d10e94f34fc8f2c2355b56eea2dca61ee8269e91c4fb2
SHA512 ca8ce12c2c2400367cbf53fb48985e9dcb6635154ac0d9254ef74b72246af6bd61ad427e53c170f18e61ba77e9867d199755acd450f9819f2626560dd7d643a5

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity~RFe59f562.TMP

MD5 88132e87dd978de32b3c2125368e6703
SHA1 71a611c26257737b26dfd0bbc61065ac696d217e
SHA256 855eb8f89d9637393c0577ef27c07698303f0bef2256b741543b65b3531a8f0d
SHA512 807dcd2ba3e5e0c55c0953a4c97608e640d94190ccf0b6987aca95a597cd8bf86b519f8c77a49a35d9b51dd60c7af4a30c29a50b519367abc76009efebf51774

memory/10228-12783-0x000000006F110000-0x0000000070451000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

MD5 f9db51467053b30dba37004d40e970e5
SHA1 f140265c384fb6b137ec1f59d6a04626e5c4a090
SHA256 05c15b5b19bb8f9d7909a507e0ed792008e7ffca6ea55456bee77abad0efe7e2
SHA512 20c90b23fed44172818ba0f810095a95c70e9e6cf366835ca68a061c9b931e8899614083d3675a0432f61c919a5201ab5e50779de58b7c5fac9b1269ea2768df

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe5a18d9.TMP

MD5 aa23c0ad3e2bf4904756d208f67339cc
SHA1 f06d78a29292d67c34194e676f02c198f2b3f4b3
SHA256 93f067f98a15ded5c222f7e562923ea7267448d6c15c79f0bf373031391afa82
SHA512 aae0f431dc170eb69d9504514e27ad73cbb179aaeca3b01d17d337ac8ec7b8ca74020d7a7db7e02020ab1c00e2ff84b0422a99d7160802eaf2de2142d75d6bf7

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 f1cb7b9426fd54e251edeb83cca1bab5
SHA1 c332543a559fd000abb3bb1881a712664daeef04
SHA256 7f9c7fbb1be4eb1acb8a887fd646cb550e076b8f6997f392e0e13c151cda82a3
SHA512 6ec7209a83011279abc45620a405828d3b71b67ec2d57e2311c22e254b9882849891f35a9b00f76ada9408db07019caa12c634413b2c0764eedb7c46a069081f

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe5a1c34.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 4e0cbc446016800e0b94438255b8be31
SHA1 c703dbf98d8861c451c2d007d26fbcb7cf81d2b9
SHA256 7574cf818f20c303037b13969a0c2eaa72971db7ab469c23bf8a4dd6680d92fa
SHA512 e83db083f1aa2dbee03709d24efd3609dfcb8be7f43935d6e497e3f657093898a70598bef4929ce08dc857fa435f6217904bf63df4e36767fe45fb376fce6f05

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 04a45d6fe07e0a9fd185f7c90f7da633
SHA1 4f88c71537d52626a0ad0557ea67aeab1678fee9
SHA256 e5898dddea73be4ad6e9fe536cded9ac5a748a647551d85f76394578e517e7e0
SHA512 7bb4e568c622c3056177a555cf4b85b68137de2bfff7ee3cac0dcc10327fee6573a8b823abaed2798b013fed02b87f39f643b07f7dbc0e758273da35a08aa4a8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 35cea91f16e2ab5d22ef4589445cbfb5
SHA1 715f72fa801e999136b4dff149dbbe7f72fb3a0a
SHA256 ca1b343d19c5f794402a3b09398693f96b21462053d1ff8e63c074cd80d05464
SHA512 94cc1dcaa40624c24762814c635a8b06d50dd9304db6e502a73492050285a6f75c08ec2c3f8c1552cef72953bb569e9e80f8a380f0aab5acd2c5cbbdf35f578e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fde1c2f8-f409-4dc0-9aac-2666bdec788e.tmp

MD5 055429eee75b9d2a88128d344dd671ff
SHA1 bab121e88625898e520fa4695c4b1a390cec7bc6
SHA256 6c06ed3c505552ce6ad983738b40690f743ac681265f0d8dbe2461c87cf54cb1
SHA512 3d3a02096198aa932a5016e5bd9b493f6e36366abfe14c554d4c58536f49a77e680574e50f5f29c7d27b87ed13bfab0e810b4dddca7aac7ab8ee2a3f370456fd

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\56f6d62c-49a3-4cc1-9d30-8816e00482cb.down_data

MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

C:\Program Files (x86)\Steam\logs\cef_log.previous.txt

MD5 7ae7313218f171bf4b4a09f2d37e9f36
SHA1 4f08f46964a3a955c3e0f141ce62404bf47ab379
SHA256 0d6783a62b31d0f678f438ce2dee303d23a2d5787949d9cfe5a56d014b13fe1d
SHA512 b55d4d3d66408f4259974a16a5b355aba854e6cbf0c1a08b8e74effb5b6d11c2351bd30b0521fcdef7ca75719735b92f704be2f94ca6486c08be608641c45c4a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5f24e8b1a535000aee65f51130be1d16
SHA1 d8173135e564978912a9adfb91f5c63fa29b2533
SHA256 76de5b50f0ebac0cbd49e4d8f2b73d0c10dc955e6ebc18d235ae7d2207737ad5
SHA512 95b3c128e6cef1cfca68ee098690484eb97175137d58c047933f8be085891ad29a125a5fbb0426dd10e1b20cc0c6d5861d32500b0ec0f2c1bab66ac6095deae9

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\f2da9aab-2139-4c52-96c9-a1a39834cabb.tmp

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 49b56c14f7763ce12d1ea93b4644299a
SHA1 219a847da6a5227d44bb296e2f405a5ffa3b87c3
SHA256 76cae4f5976cb14e7a411aaece1dd4b26e5e552bc17091fe459f694c9615acc8
SHA512 8042540ad9c82dbf88ae4cef089491f53c6dc341755d367a0d625b87aedd0fefd38a5e1fca4b1461bdf2717633a72ab912f8d8ea1312b5ceeac20b3b0f637b1e

C:\Program Files (x86)\Steam\config\config.vdf

MD5 607e2b6024c6357912d0dda2e44efc56
SHA1 cbb2291edfc904ea067b9e9d83c413b9cb2696b6
SHA256 8fb07ae53076e10ca7f18d01582694d6c1356250239935cd524c2e5ddbf6b749
SHA512 70e076adabf1ae3723bab37b888f69526cab130840f9d09c01ec3650e2750388110e2adc6d7dc73ee0dd6eae746f23250d746e63174df45f68fa402983062f42

memory/9940-13035-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 d12d178acdc4d90c47807b4b499eda08
SHA1 c77800ec12b04ca009e90eb6c684a586f1ef41e7
SHA256 2764b727f4b97eabdb39214da1a4114111c441a2953aa939a84af1a0b082dcf0
SHA512 44236f210b9b100619feb1eab0102923b1de097b35f854b9e35b59c699f58e2eeb3bcc7e69f1d7c401a01d36cc3a3b4fd96ec40cb150721795d3a7d5acfc2779

memory/9940-13041-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Program Files (x86)\Steam\config\config.vdf

MD5 80e31ae485308258ed53e958648016f7
SHA1 ec76f5c506ba993e16232eed6fbc07057cfc1eb6
SHA256 ea50b29ffc952b54922914083984f47c64d04d06684c54c193a79f1d5670deae
SHA512 18f2d1a50b8cab820effd44eb35dc2f3bdf4516e43f1b625afaf58067ec81277b9da79665a48518466b88724ad94c82a409500dd34927fd54116329594aa97a1

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 890b798a48501562e6541eabaec8c99c
SHA1 8b0309cdf2f91ae043a51adc10d9ecb1ac48a2e5
SHA256 50f09a62c6762ad358a3e70c7e5262d8aa6ce370ab61b2b758a802ecc90b3d60
SHA512 2f20ef0c9a1f670250a2da6b53ef965bd84e54a83adbc9fe8e416ed7be6aa293bae946b91a89cc3ac85c8bcd89f3a30bb152657c465788bd23d7fe3824fe8b31

memory/9940-13056-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Program Files (x86)\Steam\config\config.vdf

MD5 02166cff258c81b045727773afa67164
SHA1 148a663bc1fd35d50e0c5b13c2fa791d92139cc5
SHA256 b25d4438761f8755f30e8eb43c7ed32b7b142edd4e71f51c4d37e75fb90ba141
SHA512 3b7197f7fd7e51e7b083399764235130c6d83defda23ed89869d303ecaa6f64c898e5e803e8e5cad3ff844a3fe3b40c4fe184a5cc053385b279473435183c683

memory/9940-13069-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Program Files (x86)\Steam\config\config.vdf

MD5 e0e3522c6069c18cbe353c2dac0ba02c
SHA1 ebd7a45f31ab7fabd89c91f921b661a9039d12e4
SHA256 b91955cdd68db915df9712c19a5c589eda6fadde08a9f170bfbb3b579253164b
SHA512 4fcb2db4d0693ba3992955bfe17c7a87577e57cf58d6521f4277cbaae2670a33d3340a9677b871539f661bc02708f2f2a50f6e605fb68b33ada02687f92732a3

C:\Program Files (x86)\Steam\config\config.vdf

MD5 bf2468ef26f082d3273016affceaa906
SHA1 aaf5217c3c57008a25055bc1ba891c128c9939e4
SHA256 1fae5d88286f2e988d2a4e283587c4f44e04e63bb4d806f52dba4fd2993bef30
SHA512 d43e94e56e23b81d3e8d994635c3fd892feb9118598bd110e5822f0d7f6d05abff6436d23c4324f25c25b1e4c06e0dece4fad47bb7e87006f3f53f37667ee6f5

memory/9940-13103-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\UserPrefs.json

MD5 602c49f9246967bdcff45b4f43cf2fb0
SHA1 4c5796e0c724bbd7a9244cc8a0fc9e8f40181f2d
SHA256 a3ad9649c1038078038be1abd591cdba73b4b4f5cf30e11bb6cb7a432b746114
SHA512 2f273c0dd0127071f4c768cfe7277c6efff84c1ef4f4271c1326db3658c84261794b106af3198717f349fbaaaf276163700bbb50ae20fe52ed0a88a192d46f77

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 8baeb0a79663151773b05536abdebd8b
SHA1 ce1e2a222dd5af3681320b3d996604d9e24e6ebc
SHA256 12c60fea3bc010dd919b158980bc228977fa4dd35b7b3fc491c56392510f9ad7
SHA512 e52c2950110101e2793951e6f4d1230cee7175a29f68414443c7226fe3bd3fb635180fe2b329581bc3d3d2f00de67d0c065b14b9fb15d4fa27844f3e532fb005

memory/9940-13119-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9992_1905103704\LICENSE

MD5 f6719687bed7403612eaed0b191eb4a9
SHA1 dd03919750e45507743bd089a659e8efcefa7af1
SHA256 afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59
SHA512 dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping9992_1905103704\manifest.json

MD5 2ff237adbc218a4934a8b361bcd3428e
SHA1 efad279269d9372dcf9c65b8527792e2e9e6ca7d
SHA256 25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827
SHA512 bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542

memory/9940-13157-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

MD5 7dd834276a8c91e63dce9530c0262e2b
SHA1 03b783b173aafd305f870833f676ed2a8ba3fcb3
SHA256 9d6cd7d651815f3a0eefffe5646dd1373a79cf7f1da11115e190228f9a631a6f
SHA512 71cf1a9571fb729a47afb4f0b738c24b64e4e9403be511d62494ec497fc73e37de6953be4420764504fa791dbb3be007e95374c6f9c93a32fe1d774e49773011

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 29a7d636499cef9fa6303c96d85fb460
SHA1 7807d19eeb121a4ab24a5beef9dc4a82a4a5bfda
SHA256 a6fe13a889801017a83728aeb4412b9a6e689f17943fe6231f82778f60d34678
SHA512 ec12e092543bac96ce07ba1c814e37299e6b9be400a470c0533b044741b7e3670a0a45c49d31cb40c08f4a47aa8072986450f56fb2790d2d130e682fb5716588

memory/9940-13169-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Program Files (x86)\Steam\userdata\996293921\config\licensecache

MD5 4b8d7e35a43d6c822c343bbaa49f9b3d
SHA1 87075736fc3bad38b4dddb6691316fd2ccf04348
SHA256 e7cd4aaa38acf8984d2acaf20067a35bd5c56e6fd4a726d7d55af6757fd023c6
SHA512 0e1c8230e324d88323d576c5dd5e3332ed1caae6b995b40329a5598c0f77714e4bc24a71545eb119d83395c6788c6ee48d7ff5d15c2d37911a886d2e92e7f5e4

C:\Program Files (x86)\Steam\userdata\996293921\config\licensecache~RFe5bd4a2.TMP

MD5 32fcd935d24e7c409c3786d5da70b21c
SHA1 bd205056bad1440f0ad024ddc029e0290efe22ee
SHA256 edee75a655e155bfbd55e38aca9960b210fc270b307cba24ed437527cec44016
SHA512 56e0154be444bbd354317ab741833003025ef1d2719fd12222fc919179c34728ed534e803b84d766f4d4155652c5f0756c0939f1bff467d52c4551c418300dd2

C:\Program Files (x86)\Steam\userdata\996293921\config\localconfig.vdf

MD5 d6f0721e4a7e80dd4d409daa885d7637
SHA1 d9c9f5dacea77b7694c8e706a989f1326cb0b314
SHA256 648cd6c4db83ca072f0191ed6306241073e2f5c6a9568ccfc21abfbff59d60ec
SHA512 25e6c1525e6b789889627c063bdc1616ededc7f448cc51538275c0b51e08f8e70bdbdf3cf054dd360d2e10a5652c4f0138f4361d24790fa8b95f516fc58d9cb1

C:\Program Files (x86)\Steam\userdata\996293921\config\localconfig.vdf~RFe5bd686.TMP

MD5 737431d9989102f5e16ea5d9f6527fb9
SHA1 d626f6d6c58327e6e8651d3b88b1a6f0c315db95
SHA256 3526b7443b185cd4d92fc324674d3be4da31126cb6fbf00ec24c43b509ea9b0a
SHA512 93da2a33d372f90081773e77c03879d44c352048a6470bcb59472d3679a3fcb953801ffe49a958ac6322a95a46dd69082fd61aaa0bd66b6f9759e0951f800eab

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 345e0337b67806a9bdf5a60b808079cb
SHA1 03890ad3fb841f747b0db9e8d7a9fa6fd14e5c91
SHA256 a768da3e45963892f07503a2656577e7f7eb2d47361476fec366f6cc42f6038d
SHA512 2f1d89d2e382d55f3345133552f38b1a25b71e29f2a6baf965e4585488804a552281a468d1a8b862deacb3829334cead1f2189c7d27fc8fdcc22a06e9edaaa80

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 7ebad9561f23d8524c46f816850cd465
SHA1 70fa5608eb9d4ca4a56983f3c3a5cf2505741bf3
SHA256 7d3ceab4d3ddc5a65a4b5f5fc2264224a502c7f5349a9cb3eb435d721c40a0be
SHA512 03da98c019e6c1c613afa8c803b49bf44075896abce13a130f2ad2d09b54cb8b1a7ebcf9fee2f9a4d7eba75f4399059adde3e330650b99e8c695fbd8a89d1aad

C:\Program Files (x86)\Steam\userdata\996293921\config\localconfig.vdf

MD5 8d7ad4f3d15f99afeebf4b9bd4a56f66
SHA1 1b17a1b37315f8cfc21182cfbf661c6b0f6c94a6
SHA256 0fbef394e9a673985d20924068799b65b3d704fcd21508021b3cd69c94f85194
SHA512 2d8afb0a4ac65e517ea5b4c16a2f34a39661db747e2c144858bbacc4e213f3ea1171d9b9a6c99827e06f3d35181877c314f8c80fe9fe406f957636ec44abc59b

C:\Program Files (x86)\Steam\userdata\996293921\7\remote\sharedconfig.vdf

MD5 b0f83f7fa83be9f13006982393a0bd83
SHA1 eb2b942b2ecb38e5f99372cb2bd67ee7fe32ed47
SHA256 e8b94ff22034c3f2730029a49e953a58b69d7ee4ec9f2b3cfe2cbf1f3bc29ae3
SHA512 1d93cb6b548106b9fedffaadfb95bc7e7fa39c4a7ee17422d326b6adf82fc1aa9ec569c0e26a99407f8876672634ddf57ff0fcef9de5b2ba0361f4a8363a7869

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 6388f8d38c6d0bcbdb535a42ddbe01db
SHA1 6305a016eeb3129f6a6d71f232616e2a6c9dd6d5
SHA256 08f16ca10e903d2c866fbb01dce840f8d71627e2a110f4634831a139b983ae8a
SHA512 d33518d98a13e2fd8ca3222a924d832d03f2496982b772ad2463be523012f3e5df7197565cd9631d9f29adef6fda5da250c70dc96ee078af8be89f3b835935f3

C:\Program Files (x86)\Steam\userdata\996293921\config\localconfig.vdf

MD5 3929924f437030c4d92f08db2830bbe4
SHA1 6b55ec35ed87e225fc902fb233a7e639ffad1e9c
SHA256 7c8820b62b3bdf5b2b560704ce41641afe244fbd6bf5b763361578a2fa4043ee
SHA512 e327eb2656b33b807ad84c411c59863153e17c210e7f7f25c241440064e89c5cf0c8b556032a91548bb8b392cbb92513d77f2ecd6c45281e4b17df10136e2fbf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 515e9ff37da52b39e203c4f9a4a3d28f
SHA1 988210f0d9082ccd4604cf2bdf7e00e4ed9241e4
SHA256 c64eda3249a3a86a45809b1882fe49a57aeacbc0c030049fad1d37f23c01efc9
SHA512 ce571e5e47afe2af9d22ab589a1ddb0c0beba576614cc24a22bdf86b0e23e8156ddf8438205b7a93e6c683159ef837d2b410340d3f244e091dc94f1576ff205f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 e21978cb06657e181c3c2c61319be9d4
SHA1 ff211c765cac8affab2133ae5ce38417a283768a
SHA256 84abf7aeefa3c02de06462e3a4fd2b2e5b0a89a8f3fa802ad5f65915bc8e1a28
SHA512 ced6cddd2a06b018f20bd1092824d7367005d6dc12e2ffa27e8099ebde1ad7533653248aedff01de52622b9699c8b2a983cebb5d3f7de4c635c7147b243ee61f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 2a72c63e58d537c13b20a6f4cdd59467
SHA1 a7310cbe4bc5e573a3e54e26063c0fcccb67f4af
SHA256 e5c5f3e0f2e67e713065d91f23b4b89f08352cc2d3b2a046861cd4517571762f
SHA512 b94b8ff37660aa1e21a85d4b24b6ac2f991339990952bcc1421a41d2e7f8ef4e92190f6efbf61e3f1e67fd3f930332c59b6f608a58c4f23327ff09292d9f1df4

memory/9940-13340-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 d082f5c7419af805ad947082e52bc229
SHA1 1aaa2b6639fa6b4f2164a4777521fc3a1fb94515
SHA256 b0f79ea9f1d8607d1c7dccaee70483e9c0f8e7c39ac7dca39c20aae464f821e3
SHA512 ab83b38753796122d72a935638e615587e1ab51dd4c55e56f61870ea3580ced2b3f9858509724aae4b28d295812491e2e74152dab1ba7238d1d82fb7c4c871f1

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000f

MD5 e13edde4a25e96e573f37bdd11e020aa
SHA1 84a0c3cc6cd74b149cc27de2b0fe48bc2acb70d2
SHA256 45b526e6aa5356b278aa37e67593a25d09c9653e8a0e71fb8e155111d3b7a515
SHA512 9ba4cce47994f949731e594538f56f423ee46a8e602fe922ab6e1d173b87831ae5a80d967d695fc45a08b25aef5c494518b43cde6b4709db690e904b2cc1c053

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 7ee32b5187b435b99cb7d6439ce44886
SHA1 db690eb718205a351f9f384bbb4e70f945473a60
SHA256 045e615674c376003cd8c7523684ff8cc4bf089811fbed537b0f5f358223eaff
SHA512 7ffe2ad805fa91362a4a4e44c84ad309ab9188f10175f9c4d8e6f4b09da1deb851d1adee7b25d5cf849cc898907b1f90d811bbba1bf2c3f9a24fd9ddf8616eab

C:\Program Files (x86)\Steam\userdata\996293921\config\localconfig.vdf

MD5 a4becde72f55424364882a32fbb469e4
SHA1 a5cac690cab53c3a611469f2da5f093999807879
SHA256 142c23a0a6a6e01aea0dc7ae17fad36db4cce18fe5cf4d9b21002083e7a2fbfb
SHA512 f820444388147dbf69434bea4b3247d6eee2359304d30705f8a1b380b66c6f1a69982e64022487a5d09d71fb59988e02f8ccd5a1bf5ba20fa8b83926f3ed63be

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000013

MD5 b507567f09861406425726176430b282
SHA1 ef31ff9a5a918797c76752018a667e29e415e580
SHA256 4390634070a440bead4ea3dc609984097da973983ac140b094149b4bbed1349f
SHA512 23e8a4e14a2a8608c817b88080fabce226ef7c280f5c87baa27780dc1307d60f75d215a91c3de6651f17e6df71219b3e51f2665ce9553c71f427a38e7c81d65b

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000014

MD5 cc039445c6c92d32fb74a942a2876d71
SHA1 71cc9c01cf705b61ba163bceaa62651865ef5ee6
SHA256 1a71cffdaadd8f15a6268dfd76f3524409eb5fbad791ce30def403ea13a373a9
SHA512 1834c2c6d6529e69746be6ef8b441997a7e05b00303b10cd2dbc16b0d18cf89a6ead9fb943732f56f7f9b74e347b1bb889a71f08baee17b6b69afbc7350311ba

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000e

MD5 544a6e4b1b34c5132739a0d2ba39b18d
SHA1 683d474bf1ef4998ae5e37bdd219f34f15a12eb5
SHA256 369ca10d1b319a8fb94a6cd6143f4a524833faec18688d733508dd2c4f6db7e1
SHA512 efa73011d5933b27c23282e0e3caaaec3485d6db3b92212106fa6636b18365704904e7cc444a8b51d0e32d3a29c13e1bc2dc296214c492675b912de85824d4c3

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000012

MD5 fb8a686df2e4d5987c9e43e10b480df7
SHA1 bf85d7c64d6c23fb859989f0229c083aa857197c
SHA256 b6b6c978ff263141e66d878ec683c0092f651fb874a21556d921e62e6c7ad887
SHA512 e21e7287672434bfdeb7de3cc63bf98ebf923fc709941364f68a8fe4ff19259c7518ebef4aa1ae5218ae845450deff5d10dfcc114f562bceeb24b0244900ee57

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000011

MD5 c9e90bc8ec6a09d8a69f4a4dc6fe8b6a
SHA1 f099ace175891bb8b81eea2595bf8de8027bec6b
SHA256 8fa6b37e750ce1df8e880691ea6dcd4aa922b55a722aa0b1df8ed6302aaf723e
SHA512 c4bda62806935165c94191234b8782408876f1336279a26d58ab3a75f41c51433ad24516c0354a8a047c1e743c4fbb8989938b6a1ff29ae0585b3fd08230a497

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000c

MD5 9fa060a599b0ee1912f2073ed59df3c8
SHA1 eaaeef616747d09506c6ed1d96901d2c8d1ad4e0
SHA256 7924474a8f327264982347dc932997ed49890ea4114925024ba678fba2d4e90c
SHA512 93837c0d1bf848ff603073bce6ac252f770a35fad094b294609682e11b04b463292c74c8440891e89741f28fa67a888ed6fdc1575fda99a3c2b6065ccc4e7b47

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000d

MD5 45886a6a9aace3fad669a79bc3191ce5
SHA1 c24b4a569c0fee533ca9db199feea061ccda03f9
SHA256 99d8caa7d664ce601c1e90e2b94cd63c6c5ff70f3d9871223f356f89341a43a5
SHA512 2dfc402d0c3f39bac280ea49bcbf9edcf7d849c23ab97422ddc0c46d2a18250e90bc66a6a407e437defa1eff3ea745ea657fc2a21f6211525e35a560a31c59ff

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000035

MD5 6168553bef8c73ba623d6fe16b25e3e9
SHA1 4a31273b6f37f1f39b855edd0b764ec1b7b051e0
SHA256 d5692b785e18340807d75f1a969595bc8b1c408fb6fd63947775705e6d6baa66
SHA512 0246cee85a88068ca348694d38e63d46c753b03afadf8be76eca18d21e3de77b495215ed2384d62658a391104f9e00df8605edb77339366df332c75691928efb

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000018

MD5 daf4bc548bc47e46ac4221c35e57b3e6
SHA1 232e6919b20457c5564cfb4d5510582a15073b27
SHA256 d2efa5f3652a92740b4f9349f4fdcfa550c0564f99c8eec357518b6ae8c9ebae
SHA512 45125729ef6cc2fe403545f096872b0470be4d932da283aa708ff9323fa0da18157b586efe7243aaa30480c0d7d2bd0606ce78644beae976ca81c350e134ff36

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000017

MD5 d285b525b70a051564f76ca71504e368
SHA1 333744cde9de37b4936c98e90f5a38b1d90af845
SHA256 bce39f57831630e2ac08ef2cc9bcb6cf6395149ebe4c487bd136cf8881591637
SHA512 5739f18afd9c2f07723e4e1ed9526d90ac2e541284a57efc51b464e0eb3f9ac7ebb58304d453d300e98110efb881ef0d3f8673847f01162bca0b02290c1cdfdb

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000016

MD5 af5256dcf1ad35a9c186d180372e992d
SHA1 d3f93c5db0aa41589e9d525624ff518c9343b459
SHA256 035328de83fba90fccf87a4c8ba797fd4f841b08a7b5cdd8cda582a396daeb86
SHA512 2934d2de8cd9fbe94b0b179d7a460c2e671f726c1f93e3a04cef15c52ee437f6c3810c2402caace0fba2225f1d727dd3178630ddde83c51b55a3fae8b49d3637

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00003e

MD5 2d64caa5ecbf5e42cbb766ca4d85e90e
SHA1 147420abceb4a7fd7e486dddcfe68cda7ebb3a18
SHA256 045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f
SHA512 c96556ec57dac504919e806c7df536c4f86892b8525739289b2f2dbbf475de883a4824069dbdd4bb1770dd484f321563a00892e6c79d48818a4b95406bf1af96

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000045

MD5 ce6bda6643b662a41b9fb570bdf72f83
SHA1 87bcf1d2820b476aaeaea91dc7f6dbedd73c1cb8
SHA256 0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6
SHA512 8023da9f9619d34d4e5f7c819a96356485f73fddcb8adb452f3ceefa8c969c16ca78a8c8d02d8e7a213eb9c5bbe5c50745ba7602e0ee2fe36d2742fb3e979c86

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 dd38527b1f24cef348f30ded92b90beb
SHA1 cb397c40a5d6c49fb202c7b9d11b0ecd35fcd514
SHA256 1c1fa702c82e9bfd8a163493ff0e48fda0aacb187ac8ac761de629ff615fc800
SHA512 55a804c44a30de2cace73f19209937d5da373b868226473d298632bfa69f9f6c857162768b4a56743e8de8ceb2f4439ceadf595936ceefd5d53737fe32f23d04

memory/9940-13808-0x000000006F1E0000-0x0000000070521000-memory.dmp

memory/9940-14083-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 721ccf37a0511e4931dcf873d95c803f
SHA1 388a3a905f53739868e5d80a0cdd2ea08ac271c0
SHA256 36effbc802a936356d2e13f9c3931d8920d728b2015b0d6bc8d9f312ca7ca9a2
SHA512 51d73064aa2b1acd801f4c9ad67291102723af20ba4b0064997de75f0a7c96c30276c3ac3a736f981058e34b228a7fe0de09969bef7f1e550a4ad5a2577e2d04

C:\Program Files (x86)\Steam\userdata\996293921\7\remote\sharedconfig.vdf

MD5 ecdd70e5f411c6a9da4c302f3cd476ed
SHA1 b2b85a8a953924c7f85be1ae48157e6719028e01
SHA256 0308e98823c3a209f1b7c6103d2812ed886664d3425b37d4bb752a369625b3a4
SHA512 6271d63600428f75492b38f00feebb93f0038b46195c4e652545d6c891dc75b6d62b9d4a370355e5aec5edf5d45343a5b5358aa817ccee343aefab88390dd065

C:\Users\Admin\Desktop\Geometry Dash.url

MD5 79a91e63fbe44bf40eff271f46bc274c
SHA1 c3c5aae7545b6c8ae3cb1803bba548291275319b
SHA256 b6448b7e531908491656ae45d61983bdf309ba0005678d10b8c61b6f5e49b333
SHA512 d89930c54412176b8ca6f0753ef503d2479908d4fc8147466d1dc16a57009478c86215e930a10deabe9eeb6574331515e7421beafa9608419b5b9ea1cee4a476

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 2f7e440049184f40b84df96484f98456
SHA1 9efe9c8e3f1d901337cc52fa118ec6618f0ea174
SHA256 480e93ef5d6311b369accc0280dae94c6cb5fbff5044f43fab71a65c08852ffa
SHA512 54039493e4688723d5fb6a3bb761dba38e67608a6a5048be6a3d0c9133fe0ba2eb8dbc4342f8575ecda8bc96fef9e927a4e11ff8535f5408208bb65ff08acc1b

C:\Program Files (x86)\Steam\steamapps\appmanifest_228980.acf

MD5 9036e5ffdd48a272988d38c882be4ee6
SHA1 e032db769c8437053a35476298e807cae4944473
SHA256 31fbeca467f6e0b5c1530059e7dba1e08503646781de9b1460843b5a020ea294
SHA512 72d535e7dfed83bd79e76a2ef1ceb2a530d195fe3cf9da32779c4b644d07e7e2493c371a868605e61689cac6dcc8c9cc09f90ca68603a24ba7671b25a6435df2

C:\Program Files (x86)\Steam\steamapps\appmanifest_228980.acf~RFe5c4a30.TMP

MD5 d661702721b5f234b7a7e729629c957d
SHA1 6a6ea8e4a48ef67da9b0c35127fc9a0c38e9a951
SHA256 1774c5d46b834a00f98ad8b20e6cbb2cec85b641b4dff4d1a62a86b690fc4236
SHA512 5e19018318532b9022eee88b7ead2ca73b2e064120403f89188b1cbfdcf641f4372713008c6528d8a1e45282cc8e5b63b23af02cfc4252fb2e1987b4d589aa5e

C:\Program Files (x86)\Steam\steamapps\appmanifest_322170.acf

MD5 6df657cdfab9d7b928e0242dc0046c63
SHA1 888e05f16cf26507a9457fc7b7ddf55ac90bf7f9
SHA256 fc95196ea94c22bb877e2e6eafe390efe79a980180614c3d3edb61745710049b
SHA512 ab174741868b4db6370b881360bad60454730abd05cd3a3ddb8ac82ca9e1101b1dc6ba7b80d4f7d13adbe4d242530c931ade28afee8ad0c9c98de54ab63b77a9

C:\Program Files (x86)\Steam\steamapps\appmanifest_322170.acf~RFe5c4a5f.TMP

MD5 1472927ed42858f1b7caf0c967a477f0
SHA1 8728194cfd3759e7c6478da8da45d66dece7d2f6
SHA256 d76a48365b7ed1638f8c24d7c9b56c25d98d1c73d827bd26a4459d287ef739f5
SHA512 49e60b43a9ecbf9ffc0b4a78aaa1a56cc16637aad5a211ffe42def39ce27153f2e3ec734342914e01807db897e2ef91027d51d410fcf58c3ee91f195d1d7bfc4

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 11966871af8aa93166341f648ce7b11c
SHA1 db8e931a67edeb4ff59c6b9eb117f63e3412950e
SHA256 9c661e60b74f2e0e1354d8b00fe9b9371996488fe415d864ca9100f41196cb68
SHA512 8fc0f2b5373687aac982092e791fb1117d6e2208951c2e81344db3873262c37c9cde0f694fed128c3fbde90a555621532aed20f61a9a295441ba04fc1d6e2eed

C:\Program Files (x86)\Steam\appcache\librarycache\1245040_icon.jpg

MD5 7ecdaf8a54ec52b20640a88527512903
SHA1 3133a4d748ad3be61fe9db759339cd5de73339b5
SHA256 7bd8b75aec0a4d4a377f3ca3a023fd8b7c5fc7dc6a2a66d17f8cdfe5b731ab0c
SHA512 60ae2031eed0c38264f0d8db22a9b6efeb3f80c791e916e15a1730853162d56e0da014dbd93a5479bae4f3bdd5705ca89be70c90574a524abd1c276ed5c55a2d

memory/9940-14338-0x000000006F1E0000-0x0000000070521000-memory.dmp

memory/17448-14344-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14354-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14353-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14352-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14351-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14350-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14349-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14348-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14343-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

memory/17448-14342-0x0000023BE31C0000-0x0000023BE31C1000-memory.dmp

C:\Program Files (x86)\Steam\steamapps\appmanifest_322170.acf

MD5 798bfacfd4aa93060515ae20617e9759
SHA1 92d8fb564c409baf4410f88960f9b03b747abb29
SHA256 6f9b446cdd7ba6b637292caa8bbec18c29600d9304db05a861f9844748889008
SHA512 9dfd30af9bfc236f5504e0b6cfd4f69e9689df85ddfd03ca78e6c35fbb498aebff45eda7f88112040880b55dbea24d2910a6d325f64b4554d6ab64c782806380

C:\Users\Admin\AppData\Local\Steam\htmlcache\Dictionaries\en-US-10-1.bdic

MD5 4604e676a0a7d18770853919e24ec465
SHA1 415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f
SHA256 a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100
SHA512 3d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774

memory/9940-14436-0x000000006F1E0000-0x0000000070521000-memory.dmp

memory/9940-14887-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 62681ea46e2dc6459e4e5af475304ca7
SHA1 01e7d2b1363d443708c1916abb1f886f8162fac9
SHA256 e7dfc01c75294ee1129870978617307bda3f3f2808967f3697715567e8e545da
SHA512 2ed625f8e6c795c31dc4b6ecdbe8b92b67330ea7170c348c22e560884fcf8a5039b69fdc448f65f8596449f238c479802f1a0e623a1345037daac6b017f6520b

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\PlayerExplosion_19-uhd.png

MD5 e2ae7bc510bcfc694e5eb2207c26825f
SHA1 fafd3fa8212f5737fab1331f39d47d9bb20944cf
SHA256 b04860aa938f075fff96fc186ca37edf98bf41c2c58e5db1a9b630c8556d308b
SHA512 015a5acf3211a2548790c8ec382732fccd7790fff6962afd37e50a085a99e51178cd1797fd4ce53da83f60d8d030d2ec4b3b063e8829fbd6053b90c721170e95

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s2283.ogg

MD5 fbff6bd2deac16d6a45deae4df032ee5
SHA1 d824b79bd63eea0a120c220d43ecca032e84c604
SHA256 865484890c4e0b5623f4397c08de4c6e957adcbcee1b205683c4f0256cb843f9
SHA512 a88f19b6badeb4471b66866d766d24d00a78dac9c3670e097c52e37b17173e74b716862684288b9775cf4bbb1391e7eee2e6eb8e111d55d591409782dcf8bb09

C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

MD5 fcf1999d7dd13c90a1848e970f1b60c1
SHA1 784ca5fb2ad30fbebe0a4753149a0c732c0def74
SHA256 39653cccd77933c5df16cda160ed5a271366fcc9b6bcdc2c8721f646a10f92c7
SHA512 3b986d754dd2e9c5d07b3782a2ec33543935f5a93fc62696b42302ac335d31d1e14b59a6fb99b045693429c45f20eb5f4321426698d7d0c1af623e5ded3df8e9

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_0000a5

MD5 47d88f0e30322831ac51429e321af624
SHA1 0a3a50ae8c9d61a6d96b872f91b4694187be0bcb
SHA256 ff066f3e1ab3028b7bf326825772da1a50d4c9bfe92ec0abcb52f17ed996482c
SHA512 416fa132223c396c6ec4ba581383ff0859ee02a7e73acca4836df0e8154600cc9cfa4249832d0370fc7c45232e0114994e7da36d094cd459a6f3c77be539cece

C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

MD5 9ce1fa8cff793aa67b6ca9073be25a0b
SHA1 3d1192004c968c1f00048d67240d34a6693012f3
SHA256 7c59ae0c69dc9f44337bae66ffd2e0f2d76a605d09b274e6d5f47a2445ff0133
SHA512 61b051d495c0e47746c773ab84ac1479cc2fec46450186784332aef6ce276964bdf013564442207aba4ea98b5ba0f75af9f46e060e9632ae8ac9472cb3fdd0ee

memory/9940-23479-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s2714.ogg

MD5 5eea6f7ee2de54968abe281a35feda8a
SHA1 11ad23014ae94a2ef000ee5beafe000d6e50199e
SHA256 cd0f0544d50833a5dd384852a876a7a0a8878fbe503d3a242db7628b23ffe3c9
SHA512 71bfcc3edeeca6e2e46e298f96b930fb82344074bacf3f61d061a43877a8e604717f62608bf5592585e136b296672acdc5c68bfeca0f5320da43fa037ad47f6d

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s5218.ogg

MD5 10e4827e5a47f40abf04c5101cd15b83
SHA1 e49154a115f70539f6e49d9cc005798303ecaf7c
SHA256 fc539eaba3db3740de268424750a932f066cde67ccbeb92b1c81f5b79dd5d27c
SHA512 f45bcb50b8707d0985402fbe7c0bfd3caedb2395411ca69736fcba044b6ef8e9c66ffa3fadbb981b4f7471f6ecd78d6149bbc0582d040360f12f8f07ad63d621

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s459.ogg

MD5 0028f735a2d25e190b98cd8b7f9ffa3f
SHA1 46e8dcb552e01fe9aa82a581e0a69b1d5cb8997e
SHA256 493099638f1a835a0871b903c4bc7b13642bf0674b16fa0f4070357c21c278d5
SHA512 e55fbe5641f5c819636d25903c995d5b101eab307f110b877538713bdbd5cb8135adea5c29f4d40ac354a3bdfec3faa466317ff35102cb6eb8992e4a1499f644

C:\Program Files (x86)\Steam\steamapps\appmanifest_322170.acf

MD5 a6fc061ad5fd755e0e1a687e962002a0
SHA1 2872cdc84882c4b4145e7d8fdb0a7959afc62338
SHA256 f2d3042751be1ca9b548668fc01123a680fdb681b9341b8716bb93c3e8c465e2
SHA512 cc57269d8fc3d6bbfdf6ccbc7c2159b6849e02fe8b52fa5fb412421a53ef97949b3b6afcdf2ef5a7c817a8e30942df617698cac11b1d741928f9167a37ad3c8b

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s7359.ogg

MD5 f6fb8f798d0e76195a8cdb4f966151ab
SHA1 9c8db198a49f488f28736ca2821fb7cc60d1a41a
SHA256 e26943c8abda2ca6fce52452b41f79a737bf619b3a45002c6e27c481a423c085
SHA512 a960082da7ace698536e004147a44e457ed6fea4af13f153d487075fbb90c77a9bae36cdc046107f2cebddc577f8e35374dbd25474cede52062553e437d75f5c

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s2269.ogg

MD5 3ac145ce84fc8e60d0237251b852d676
SHA1 090f3e76be2733444df3ed0013be50d22856e4ce
SHA256 78f3cb04dc0487bf611cce818cdff44d7c727b0799e26a20b2f94a6c305e1011
SHA512 5131742a44645bac93b572977900e278f7ddf30920d830978a42a74f9c48083858f08cbf13df23c22ec5299e51f76704dc8d0270fbdcd9ae9d3b1611610daeca

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s10162.ogg

MD5 e487c2639aca7520f2efeb1096783446
SHA1 1167afd20e30fc893c7b8021964e6653e282d108
SHA256 8af4efd7d7b2a195c18b1998e85c81ab751666ea29e811807adc776538d07a5b
SHA512 1e2fd107c06a183d3c0b56fe2ec0bf19d9fb568d3a625c7a8f7ba6df103bda7def027d6431b422e05cbaa0e3bf04cc0312b0285c9b36c09dd04367b786554b2e

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s4400.ogg

MD5 7eca3df6e46adecb0596c5036ad2af7f
SHA1 c624254ac02233459269fe9487e88e3ce9b76e31
SHA256 b9b67136e89b2edcad7bd4fdff4569b281ee4dad3ef91536cc5009228d5f0e06
SHA512 e33712e8403fbe1f6c633525332f4259048669f040227042fc68811ca7fc263669f5a494ec7cf26905479c2342340841cd33b44dc58998df25db4cbcfebbfee0

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s7841.ogg

MD5 8e78af430e70eb528657d8c7fab3bc8f
SHA1 dbd40b1ffbd1f3ed439c06933528d71590ee7a63
SHA256 18ee4912edebc349c97bdb67f2e44f6883c3a96c55a6c7bad4fc7900a3ff522c
SHA512 7cf1f917a012a246ce7457063255e5576a0bc67fea30b12a79cfb264ce1045127de012e50282f5c5d4f91e8391850f88f3f910e6d696f3d7a5db0a7ddf7a20ac

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s1374.ogg

MD5 c0fe99d339cd0699bd09225745fd4753
SHA1 881ec921ac1903e05ef449f25df799a268ea2fa8
SHA256 5af097acf4a9dab8e41aea4b82f6248c819cb26367883462f25696ef15efd1f5
SHA512 4d58062fb51b1cac000734bc396de3078ffd07609fec19dc1cf3787ad8c3c956c27072bc431a7a4bfbb987f5d6522905abb548647f9de11e1e58a3e1f3c2ea22

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s766.ogg

MD5 65b258746bb371b38a3b0d73a59d27e4
SHA1 64598c4f83536ea6699a42dc152947ffa8266404
SHA256 bea503ad41ec0446d71921baad72e17214c8f8e956326faad06bd49d6bf8adb6
SHA512 ebdc3626e3d3e9c6c163e5f380386a6c99426d327baede92f1d178398209e7bcc201fc3024b1c9e2442095c345882aca91a852846fe62b4db8a3cdc88236d06f

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s2270.ogg

MD5 96100c646def92a47d90cb3114494d35
SHA1 59409c5d6cacb1965386dae5b5b1178fc5895854
SHA256 ca3a9f3ce6ba76cff811df3da89936ae0e27e9fd67bbe9902fd9c4cce2f75b3c
SHA512 69ff3f4b6eded92f4895533a4be43ddb584d3a6d9f1e8cdbf13aa28f400188211f3f28f1d3ca40388349a345e7df3675c7e2740ef2e8e36996d239af8008d511

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s2847.ogg

MD5 311ee14a3ca49bb242b22dbf90d14ca9
SHA1 dabb63ae7f38d1b509676ddccc60ba3ff8253c60
SHA256 a6069f1c140afedfe01049b0da5a23615f8e771d0d29c20edd8b3036e46297ac
SHA512 e04738a7ea95d36f4cca5a3e92ddc10681e2fd0d0cb184907b35ff02d08322a9fd30aa8062b022a94d1cbd97e496a5175cb0aa02c8760af3f0249005d2ec1f09

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s6019.ogg

MD5 f4c96b40d72d2676a7ff13f614a6858e
SHA1 0dec6301e8fa19d5fbb4a673e9011fc2371731e9
SHA256 23012bd5c1ef5174358d5005d4ddba17f6e762c92329baa31c27c4785a91b3cf
SHA512 329be21c2e3a2c029b9a8c33622d043272ef3b2bee3820e696d212e31246afae1e963a7c3956ba2fb4a3abcaa05b8ccc8abf50ebd0abfea1a515869c189701f7

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s2075.ogg

MD5 8704014a401625917bd1cf63b7d2cbbf
SHA1 3c7ff16fc62e0c57931c52c3d4d4b84999d1e9c7
SHA256 13d5be9691cad50db75b773c2e2ee4603506e1959a0ed2c69693fd8ada49975e
SHA512 dcd0f197902d8290e32d0b2c6000bbb2de06200ba02cdb9393c6ca3db0b1dd8c1909475da0831656fda69c2b727ccf42626c941919da5365e19e54832ffb5f06

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\GJBeast01_AnimDesc.plist

MD5 91831b2cf5c869aa0426d68fe4a302a4
SHA1 992d928c09cbccc8672693da02958836aaa571eb
SHA256 2e255620191df9c5a40f63f8180061dc468e16879ad634c4631f87882cd12d14
SHA512 02068a9d01f6cadcafa72b3d106f60a8d7668105afadce4815e96e2d43d84b97f662017b36e16589d3593bf15487902525af1454fda67ace35306730f36cf9e5

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s12911.ogg

MD5 a21affdc4c556ac77b9b1842ca30018b
SHA1 fded8a6dd69526728f988fc5ba39a3ec134a4dd4
SHA256 2c870c1c430743c4636391c666dc3e21a5adbf845f6734f2bc89af6cc697e86b
SHA512 4de13a4eda0c3cbe2390e06b795f22091ffea0b553b9cdf052706d67bdbdb1cc3c57a91bf77cffd695e046d301e21dcfdd0c3221c3ad7327969625cb1e0d8874

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s2581.ogg

MD5 ec30eb201e03c55a655b303f07084f18
SHA1 5671c3ea4b071d29a5ab0020ce3e5c43af8ed964
SHA256 2634e80c9e168a669c73bb1db61b098e55cdcedc5c3cc46a90a40fb0a041fbe8
SHA512 3d5d6659640dcf4da490cd0ae72b95f2d4018de5df170dbea1f15976849444d23f6084d33c4a7e2bf0b100a99a512c9206e70e07cfb4360ef6b61f9b0262535e

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s7647.ogg

MD5 1fd02b442177a1253cf426d332266715
SHA1 198e469baec3f5420e0102ed48fd76cba3e9fb29
SHA256 9d68f14cd03100e902b7b2ea37a8fa4df7d15900db7ae75d38a489774b799192
SHA512 34018b2c0d13054e53ea8b3307183c4aeb392f81b1cd58d5ccf0655701d349037aa070e8797d748ca5160014a6236d2dfda87ad1ebf726883d2010cc34e80600

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\gjFont32.png

MD5 a18524eeed8e157692e21c19216f530e
SHA1 237f1a6da229d4ea5f85ee893cde2cf5078f8638
SHA256 3a50d9dc6522771a05fb2b715eb723301a867c02f77e577302af71ca4efc8248
SHA512 dd0147e76881377850aa0b21a27711c1b0efe243f906e2cd53d5df0aa66600abaec641c27a2669e21d76faedf4cef364277e0d2fef2da2d287e817a9571c1903

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s6897.ogg

MD5 2bfe1ca2cca2eb040c83643759ea5842
SHA1 3287d2f623af78973cd6c2d4faed3f0cac837c27
SHA256 05cdb748e933581bdff15125af335dd1c2e425e48209c4de0ffa5101fd7daf49
SHA512 301d82bec2b7256ce5095153f276a8119480bdb4136290c49b3294a16a24698884c849fc948ae2ddd3a3897ec0f043060435155449e1f1efc534804891e3b995

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s2529.ogg

MD5 cf885b82176d51737b20d52df4ebc3fb
SHA1 a5a726373615483e87d751a8d9f34e3e6934afa7
SHA256 90f3debceb058e1337779e3bf0b80d6e79195d1ed9fc2953f5f8a0debc6ace72
SHA512 4c03ff13157aaf6ff605ab0af94ada96682c83acfb5a5794c08beca1fc1c4f6854a71625acd294d3a402382ce311c164d2eddbb3fe20fc241d57048936b73fd4

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\fps_images-ipadhd.png

MD5 c3e59c137a103d4b60bfa282f1e324ed
SHA1 5e888c7eccff2ac02c48ee140b79df0d5fd6584a
SHA256 e337e1417bcedbcd4b2c9bf2d879305fd44d4d0dd84aee7ee46331b463201153
SHA512 e720529afbc1163e564592b83c4eb2195769334f2c3d5b796c6a17843fe2fc46bfd718a423a2e2556b866dc95e036afba6b7cb907e62a99d308174dc95b1bf40

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\gjFont20.png

MD5 9e0ae91392f85c283ec1cf26179cfd87
SHA1 47970a373c45c576f84141d2c9747ff2b479d52a
SHA256 c7718c951f024f9fdf26d17d8b019984559510c8f7a1b74a00c47dfd8e1f698f
SHA512 c6e916cfd6b2a2a47aaa9b9ceefaad382f33efaf084f62eda28c25928723288f5e19aab046f144f60852d9b1ce1d8284e26ed421b075d5c48bef0bbd2ee7c0d3

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s4278.ogg

MD5 07ec1ad9aeec8d99024ec19e86042f30
SHA1 df5a063af98685daeed4f7b4593f0cd446769b35
SHA256 9c34f15ec2c0e79460ebbb6ccf6588bbdd4f0d11385dc373222e5e95b2be79e2
SHA512 f10483ee03fed029d42d968798fba948d2885cb48fb09443e3d28810ee481611fd76a5f69c28d74d9b1ea943789408bed54f389657b5b44165133294f00f9cb3

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\gjFont28.png

MD5 87bffc6f15b0f036d483719c2fca871a
SHA1 3f2872a3a052a8bd4999c0bb6b3da791ad654aaf
SHA256 d9ec37d278022de84d253b89006dce6dbd376bf4f188465896016defee461077
SHA512 a863edce403fc93eb0ad082689efe19fb320d4eaf89b6503f9a84a2c37d1bd46034c432442f8a7f54b86eaaa56a99a53435e3eb8fea12493cbe2cf00a712f665

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s4349.ogg

MD5 30a55d287e8f1a6fad081e7bf206c1e1
SHA1 50f682c1b8b03d2fc284329c92e7cad9cfaf59f7
SHA256 fbcee0d4eee726837e96ade9d91920407492113ebb2023622433316ca0bdf218
SHA512 7a5b4f4fa3dd17ef4aae7363d0269ab6ffba0717d1e216cb9bc3648120d3bfcab7db871c72f30fdfdabeb93ae507fec74af32d76deba71dcad6d0b2ff49ced25

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\square02_001.png

MD5 5344c35c2662cc24eba4a0f6f0a61d85
SHA1 4adf309fe8bd5fdb4a66632aa93395ff73c0bb72
SHA256 28a6ad0aa888445fc531040f4d37448a6ec8f06d9a1f6c9e4e0f50087bfcfb02
SHA512 c501cb7dcc311aac497a5edbeaaf85153d1f6419451fa1160e049933d8cc3270cac13a612dbf46e4d12f227918272a3bcd8ed7f455af642e6e3126f966603f6b

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s4274.ogg

MD5 bd84edbb8f8f430358607a9166a11dca
SHA1 c7d6d231fe867a970f3ac1c735525fd6800667c3
SHA256 4b61df68e44131da0206380de54ce630bc9e71788a47c0ffd86d363a0d0f8cc8
SHA512 c0f5e908e8f9aa4323b28bf7bda1127022866ba13d3ef4aba6efd3d0994cadeae0918b3124788815860bb3f77b7debeccf318ff91322cf4c884604b3c9352fb9

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\gjFont34.png

MD5 e895c00ba1c8829242e4b7073662929d
SHA1 122a1e024755add2630391a47a1cdf83d2928d5a
SHA256 9f0251087bb7b0855f3ed86d5a1132486a0c8310cad72f824cc1c7293db54447
SHA512 406432b2c464fc7c669b572be302fdf2f4a24a34c25a8b6755014a74ba0d924f048558ed791b12f1c16bfd50c2c3b7f7f521f6f89054e1542d436915607838d2

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s1619.ogg

MD5 ca82ce824a75ec75b29807df6074d8fa
SHA1 458ddb5d9e476a0b2ba4170fbbc7c16f0673f1b2
SHA256 fda1db882f005551945e8ec7fcba2c0ba139a00333ccd826d5035460179d77a6
SHA512 65ee9b1c8bd531a28af2766e8c64dbc7ee0be2171b4e198e2de445318c1b2ea3cba7be6725522925e2378802b71e5144359a985ea8ff4b583958da8c954a5adc

memory/9940-37810-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s7309.ogg

MD5 861ebad4989254c7d955e0702bd0f25b
SHA1 cec0c4296da2d69d396fdef029153213887ee79b
SHA256 1a7b89a47cd9cb5e4fe939923d01b9c22cfbfea5d0857bbb58cb51c982897890
SHA512 1730ecbef1591a00b4ef9c09a1133308d33e6c89018c2dc4c41ccd81efce13ba59fc230790f7eb77bc81197fd616f8f661040d1d9be4d04cbbbc0072f2041a22

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s1554.ogg

MD5 2dbf4373323ef0467a6d489a0eb20afc
SHA1 382e7c7566eeeffad061d2f480b5031e8043eea1
SHA256 434ba6589822890e029493f6e02aaaffd2ae1eaaf27a8a0f70b5e97d9eeefcd0
SHA512 51cd355ac918b1ef12df51823fec96189d14bb3ef949c39548406c6a94c098c84eaab5dbbc7d17c79e40305f3674128f2f0c4dad82e8c07e9a6c66411d66daff

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s1032.ogg

MD5 9b7f7dd77ad18db1c48da19122350679
SHA1 9d92ceb1dcd4d1d8d4c1a7053dc795a181744587
SHA256 9d08c88992dfc09bbd5408c763be39d9bd674a306aa047bfcbc4c9f35c56b64b
SHA512 ed471fdd24c27b7180e61a79673b2808340d08204ae67154f2f0a4f885127d863de1429b4ba5207ccdbdfc5e6a35000a841be7f0301ceb1150f6e3c753b3fe7b

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 2445c5b9b2ade673252c6520c0eefc72
SHA1 7affb1dd0e360c90121bb09d043df975de59c16c
SHA256 27289909763e4c23b9afc03e5e02231f4a8dfa77ee71622314e4ac4d3523b9cb
SHA512 5a220d980d92cea90e263c965c4913ed11fb6b71eded074bb9500e7ebab067a0ce247f9a58ca45e389202730dc37a1d4804424a807f219cd142ca8b5394d42bc

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s13702.ogg

MD5 656feb92e19c63731df56b191b3ba7f5
SHA1 3a454e255968d20ff846be82324a839cd1c4da22
SHA256 417aabf02509ef7fa6d7940e831e393728ee4102567a1c8f3a0970e6141f33b1
SHA512 09e672e856edf8667f929834839553ccd27af1c2c500c0f4315d9263476059d8630fdf7ee424aadfb71bbb117ceb027cb52a02864674e5463191164b95a52c0e

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s4295.ogg

MD5 2c5282798dddc6a7294745b5ea9b4e2d
SHA1 4ec00c1679f188194c07b425009827daa427019a
SHA256 a03a26a9571d1bdbe5a73de4c237d45a626e7ade85bfa86bd338b83f84b45de1
SHA512 be9dd48a4cda158d079799395da21b21a969b2a8a9b4ee4e02fbc0585806772f7aa3699525b00ce621d7cf6a4f7c9a933bda61c75e4f38708268842e6da5e437

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\gjFont31.png

MD5 949d72acf83290a9d841042487a40d2b
SHA1 fd864ab5d2158988f8de6a1a975e1c1e38506926
SHA256 1f9ffbc0e82613aba94b1f19e784b47ed1f406e4dbeb4ebfa9a702f776048540
SHA512 ca8ab7ef88ae1fdddd045364c675e94d2608244b846804079f3c7145593c0923e57b96390f1b143070214ae8bc47fc445b19aeeee5aba75c4ee8ce10c5c4f44d

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s7245.ogg

MD5 ae89db95c0df4fcec4547ca30a4a578e
SHA1 1597c29f42a6f7f163255e00d04e06f2d9a8590e
SHA256 a716d392ccb7bbb9408c7f428d1b5634f3b45e52af020769212a0ffdb020fc93
SHA512 3f6a77f52e336fe4a4ab4e77191d79f26bebcce1aa3430dbae6efa58ff211d728b14288c55ba8ef103acf730a173531a36406991e61e18c3a0df8b43a9eeb5a5

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\gjFont21-uhd.png

MD5 6f7d41e550924bf3b0f72ef89fad50e8
SHA1 9df94f95f34c9726c5a604d79b6af3863edec207
SHA256 f05c0baf0e8efd095c98eeda353c4256e94948915dae3b9e9649b3dd5af66efd
SHA512 3d9371e48b3f3598dce5176ec9fbb8be4b5b5448269ea76e4ea6ae50a2f0930d50c38841089b8a56eb2f806274960042140ee82f7a324deffbcb47b8182534da

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s12918.ogg

MD5 3546a1a9969e74dfa15d2c8000d8035a
SHA1 fbbc6639eeadaebfaef8653955a2e9602e784fb5
SHA256 8aa27407021604c69168eba55f02f4a0188d94b42783b7903f83a80f63e6762e
SHA512 5985732939d2cb840731774f3ae256cf5a5da53e57da623269617d94d682fac2dd76ab3e9b8319db03c5abbd3fe4e12776ef3f266e1ebb9c371215e0b398d139

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s4848.ogg

MD5 75807d9a02ff052b49481875c9eb80f4
SHA1 06b1fe4644d2bf4469962088edbfd111a401037b
SHA256 40a0eca311a00711634825e7a0ed51f7f66559ac0930856028fd6960bb87dbd6
SHA512 4da9ab94ab6a51622596a919e0dc7ce1d87c1f999937763f3ec6a06a887fa19985afc03ac319b58070673e655c8852bd07f78b536a722fb2d8e360f853dd15ba

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\square02_001-hd.png

MD5 73631c7200e1631163d83a99f45dfd58
SHA1 d535843878576e8d594105371d2f7eb769424a89
SHA256 e37d9366a4cb51abb2787c6f8c65a0f6bde6115c5341481acf404c7a2779d37b
SHA512 386f79cdfdf0b8fc36801040e45d2fa0eefe0ad61f9418bda1d7f36a646b082162f079512111dfb14b05c782976ad76defe7263cb996b1e33e79c75f3171c854

C:\Program Files (x86)\Steam\steamapps\downloading\322170\Resources\sfx\s462.ogg

MD5 3a494b511b96bc6d9f8226f389f6b5fb
SHA1 7bf6978b8e97964abe5c0104b4deda317d4acec3
SHA256 657e4f4f47da83d4d18d4aead498e2d32d6f41df0e866c91bfba773b8b0d18fe
SHA512 4eb4fc610ba12606afb89ec1d546a382106bcdcfec19fa105161673bc1884c0e9add08cea72c39af0e5f2a321901334ed40b1a2f8ff958072a65c5d178a2cd6c

C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

MD5 5cc592aca917d2cc2ff66f89aed8d52c
SHA1 d3abcc998a359df34be3a8da0236b26bbd2bedcc
SHA256 70d97b73e44b61be7817f8422d1569cca915021e68b9f31340a9b54abe513a4a
SHA512 4426f2fa86391a2026555d9d3a3f6b075351296b614c8ba317be5702a3bba72d2adc353f1b028a019eb02545ec6a8432a47b4e3a2d7147c8264ba9f9060198c4

C:\Program Files (x86)\Steam\steamapps\appmanifest_228980.acf

MD5 ed29e25a20a07d82683077e200fb7f5f
SHA1 dab5e2d869cb3f78e3f67d4c1ee4548fb80f66f3
SHA256 a43c90df8534cf8c80ac60f27771e51c33d1607c4c4759253fcf495c9996a4ed
SHA512 cb91c7ad93b475a2ebedaed77ab88ecd8e5cf800eb15594047291abd43a74205bd1a25b1efb76ec116dc474ef61e468ae172ef7e91a82c72e350a3e7eb052d4f

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\installscript.vdf

MD5 f12953bfa28e039e7c66b6519e68b1cc
SHA1 e2f417286ce4c5706e512d45346f5f6ea26c1ee5
SHA256 58737c5aaf109287f9e222f9289553f0996636e00a663639214f65282767fc20
SHA512 3a1444363f223ccf82a3c9c775aafb1fb1797eee79895775186da0640bc02a99c777829f34006e0884587ff5140c5fa50e5193958f8ce8699fc463015c0c68be

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\installscript.vdf

MD5 081bca29f369001a81a328369a67bdac
SHA1 9056314563128ff716ecf15f542e7ffcc1f93c00
SHA256 f2d06079d05f4d9e1ce402ba0247127c403b5b12232ab38956d2765b32012e89
SHA512 ab787d0511295bcdb3edc67a744a82abc2df0b59cc50e0edb72865a4e4f4c471a0f4888af52d92d6ad4dd986dd35594dfed21ef8afaf9264f6b8826c50904f8c

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\GeometricalDominator.mp3

MD5 334f8eb62e28ede6b768700b3f8c885f
SHA1 be062ede77433b39e063731665ba5ad2f9823020
SHA256 bbea66fa05f23337ffb6ec3e9ecab56af509a5d05cbfab18ac46c16e7f95f038
SHA512 10efc34d267f65930d232b8fc0786e5d09eeeca16a72214671db24bdf662bffc329ad72922d099212a4a9d6a12c7c1bd7203113b2cad377c2063df31d2dd4498

C:\Program Files (x86)\Steam\userdata\996293921\config\librarycache\228980.json

MD5 5216ef382c2d09e344ae46f2c073acab
SHA1 91040770b2b51d00e6b7c32a37315eef249a55bd
SHA256 2200afe5bd5dccc0cfe9d34b29eedc49014dd673e5b9b2d1797e3f52a14b5617
SHA512 0a5bc2a98fec77d33e0aca0934d547746883d5ce2b6cfe23e36dc9afe5fbd51dfe12d955213cd0123b4ca004e225182bea6722d0870ea65ba5a808756e893f7a

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\PlayerExplosion_13-uhd.png

MD5 1792db495d5ea9a6c28c9ef9b69d4b19
SHA1 dee67560040af68f6a1a2c7dd8be0c9b6b5876e6
SHA256 5ebe4c3c6bf149760df8c0a1881973f528af8c7204f656119589cb43a16edd2d
SHA512 a61acd3e458d4d9ae1f589739db977562f6ef07d14b2d1712ccf107f57ee3d828aa165170ab9194537a9bc3e7bb4ec1c8e11185dd19bc44fed031d3d38d31cb9

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\PlayerExplosion_12-uhd.png

MD5 356237ad5fa9ee51786788457949dd38
SHA1 8f3aa2f909af2b139cb82a4651c4ffa000117ad2
SHA256 ae072af74c36437f2bcaedbf80be14f73cf1d64678feae51ec987ac2ab2cf40c
SHA512 ae079cfcac846be0f0e3c3be4d31cb1f1957e20d938414f9bc8aa757633893e912276489b0dde7fc46f9e5308ca6f2f96c0d07b1d43706982335f6a2b7cdaef6

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\StayInsideMe.mp3

MD5 5bff33171c1b2c99960df085d850b6d1
SHA1 a35fd7fb57f909f4c21627df2097aac39220f005
SHA256 38f5d74127ecc2161e46f2cee9b6b59c81981c7a7857e5a06b734220638bcd54
SHA512 3284428c97576eacaab9648933fa420d9f7a3bd1204f71a908e4862ccbeeea5836d8ea434ad20983505effb3d7be8ec5d9615335311942dabd7e2fa346404129

C:\Program Files (x86)\Steam\steamapps\appmanifest_322170.acf

MD5 3880a8f8cd1b136f138cedae27f226cd
SHA1 baa66d3534288bc7bf7da478f98420a3edef0127
SHA256 ce4ad0e40db01a712427fc261e10fefd2eb1e398dddeedb85887ea0930410142
SHA512 26fa9aa0eae28b2027d5400be0129c9d38f6f4bcd49bc36b922dd37103c3cb709f4eee7c29debfd9bdff4be1d17206f719283eb28957cb8dc7ca3e8a8aea14ea

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\songs\10006086.ogg

MD5 b426b4eda066956bfd022c41ecd99001
SHA1 747ebe40143ee852cdc1c775151a2faa44fcb2e4
SHA256 0f287d725a38feb60dda0267afdca4f4c0a26e5f7826ae35efed9c5bf8791dbe
SHA512 5490c485cf3b1f34df660137d5426187c67f1b2c255681999c7c49154b2bf78a71a49567c2828fe49018a6049ee3625ed9592af260ac0cc3a24a71a1ea8246b8

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\songs\10000104.ogg

MD5 ecb01d4d493d7fa09c24dbd2a2b3b5ff
SHA1 12c929884bc989a8fd14ea87a253d0ca8636e4ad
SHA256 46d612261401fb9e9f8a3c106dea69ab4e8d1e84f153713872675d66ec4e4694
SHA512 bb51bd708db44758512d0213edeab17556d0bd294aeac17a38f666d3aa92f67c9f203a595687b8fb48fd1a3fcb244260206cbb905211a31aaad4ad349bd51d5a

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\PlayerExplosion_09-uhd.png

MD5 e813c10729ea66f16b1f7ba58a658e74
SHA1 8032a625b383ae1b88b8b8588344989897012358
SHA256 d4945cf100b7e4ec39e967b0d761b3f384f737107f6dc102e4d9c58bf2151f42
SHA512 66566b994cfd7bdcb36af7af981caec55a01c09eef04be26184e3753711dcfd2258b0549e964622190132d54e55c31e3893459f71c11e2ae3eda7c5901807979

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\Resources\PowerTrip.mp3

MD5 a751d5ac13ed2aecc1bc60649bad711e
SHA1 ab3a4d510b36e9f60846c8569bb856881be1aa87
SHA256 dd4f1eb82ffac43d3c00a0bb10c393782fad912286897129d403036e8c84f444
SHA512 7fd8253cf414763e6d466b8377fe1d24a64f70f617c5bf06a5a18380e06c72729ef186b50353be67c2e2e3aa3cb85b830bf8e4870f3d795780efa88b801f0645

C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe

MD5 374d3decf19e7f96735110d670fd143e
SHA1 c59ce2dd422b06cdeff43a20ef6ae1b51327ca38
SHA256 bf34bf193efbcd368516e657dcc44edc9612c65da32e91c617dd70cb0009c563
SHA512 783db9a0dea5359a5d3922f4dde420aaf597a362d794f53d1c1c02ce81f7a956d7e7c8423fe63d7edd20d2f8bf913ebe9b61f992c0fbd16306eb2902bfd4ca07

C:\Program Files (x86)\Steam\userdata\996293921\config\librarycache\322170.json

MD5 8c0739051c859dd37f145b3df9f2520d
SHA1 e4c92b9f186258a542e1176bbf6777ce64c3c445
SHA256 093698d0f4dbd85d49f0f13d929796a245c14f5398cabc13a86936bcb3de77bf
SHA512 b1f49af7f0f919171f0190e638b46c6b44a44d34b0acb58685644516f8f01a6c746c357ea4a24b5fc38201598e067771756e20174d23882b2f3f39f5f9b4355e

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x86.exe

MD5 1801436936e64598bab5b87b37dc7f87
SHA1 28c54491be70c38c97849c3d8cfbfdd0d3c515cb
SHA256 67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d
SHA512 0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c

memory/9940-51030-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Setup_20241108_174833165.html

MD5 3a7285613d5fd397037161556b9b8e40
SHA1 b78037a0b64b2e31b1b84b545917bbbdc09be870
SHA256 233c9c4a23fbf29560dda904906f81f0c9860855a893af6469a822210214a206
SHA512 da921783440451c2d07287e77f5d8611635ab65d628921c272f1926a421167ede1b496beb6fdb1902cf226b7399f2e61bdf40df1e31a1de9f0e403d8ffaaba5d

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 ded57a412921a8005c1d57b73402a044
SHA1 810cceaca53435969ca7bd985b72edf877de895e
SHA256 0b25fbacc26dcfd189a82bf90c13a0d46ca57880246c53e29c717e1b491061b9
SHA512 56ddf1ddaf000e26d0fce18d8d3136bfdaf10eed2a0d18fc561e3e829982f7de02a43cafaa8ec15a3a6a41e14226bf48a65cec9d276726b5a1136202d1b8eaa6

C:\Config.Msi\e5d2add.rbs

MD5 046c5bb8c4b8a07d0689b9aa236e3d29
SHA1 950c7ed3641893752e774871601a3dcf5cca5157
SHA256 9a6c82fe80728115011566c0ca15ded4ea676bd8941446aecf3d9ad3cbf7707c
SHA512 3558dc73176519ec7c0c06fd7fdec0ae8aa63da0958c34be026fae509ab733117db22e37cbae27d1eda6a674a0e65fec5e0a669670bdcf91405f335c423473e0

C:\Config.Msi\e5d2ae1.rbs

MD5 f89bb726c82553c61796cec7a450de8a
SHA1 6d0960b707e3b0c11df8c54087473a5755bd7f41
SHA256 c2781a5e40de0ace313319856fc4751f9dba2e203c6252cc141bf8049fcfec6f
SHA512 58e562377cde7c79923b8cc8e520b76b059bc8ddbc8194d946360cc4901941ca7fa814282c4574a46e051a9f469470eb6bc7f993c24fc04a3ae8b7efd05c8a0c

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2010\vcredist_x64.exe

MD5 c9d9eebccef20d637f193490cec05e79
SHA1 15d032d669078aa6f0f7fd1cbf4115a070bd034d
SHA256 cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223
SHA512 24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6

C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

MD5 da427f73cf58e258b3ad2911da15eee7
SHA1 2685661c3bca7a9750d1474b34385cff7a70ac8d
SHA256 86b3347718b43ed67793982a3b1c1b663a4e1b08a9da8e557951f68d0c768100
SHA512 d7ab09fcf89a7a42eba034a939421eb8be5410010665d99e3039a2a8eedc72a9dd458f0705601ba7cf606ad1d8d16fee942927e81e5f1626516d915431cb1b33

C:\Config.Msi\e5d2ae4.rbs

MD5 5c017d65f42860c97acacb08cb553587
SHA1 fa46f5dda5b91496456e3cd5df0849aa7c5c93a1
SHA256 16b861c45aae84613fc5a0ed3cb52d4cdc41a7177218f507d0a8ceb987a5ea36
SHA512 1b680e1e59fb4457f3495729bb03fd5c3526a0fb82fdef7aed144050a44202b7595faf1f598636faa08623caa94e905cd6969c361f63e9e7aa37b626cf76c405

C:\Config.Msi\e5d2ae8.rbs

MD5 473e61611fcfeadfd45d2d233e953953
SHA1 25ee38db38c74d0e0045848d7c1b46e1ee1a4293
SHA256 b61460fc04a3ed8ade23a225436e48f9cace113e958e9b530aea9ce67fd7cbd8
SHA512 0b10560b557a3256335cbe1758e4e3c181144f5883dc2f5987be3c221f3dabc896826a23b5a3c0f79777124b702863857834c804abd3bfea01d9c13b8c17f861

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x86.exe

MD5 0fc525b6b7b96a87523daa7a0013c69d
SHA1 df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3
SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
SHA512 729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d

C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

memory/9940-51391-0x000000006F1E0000-0x0000000070521000-memory.dmp

C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared\_CommonRedist\vcredist\2013\vcredist_x64.exe

MD5 96b61b8e069832e6b809f24ea74567ba
SHA1 8bf41ba9eef02d30635a10433817dbb6886da5a2
SHA256 e554425243e3e8ca1cd5fe550db41e6fa58a007c74fad400274b128452f38fb8
SHA512 3a55dce14bbd455808bd939a5008b67c9c7111cab61b1339528308022e587726954f8c55a597c6974dc543964bdb6532fe433556fbeeaf9f8cb4d95f2bbffc12

C:\Users\Admin\AppData\Local\Temp\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\.ba1\wixstdba.dll

MD5 a52e5220efb60813b31a82d101a97dcb
SHA1 56e16e4df0944cb07e73a01301886644f062d79b
SHA256 e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf
SHA512 d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 4153557debca42aab4e12628e46eca7b
SHA1 3102d029fec9eccbd6b39dc4abc274e2a225a94c
SHA256 75ea07208adf1f44e7972a25ca998ce4d00828dfaefdde1e122515d71aa26b1b
SHA512 68fca15ea2c1f8528e1780c0c1add916ed68a6a31b29910e366622bfc65a1ddfb5bd832a10b708b5256c0de2abe94b82cb3aef6ede9e8feb7b1a431233a2273b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 bee7d8fda5b2f3342ef60e1e131cef0f
SHA1 d47d4dccb0f4fb175421eec956cca56ef675e73f
SHA256 ef58a8d44c680c91adf4472c11a615d3935794441c23cd62b16d91b49bba9736
SHA512 e9bad58dedf7a299a1c81353ec3360f93f5d8faa14a07c923567c0d7263d92c13c9dc526038928f25d60da864fbc25abe47e9f6c0a2b91511bf78ba380023083

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 cae2cf772a54f7e610d6750f996a1c88
SHA1 b6e86cec2d9525514497fb25553be62d48784603
SHA256 5230b5bc2267c5521d57626b3d873771bc7cce87a4a116e30807f895c25b511e
SHA512 c3f859aadd0f7fc6a968f154d924e5370748c67d8c661b6175116a896983cb93679ed58b3d5a96e7b0a775a1aeb74b80e670fbd32f36e206e4f1a7d75821537b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 ba11157d4d4281d17fb0bc66e86c77f1
SHA1 44e22538e6a400b166d3a6310f9cd72b2f4ab31c
SHA256 224701ff545c92d6c245051e7f2a67e653c366894103657d6f5cf0a4ce52a1d9
SHA512 3430331b4ec5b12f296de5b32726b9a551f8df67cede622203a2b955d3479977e3176d2e756e7a41383216ae5ecac10fa90bb4c7acee1f255492e2ee32ae2db2

C:\Program Files (x86)\Steam\steamapps\appmanifest_322170.acf

MD5 03376c058e1b1a9a3c95ea6fe65d4f21
SHA1 0fc864bfadf64e9b2b38e472c94f7bb99470759f
SHA256 0fc8434050c3d4cebe14f2d3c471dd5e251b0138127c361d253d580da103f5aa
SHA512 c71f4a5ca6556dff2b8c4cf958304fe8c29d7ffdf7cf6d6b7b7df2a52392fff74b7085fec3456a6bdd90fd9067deb878f924f91e0d953663fd781cac3602505a

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 8ad004dae61709fd4130193ad5a43c97
SHA1 2a71321621c3794caa27439626d26045dcb6cab8
SHA256 e9e2f01c0e5dc5fb205cfb0a896a2f44ad2f4b172884021501661ba51ce39dba
SHA512 a11b2bb4415b8466f59d2f5ecbc76277bb4a012465cc229f9ef27ace678a33c1bfe1ed1f946590958d6194e1eae8961e1cb9f5f74033650ced801b1def16b6c3

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 3444e7ba9f08d0a304782f69052b3a28
SHA1 92b85da343bab55bf1d0ae23f492044e773bd59c
SHA256 374bc23a94f1e278015e422f5c10eeef02dbc4290354acd244ee76c9b5889780
SHA512 92c4106700a1c04713909587479b52eac73be5819c4aa42cb404fcabd6036de7b97958b7911959d154a653c7f758bae5767c3c9389ed1ff21ade8f219712998f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 99082f528f9bea205380722ae6f2e816
SHA1 debcb791052fa5dc93ad52d4d8c8454319bd4154
SHA256 0339538539c84a0a3a9e9233baa2dd48f2bcb515053c4eaa981b380fa07258c3
SHA512 d29c6d8e1e9fe3d30ba9e37c418f4a2bad613b73e334d8a4f40c1c0ce4537de29d644d87a80e2faa42f82c80ff3a96c10dc1ead237443c6b8867a7efdd1e7f32

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 2c7057b2b13d3e03fe68324eb3f29077
SHA1 23867d04bbd56da8f0acb5b336b361c5ad54c5ef
SHA256 5298e8d4f21ac4ef9b685f228ab8d846896116125e52cf5ad54c5bcd1a9f5064
SHA512 e545c3e1f414e4b9584d83d962113d06cd526d646af46e3a3a7a11cc5f7e40af74f4f12d2254d05f105cfdce586ba511e8b9b2b76806307d25a7e4ab23cffef8

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 92693b55dcee8dd5cda1e088d5d53306
SHA1 0769d6a624dba5d1400da8f96028aa16d5797e25
SHA256 d210bd74ed9aef062fd6057a9914f45a890016fa144dbd3b1c0d72909d40321a
SHA512 a7e9eb741670fb791db02670a66cbc6e20224362d3257324b8f50801fdddfcd9924ff7c8985b4bd6801f75f8239845101335d29648cf825c0156010826b2f6bd

C:\Program Files (x86)\Steam\steamapps\appmanifest_322170.acf

MD5 81fab849669ed482c707ea9103312bdb
SHA1 db8f0271eefb8f8696656e77cf820b7c88f56136
SHA256 861c65f613e4baa9a99f6410093604a8dc737d98226e5752e36d30d44131f0f9
SHA512 e07b06b9635159fafc4806cd06df9b7aeb8e82139fb1cf45ffa6f4f4d0b00bb960db082bff8eb7de9faf01196bbe29a3050c26d0dd6075fb2cb385f3e87c099d

C:\Program Files (x86)\Steam\userdata\996293921\config\librarycache\2060160.json

MD5 e1e037dd985a0381482233d72ffd4b0a
SHA1 d8d8dca84a74f2cafdd557212b10c5c1e001d798
SHA256 d65ff7453e31106815638b59bcbfd2f9d7b446c8369184b1e215f1b6333821d7
SHA512 6be71b6bfd6b6d92dda24ac48f4b58757db2a87033b228732adef5d52fdabf4585b1116d521cef99f8d34c0fff748395f289adb69b0e39155de452b2bc86f0c2

C:\Users\Admin\Desktop\The Farmer Was Replaced.url

MD5 4417e11f2e1d79d6c1f69dd870935d63
SHA1 d5e1360ded5caf7c55de6411bf9db646611fecfd
SHA256 a56d3e5cb94d656578bc4e8e0bbb5b24bf038d6e038655f5426288f2294711ea
SHA512 b52aa08b021f20b5bf811a505b94de9258f57e81491626f46bd8a5aea0b21d4d0769f439d145578666d2e0152b0c80c01395adc1e83c8aa6f561d9b8aa6a5414

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 470aa34ad1c442b6f2d07cee677b946a
SHA1 58b899faa2c291643d0ff4aa50214ed074455164
SHA256 767ec339e1bbfa05df5aff468f4991d6e3672e474861757f3dbb042b54a8b1ad
SHA512 6ff125125e8aca21e76a2512dcf56f066595c6cd079b14302b8ec9bc6957cbcd094c11779beee4f5ed75a767d39587ac48af2cf26ccc840cc581c6fa0f6f95e6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 e5fdd94cdd14544e26aba50f91ee7850
SHA1 b02f8ad87b4bc56042f68de5711f1ed510c958c7
SHA256 fc7560f5bc6035e18a0453b3134c0f129648705e06416e1eea6ac73291188db3
SHA512 14b8a7221c0426443730a823953150973407c0f8d3b9e8281e01dcdc4f8c7f1006fc0674034be3011e9346361708c9b4be10a33deab85a6baea9de1664dd70df

C:\Program Files (x86)\Steam\steamapps\appmanifest_2060160.acf~RFe5dd67d.TMP

MD5 4da7805aec84ab44b546ee6c9b8917da
SHA1 1b2a6666b01701b76e56db0dc162de78d77bdeca
SHA256 93e104889fc9bf7e65d87be7a67b8fdc3f02f49f188679a3a4f793f5b89050dc
SHA512 bcc17c897700e3252b7c089af9b2ddc2894ae2edd8f689318e369ca721dc6427dd1fee4f597819437888769638cc6b70ef95c5d8eba1ac2e954dd3c3afe43fe1

C:\Program Files (x86)\Steam\steamapps\appmanifest_2060160.acf

MD5 6d32f9b64abc2d7cd78ee0be4f60e976
SHA1 809b502dbf62b0892ec64819e30bd095c4088bae
SHA256 cce405ea1cd90f425e677300837e0d40589769aa7539c8706788de29100a9e0d
SHA512 1333cab0686ec173db21193352a6ec4cc558aad48cfd940e616ced57379bc0998c2ad8680018a32335170510586fdad719de3928e48aff4b3609825ff68237e4

C:\Program Files (x86)\Steam\steamapps\downloading\2060160\MonoBleedingEdge\etc\mono\4.0\Browsers\Compat.browser

MD5 0d831c1264b5b32a39fa347de368fe48
SHA1 187dff516f9448e63ea5078190b3347922c4b3eb
SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
SHA512 4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

C:\Program Files (x86)\Steam\steamapps\downloading\2060160\MonoBleedingEdge\etc\mono\4.0\DefaultWsdlHelpGenerator.aspx

MD5 f7be9f1841ff92f9d4040aed832e0c79
SHA1 b3e4b508aab3cf201c06892713b43ddb0c43b7ae
SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
SHA512 380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

C:\Program Files (x86)\Steam\steamapps\downloading\2060160\MonoBleedingEdge\etc\mono\4.0\settings.map

MD5 ba17ade8a8e3ee221377534c8136f617
SHA1 8e17e2aec423a8e6fb43e8cbe6215040217bb8a3
SHA256 ce1db1ad8a9512073164e3eccdc193f7eda036e1a9733caec4635de21b2865c8
SHA512 c18bcbcbd4b9a20a72b1a934d70db1eafef047f34f3ba2c6357d8e3afed07ecaab861e5571ceb58c22d4d3e5ebb34b51e366a0553c3153fbc263d1d80472e297

C:\Program Files (x86)\Steam\steamapps\downloading\2060160\MonoBleedingEdge\etc\mono\4.0\web.config

MD5 d081581e16b06480a5aaef8cdfb305ab
SHA1 771648fadc7ed9a422b4bc26e38d854d066742d7
SHA256 e38bb8cc68fe5b4edecdfd288d094b9e8ced7629039b2a347682aba0d8bd7492
SHA512 6312269cfd726a991e574b1da0c3b8a2978b248118c1610d4e8791e83f3aa6d42bdd1f4f81850eaa94c026d51e73c515971a58580cd9dfbbcadf9ba0584749c4

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 b704440e04f4ccb8fef72836efc98996
SHA1 c1de709078bdaadcdf29641828353614c7131498
SHA256 b88cbcc550b0b2528ddd423b293511e81c5853d671645b6b87e9b862b80bddfc
SHA512 02d0c3f51df78ee565aa7fc6013cb495b6ff827f83537c7f4e2f77e2052fb1286cfab5ccc99389b4761e01859f8e076e4765600ae21cf45c9819096183290fd4

C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

MD5 f93f8cf4acd53b03d799484fca691eaa
SHA1 7bce3070c3c7a4b8981a95c5f7f9f574131b6ff7
SHA256 8b0df4622f2c6cd271ffc406c7a27b67a94dc4de13cbbf7295d1456e774f7bfd
SHA512 007b1c5f5e5a02dcd699f3e10766f8def27a0984444dd687e62d9d828efa78263aed406f0fb98a065479f2bac8eb6fca5e6c94b4ba05b5e16b0894e1efd1f673

C:\Program Files (x86)\Steam\steamapps\appmanifest_2060160.acf

MD5 0b2a7257b86ccc3823de65e7fe3f4e79
SHA1 9314a66e6c91e95969807843b65e4f956b4ae745
SHA256 911517770fff61e3fd4276a9ee455d8f04bb0f7e112741b6a484be976cb24390
SHA512 5427acd12004c5fa7c4cc2281a222ea7a2ce322fe89ed7043c5c591db733cb30e2f8f4efdea250d62f258931803fa74b7b69bbdd7815384c32c31e542b83ace6

C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\TheFarmerWasReplaced.exe

MD5 29c546b5b014a56f0fe192d380acb1fb
SHA1 db484a16ab9b212c33596f81189ce3240b05b71e
SHA256 fe123562ddde691e48eaca7df399939ab906f14fe4b2e0cf83fd05e9f80de5f7
SHA512 10401e24d4641e61cd8dc7e2ae13746a61ac04ba27375a0a082f7e6adfdb3c73c414b5c214bd0db9f38e12f3e5ef95647e99869085757e900b2f234d2a58fae8

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Backup\LowK_backup22\main.py

MD5 38387423dc6b889447ee7b0514ada180
SHA1 98107a9da492a65d6aa878c0612b8b61be8eead8
SHA256 a24175a7063a8e9aa5e00909e9f23caf8d3f5b75960f7a3c6a79b48425c7a33d
SHA512 3472c0bc8e2464902c93874cd018dde98028ab6cc71186e1cc94186037c085228c8a1d0ddf45b871c5778decd97a975f1f12184475c0ed8675db67f1fe9b1041

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Saves\LowK\__builtins__.py

MD5 7b245cd48730889418462e95ec81bc07
SHA1 91b1c9932e305c69441948159437c1bfdbd17e59
SHA256 47bfb791918a1a9b73554c4c874a9453f6cd2508752299d04b829243a1969950
SHA512 772439ecc5a16a56993dcbcc899b8b2faf5fd27930df0e09e5a798fd133ad1243a56df80cdd1c9258e8c9d63d4de18a31a75da0abaa830ba0fe701fb04cc7454

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Saves\LowK\save.json

MD5 acc232516f80aa2f239020bbcfe862a6
SHA1 32923f1d476e89055b655966de99a4b9a0ff45d0
SHA256 a91c1bb399bcee283646d99168966160c2a6e1712a80dc866e6370dcbd427d50
SHA512 826860fedb9247129faff0949e671115cd36fad93201354834894a7b0a37c70a61a076cdeed2dca1327bc1e04117b4b401c99b3c425a85ae68e1ed506e93b6b0

C:\Program Files (x86)\Steam\steamapps\common\The Farmer Was Replaced\UnityCrashHandler64.exe

MD5 787cca1c807973c53c5e6fcf3e305477
SHA1 c89204dbb5c19136db7f54f7d25d26a31b3c4218
SHA256 2935b7d6018821bc76bba055dea98b785e9dfd8b46c2d1938476271638ce0075
SHA512 dbcafd0b718a4654ee2d803a680511d5c7f540ba6cae9ed1f7728397a04d24da844ccd13fb47413c37f032eb5eb11fcd682c899226a4b59ea4dee8cd467256dd

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 faece1e26632b2d5ec4cd876a721c81e
SHA1 66ae51e1f8ea0599d72270123dc5d19379513b71
SHA256 f4fc21956758e01206a4050871b6d820f14d9cfc2182b55607c9183616ff4fb9
SHA512 89e049a44dc4c80a152ab5b64423e755f63a0daa6e72d3807617489e34f6cfa6efb1f56a6a8aab16d1817b616620d6e41c10fdef1f838cc552a0630008caab97

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 3f3bc10420ac5470d7c93eca213ae5de
SHA1 7d87ab96c101767af650f43eb7071b70af41b753
SHA256 cfdc2756292a1f5ba93d6f1af6d3fe6d39352739650878e0c6190c223ddda133
SHA512 44bc06d2bc36be5576ced6cff241cde0c2e5c274ca347c5577dd0f9a8c4fde2346d9bf95d3736017a68c106e6963f4180e18aefd4856cbec365cc3f6983c23b1

C:\Program Files (x86)\Steam\steamapps\appmanifest_2060160.acf

MD5 7127938a94d3d9928798849e6fe21d19
SHA1 3719e1fcb4458f02736c265384489af3d98f7538
SHA256 83c80d4c70849f882c4983008ed16cbf926a6fee0ea63c6d4cad2e6f9fbcdb39
SHA512 bd073e65e5d51987a8a6912b65f2eed181d4a0f27e03c46849a116906b0257465ec69bfbd149385d9ae9a3ee4a5c4f951632694785b2e2c859a32f7e6cefd86a

C:\Program Files (x86)\Steam\steamapps\appmanifest_2060160.acf

MD5 d64d9319031df0701362762c5a52e7cf
SHA1 90c217aef9bc070c54d67762ed6bbe341c7f0516
SHA256 35d17ce9fa961a2d43ee572ea16a04c00d6acb804cf71dbcb6ff6e68811674a5
SHA512 58dd598ae15b887b34215f8ad5d97f33ebe2a125ee30fbf5330decd2c5477aabb0a24f364e85df01e3ea362aec0a8a198f3a033148a8bb412c87838c7c6fd0e4

C:\Program Files (x86)\Steam\userdata\996293921\gamerecordings\gamerecording.pb

MD5 ce397be4069fa027d771909d2b8003fa
SHA1 6fc17e186fce137a13672e7c252d8cf8d4e40a9b
SHA256 225ab362ec4abf52c1c93937a603869144212a1e002c22f157d5870bd304c34a
SHA512 da34e2089d556dc45949c61a08263194807902ffb8da37746eb09d37ffc52e7e9c97d65c1e42b4f4822fa6e1fb08d099dbe73c4159636edc23f41774cee1b180

C:\Program Files (x86)\Steam\userdata\996293921\7\remote\serverbrowser_hist.vdf.stmp

MD5 237dee3c008e80f43c505d7eeb487346
SHA1 2c63ef6a5741f4eb01f8cf44d6965bf9b3889762
SHA256 b4f288500663f49b80990c007f266d730b7744888a51dfcf9d6699ad6c639314
SHA512 dd589beaea158b6152ba1ddc5161cc963df57679b33c946bf4976827393b0fdb8dd708d3bcbfc192036b95454ae031efeec4707f49fc024a5a35903bc875349a

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 5f2eb1b0f9cd4d8927915a8a78b3ad03
SHA1 bd697f9cc79f5f8a604ea16915ab5af05597b45d
SHA256 5c1260bf9c7abba2595067ab4a142b7b30c7e4fb314ea35e1bf286277fa31a8a
SHA512 089670d26331f9b810ab01b4fcc0209161da98125e82f44da9c517684a3b766cf22383b566210c1d5b23f69092e514a8fced31358a3cb4f04bd72a61b53baf96

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 1941497d2ead65e238e2d9bfaebee1d8
SHA1 10da2387c659bfae2eda607bbde11f7d56e9fe7c
SHA256 054e1bd4d4f006fe4ff1088e15edae7b9294f17f0ab144809d8b4379f0dae83c
SHA512 f9619509f0de7c4e226cd39e3460847d3f44a07d2b5d9f20b501d42801ab8c2c02879a54fcd3d71da8b1a4de62172e0a660dcbb1d84a533b1024fc0f4636b2da

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Backup\LowK_backup0\main.py

MD5 bdd8e38d60d6c05ecaadd6801428735d
SHA1 8c14e7aed114b8430bc782d7aea5c8687b4b214e
SHA256 cf897848a45ff89d56811a4cced53f444f6898333172fb8e07dbc365898de06c
SHA512 1db8d1a003874d1a6a231f8f0fd75364461950d9143f9a62c650b5b4cacbc99d8fcb1d373cd42e7a5f32a8de0d7b5dd5c769878e7ab6892acf830fd3f255775a

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Backup\Save0_backup0\save.json

MD5 253bb50a71887f5b27fd1fe731724690
SHA1 1f7bc1aa18fd45cb8843b3d85bfb73ec7890d544
SHA256 c76435ba4f8e717ab34974764ec9be2b745e2893b53f718fd3ccac93aac252ec
SHA512 0410c8b0bd729aa6530adff2a83b65031c0757edf2eb90c9d959095b9bcae9e688de3ccd182b361ea3b9ba42e90969867849c410e0800281933c097ce902700f

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Backup\LowK_backup8\main.py

MD5 046911de44cb889f1b012a75f6b9a659
SHA1 f9ddab244f88acaa6ebc0afc27955224ece7615f
SHA256 4cf482764286ce745052634a56b134f0ebdbe4319ea61ff4b59a16a7a80d8be4
SHA512 7cc2f863da0bf285406e851be52640b2a9c70f8c3bba651d233ee0c5ca8c1705d5e96840d0644bf5f56d6cff67aa9bbd5ac996174b375765096b0644421e69a8

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Backup\LowK_backup18\main.py

MD5 c2c5068fbcf94a2cad6427e467c2d014
SHA1 ef8a148efa7674f5d83006089f89caf91571b85f
SHA256 67fd14ea101958db95a6f62b2c9731c58101ad8a69cb2d9d18aa0d4e1951e47c
SHA512 a34a6cfb01eb200072b58769c989d012d14ad452837130725aab9eda047793fb324da9c48229253fefea9eb55e88e4aa7765d4351ec23cdd56d4397b99cc12a0

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Backup\LowK_backup16\main.py

MD5 c2a19c61f1624d7304975dde2657c379
SHA1 a844c60acba422667f96bb6eac8a22be8d53f091
SHA256 dd27aeaa6fc77390f40dcec117c7d31dfe11fbdc590e0f0bdad6ac858a674a90
SHA512 6f5cced9d0a62f23781099ce182a854cea09f3faf22a021343f1f4abd48fb67930b156abd08e9abc686d15421d78b25c75269b5df8fabf190a572e564fd8c3c1

C:\Users\Admin\AppData\LocalLow\TheFarmerWasReplaced\TheFarmerWasReplaced\Backup\LowK_backup12\main.py

MD5 9f7a46132b5e573d37a7bd460c784d67
SHA1 459af05369d3a041d531ce9edd0211b538af14e3
SHA256 6c48e669e1aa6e83d337b5f969bfc43fc27e21a780590cb3dc6c58e780045632
SHA512 e9420acbec1596c6c1b1696abb29cd6c3acbf01b52af5bbbc0955f01d846e218b471572c459ea315db31400e663d23ec3cc2a495b5cdb09ca24b274900830478

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 5be7190740b6c1db0e1e30812a9e420d
SHA1 7b586cd776be573bf454745f1db3dbb795ffaa85
SHA256 55bc0ba455b57b0a3b50413c066c7650593eace66bf9431729960b01170d290b
SHA512 93b1bdd34e6c2d61b5d4cd3c9d1c43690723146371334f308f62f14a3d4dac81193feb75b2cf0d059cd6d5481779e38646abb4db2f9f2de3c8ac934bc61b356b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

MD5 58709a29b9a2e8f3f6b11ce7c063fd23
SHA1 b58eeebe62a86b085d2701e3fdcf228eb0ccba2c
SHA256 1fef2a7633f3bff90e56232e256292160535dafdda8bcdc772a3c959ae6083bc
SHA512 51243e1f761c5d06c65d13ea481ba7a54bf1f0f3ec7ffb8055e8706e8fac5ec91956298f9149e5654de90d7a919671ed38c4c3f927e2f74862ae604a9091350d

C:\Program Files (x86)\Steam\steamapps\appmanifest_2060160.acf

MD5 6af8c53cb18843779b19463a2598752c
SHA1 188cd1e4b6ec534c282a0a3346f8017b80b2f770
SHA256 3c79019eb9f28d0674fb2c7d7369491f471e4001e2e34a55aff425d1ee5379bb
SHA512 7638319291854794fae054bece603ed9e80681f24486bf1883dc221196ea56b886ab99b569da1eb3a9561208f4d87ea922834bbe171c78a53114e3cfa3ff2383

C:\Program Files (x86)\Steam\userdata\996293921\config\librarycache\413150.json

MD5 beeec1b92c155ed661e3bacb9eb6ddf2
SHA1 3d41abad049f6ab20cbe6c9f4ae4817fedf6d466
SHA256 dccee6d555a42cf1d469751e8e3c5b92d0c6e3e939ba0aa06b49f40d5d4b6cab
SHA512 290ac53e1d83739696e0fad75aa6bdd5caebbe06f975cd4cd2b42c3c27d6136aed3660e06ba9a7cc539b4b8505e6a329e863af76d4b8c5837ab460e524c46b4b

C:\Program Files (x86)\Steam\logs\cef_log.txt

MD5 092ffadb01bbd1ad8ccb0898b2b2b474
SHA1 d474eb89d2b67a3910522bf316fd475ab62ed27b
SHA256 15e2f2b2b3cb49f3b305413305e627adea6e92b847291c13dc7ed11615df18a6
SHA512 3aed07d82f6cfcd171bb581d6da3a6463aa10b1df71bb9477023f988d43dc8ed9b79644477cb799b655fb6274127dd26fb903c254fa0ec420374d8b705b8babb

C:\Program Files (x86)\Steam\userdata\996293921\config\librarycache\945360.json

MD5 90fb241d908527aa8389488b60104d7d
SHA1 8c143ecbf0913f3e3da367347f2bc7886a076ed0
SHA256 28b28a8096605739806edb0208a7c39fe8db205a0cd1054ab617cb0c1985ce15
SHA512 781b9734d2465a2ec1deb4ed10017d03809203ad4dfc6c6c8cdb11baf6f299cb4049ff90d46986c22ec6abc706280b799511550d099a9ff614e55eb4dccfba0e

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 f58d7eb426807e7df36063a5a8b47220
SHA1 1d6da5f1ed1fa2510bacb40d5e5b88bbe96d0e48
SHA256 fa7075eaf86683c52d6f865d00af0b12a32d9d8f1343ddab304bbdbbd73116cd
SHA512 878d8cc5263cfefa3db511ccfeb9a3aefb5655a8d536e2f32172997f976aef8b2bd28789da1665aa1ae9934d864ce053e101ce59ecad6a41472780a96e34e050

C:\Program Files (x86)\Steam\userdata\996293921\config\librarycache\730.json

MD5 3b93311ec2d5629e535e71c88095931f
SHA1 85a2889860707dc257286e8289e56bdab395667c
SHA256 d07e31b735f72462d0922ddac437d03ee3d8d182ac0b1037f4f46aae449b23b4
SHA512 f49cdabb52cfc140a746fcb544f093196158dd1ba39c99236d9b4ccadbc7c9613df13a55be7d7c999ef97073ea497e8fe6a6a6d565c81fe59cf8423add47406d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

MD5 98eaf699f517ff88bb2f595bddb2c5d8
SHA1 eae1d3e4c6e6a8f9636c0efb0a04ecbabe8b63ca
SHA256 7aa34824dbe8dbfd8011576a365dcd057127406d61702634d69f0240325cc582
SHA512 7d9623ca066012a200a01bf48e0617fcfb35cad0efff091bc3b7931e98b72b95df66205cfa904ae9b84d92c9fcea421b366d9ef3023c023488cdabf91b5ef8c5

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

MD5 e108a54da0de34cdc6f4e9b86ccf7133
SHA1 401a6ecb03eaee78ae5a8fdf0fadebf5f5fca057
SHA256 895191616e4f619abe24b796024d9a01aca5aab88c233a13894acbfc06bc841b
SHA512 8425f4c8a598aa428b65d459b9b1642ebc3164153ae95499d0fd60ffcc0097af1d18c00e4f275b45ce4ee0118068e88b9479cb144bc61c969ae309c1bfd39223

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 484bf57ea5079585f1ba2d8909c15df2
SHA1 e5361593285a7d2095b4e316cbeba6537e32840d
SHA256 b192bb78716b99015635a24dd71229b0958a9c598b79ae7ce67b36289b2164b1
SHA512 82bb8d269ce16437b52874d2e97758765398206d1ebfa756028dbab38651bff8d3f18091b704f6b8c22c7e06a6f32d2e445f9350bdb653b7b9db6f218f72941e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ce0428e0114d8c2d3ac5469c9826ca9a
SHA1 d340a8fcbbfb08960f9556309eb076abd773c667
SHA256 a48675ada04cc8f0eaee735a9582cd824347055404896e24fba830b9ad0c2e9f
SHA512 bb1b70cebe709319f42ffd480ef1f5554d2ad56c1c5c2e821ab6b1d38b11185f6259d6121436207d85cd2aad38519d9bc8d9f57375f7ad7ce231850cedc664f8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5fcf7e.TMP

MD5 3ebd9d451bf3b4fd995002a090882f40
SHA1 bec0d4b0ac1a2ef98bd347fa1ad6550bddcc45f6
SHA256 a8e3f50139bfe2841f585d495fa91d169d89d343038bdd540018e1f8909edb74
SHA512 12d1799954611f71481e00b9d20253f0e2b47c94f486442f915dfe82c784e5dcd8114f589a4bea867754c691f4c10b9c6d0a8271ffbe0bc9c1395dc55bdacb21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 09659592b8da0c093a42eccddd3864c9
SHA1 eff9155aea10e8578a90cd5b37a18b8b8772d22e
SHA256 3fb69f3738185e0dbd9d73bac652ea0927cd5547a4edd488bca06935e15e771c
SHA512 ead9236469369f5162b9c005f704f4b19cb656d5fe2d9e4415a8eb68cd602e171bae7f0d3ef563f6a285c0a0d9546ff406dae79f24c7e1b02bd654c1e386ead8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 6b7cd502be0d7ef7d3b8a02cc2a28324
SHA1 1be752e98f10e5d8015315ae780e345553aca9da
SHA256 f82662e13471b09fd607443d004ba74d3fd5664254a8e77896a6027c0483dd4c
SHA512 eb084619b065c3e8e88fe2520f58d605271949b85b7f48d110d4601467abef4c21d207a6fc3c08d34afd43d8bf8e3882910f4461750170e1ca6eb7296ef1f043

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 f4fc6999fd99e398195968c480a4b5b5
SHA1 7bc492d14b7ce9c51e5987b4bc6a110526968773
SHA256 d52f5eeae0689c97e2b940985080acd81b5c5c3b75015ee645dc1a8b51846db9
SHA512 9e9534e2e7ca81a85bde1411db482ead3eb60f904a37b13343bc2f6dca29ea81fe6b6bc0269c9f469484869fe082d163b3d7885b478288c4cdb2a6274d1d9776

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037

MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

MD5 fb2f02c107cee2b4f2286d528d23b94e
SHA1 d76d6b684b7cfbe340e61734a7c197cc672b1af3
SHA256 925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a
SHA512 be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

MD5 169c488b962bffb1fbcf2c7f1cf51cd8
SHA1 cbdd5017805e50346ce5ec32180ebe97884403f5
SHA256 11bb829b61a7373fbf07acc903bcbec2124822c208c2d3771fbd986a9bcec5ae
SHA512 67ab0dd2f1fd0fc50ce72ebb08622b2bae027c78fc34a87a29fad9e8a8ccc509a994796d4904b3d9bec90439a316f8576a7c26f51c0dbf57f1474ea279f9a39d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 12974aa0e768e896de5c7df383ce5956
SHA1 248966e61ca975c7fca322c21b9f96063f20a10c
SHA256 a816e39d1fa551871d94220e80d4a0e5c9d8084868741b3d476dd7a85f10f61e
SHA512 00ff406d3868262b2dc19b9b61d383597ca0e97aad9f7a3eca5060a071cfafbe91324c4337bc762d67247f9c1c3687967110a1b4f0725aa90ff871443481ef7a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ab0f46d35360c3104df5758fea735d44
SHA1 6af4470c59c527c3c7c0ea8af2086ba27dfd75d9
SHA256 3227df53605b3c953e08e47ed62961873b24537ef68fb898d35bbd53abd6011c
SHA512 5e9970465841594dcbf04c0119e6499f7ad2da56aed9f29802e0757cdc9cd533391e6769b8c1dea9506d3450dd811ad99b5123e461bcf43dc0ac0b85be16ebb1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

MD5 e579aca9a74ae76669750d8879e16bf3
SHA1 0b8f462b46ec2b2dbaa728bea79d611411bae752
SHA256 6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf
SHA512 df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 27cf76345ba22cd33e8d2d4a8d8856bb
SHA1 f983b398165a3078079627ed45fd439825fc26fe
SHA256 c1b6847fc54d2576bec091eb19697b4a72eb28a8e548b915e1ab795db1e5e8ee
SHA512 dd15ff75cefe19c22758fe6fdd47d3475eaf24855dd73f64f9b5b45cea9efa4b80cb9279a29b87549dbfd2920f1a6ae311355d53eb0c20c09aa96e5f53748a88

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 7cedfe157d00ba3057419ab65feb8fba
SHA1 b6b9c8282a130aebe0fc3aeec764d407c799dbf7
SHA256 6955187c83f5c98ec012264ad711ae16cfec387830329676654ec136557a3e2c
SHA512 4a6e183f45d22896ca3194c00978d814f7614a561768ace6850444dfcab4619fe1f1be873d9a5518a96d19ed613b21da2c681d353eb02553794338164baa6cf4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 6cde15c7181fbd5c1bdb139fee6e0b2f
SHA1 e15196caef8a92d0f84a32f576d63f20c574e2f2
SHA256 d649bcc446daee4b0e04f8170a8f0e451c2e9e3793d539722af8c32be8a37058
SHA512 06abcc57e29543a547d4d2f9040dbd8f13160d6aadb1037be56608ead3b2469e40062f59054cd77b9e6757915178fabe7517a5724ec1f73d8bf96625689bf2d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe60b308.TMP

MD5 15b100856cd3301027de1071872f540c
SHA1 8d3335a69751b4a2d3a1cbade5a9ab5dcece785e
SHA256 1993f11a1ebcac43c6929a149c12dcfd265a0d05a495c2d3742fb755f5f40c28
SHA512 6213e41f3cd16ae9177b698310b7e5463221ee1cbd429ce54fa5589ffddd453fbf1306a4a64bd1e4300520cc5130d21c4a7e022df312aeb59dc8fbf47eb3f3cf

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 a6f57b8d9e89862e1fc4b6cd747e5126
SHA1 cd1c3e0c0964a9f4c61e387ffbdd950d35f5d473
SHA256 1877e3c0c62d90b14fe8b68e7ca81b328f83bdf499f24ea6026eeb318861994b
SHA512 e308c148cab362b339b9c3060f52d840dfa21ba3351d46e5e919b3ac88bb712211ecbfc5a5e42f2cb2315e3103239ad586a39e37723b07b405c95c732b1db9a9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 11c679f5328c7959506dd2ded88f546f
SHA1 e18eb5207b4c997b7d1ea93af50640cdd46f98b7
SHA256 17855333918d644bbce4d0b0792989aa29d4c327abb9413e0916f06a7605492e
SHA512 bf3bcb1207b2cc81dcb4354b017e11ae8cafadf92f06eb3a02e210ef9e040468c3de70f03d2c11172c9dddff9f0dab2b6432591b52cf59a7089eefeb1799fb3a

C:\Users\Admin\Downloads\Unconfirmed 274522.crdownload

MD5 5466120f2eac36c167759305ba2e424a
SHA1 f943b2dc10d093023d45fb0ff489fb5500febc1a
SHA256 a35c220683d06ba369fe529ba9fd535b6fc2d52ab78215919bafd7572ad381d7
SHA512 c87cd194c8051bc55e3d61707f6efa5fc6f7dd0f633db63f3c8d3b5a8602c3a04c5077bb33bb3ae72397125e18b1012f8d53fa90dffe9452a96626793e5bdb96

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 e2873807ab491c16dc6f15157ac1a555
SHA1 39df00382567e5b67c80e326f81ce109edd01d57
SHA256 0e494b2a5df1a37914fc55c451adceae5a8feb66de6a84fac3c7166c58ab02d4
SHA512 5905bf3b9b7938179b99518a035f5e001c5b3d86638780c39c6e66abd035d5e438771dc979f1c5816f942cc9aaacc75233cddb2670d92bbe7b7ab638b37eb169

C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00001c

MD5 6293ad747941bf2e9773f3e333c6c342
SHA1 d504d7ddea6904d430e970f66c6a125e695a083e
SHA256 e2c778f1a6a99fbb952ebda3fea1b27f35ba5acb089a61313817ba2fc7421219
SHA512 319f2d1d4973a122bacfd787a8bd0939d133aaec8bdcf278f570477d5d19628a006698e98b5e2547dc9bd6a2105dc22f09f5004d03b360a7a51270b6c51a4746

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 afde31655be740cf4b93a0bf0054092c
SHA1 7afeb1136e24b73c7fbd7878ac96d74f1bd0544a
SHA256 c77c1b36678f19884781e5b07127b9bf5bd1d064545081c6ba6320a785260924
SHA512 4903769aed439753b4d470df629729ae4a330278c3127910d973c6ec35684b501f7a6d7e9ef37bce0aa66dff44bd5be3eaa32ded7b8215a6f4ae30a41011ac75

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 9dae2451e36729dbdf5cd9199536026f
SHA1 e0a81b40b793c7e383e0032bfc04dab70a938866
SHA256 b34c608fa1f2e3ec557ee91bb04031a95b10d155f48c80bdd155ef93c739aafa
SHA512 4b1b42dc3bed0b449a6aa41c1b515d631fdf6edd14f09f27205d37fdfd43dd80cd38af82e93f02fb1b12b543e8169b82c8189318bd818a8087661410fa70038a

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\cs_dust2.bsp

MD5 2039548e605030fd836bcc9ed7a742a4
SHA1 5e89b06e33fff25952d5e1c78d1bacd970920c4c
SHA256 c7272478b451baec0e8d8b8fa365f7a12a865dd152403b770a17e26de4147415
SHA512 d8d96918cf133e6c3efe68f035e084d26a07ed83c20a4d214a1a83cdb56e92a8152d616f6aa26fa6ae74ef074bda05487b6460994eb2b8550651c787b5107880

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\dlls\mp.dll.bak

MD5 30501d8318d426bed3f630dd37ed4f01
SHA1 d086eaba7655e8cef4835030b2a12bccfae69132
SHA256 367be9b3a5fdb9843b3dd715415e9b23e7b362d421df15009e9f6fdd5e8bc5e1
SHA512 d750654be5e7a9f6b206c029e45b51117e3f9c6f48bca9f9f48f24e0917a3ae3e703de98c3d068033ace2c847b35239e52eb5916f5d1ae841c5ef6e192bb168d

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\events\awp.sc

MD5 d14f11b47b92d829b6ec4912ca7349e8
SHA1 86b8dd77a055a3d1d154022492ed7d7e4ca371a5
SHA256 89a0f0c5f04ea6da99b4a48fb642b968d32350aa3e6697da24d2736b7bb195d0
SHA512 f19f860c86297921b972338dd0ee73241b3b822d1b9d977cee39e45891f1d57bf144cd676eb2e7e35985969613dff0896473dd8e89ad07c66e79ac94510fb5d7

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\events\deagle.sc

MD5 e41aa21f57500b1b71802b76fcaaecd1
SHA1 554eaebf267f8aaceb4e9b18e28dfa5131168a09
SHA256 2092e6c9862b42fe817a552f0ecf05a58a2609b2424402404a796c325bdf2098
SHA512 4c2b2e183bb68c16b383532aa03d5dbaebebde35b843ff442b84f6c9dba655868e7e7ba76b5b92d003db1ac73ebdd2aed5933595b35d073c702b1e841d94269d

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\game.ico

MD5 4335bd4014d837b4c94896ce8833be2a
SHA1 f16b5951eed02e3c3516389031374e95268d9ce7
SHA256 13a9046a55d6059bbf1df982569ca56a6e6d48f70917103fb71256b41e473168
SHA512 38f1b35e0689e753c673464905dd3c9f23766cfbe6e76e1fc1a47633cfe614992e964c18fe30332b658c6e4d741e9da995b16e246ce0e1d7eb1e63d49abb121f

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\gfx\env\backalleydn.tga

MD5 9fdd1b5a25c59e13091bfe30a869be19
SHA1 aa0ae6346f02d8691173cbc22326307bef7e33c5
SHA256 fbeea2b37b440aa44a8a000416067ec25c40f3382f858a6b2ae8625a98e8e4da
SHA512 a06018b75ad312a82171efb3275857cec0aa561cb39756a8c2e6286709e63112a64d060dd98448eafd86b86409bcbcb3955ed755510e3c73bb45f74a28516f0c

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\gfx\vgui\hegrenade.tga

MD5 689ff54b631b2d6484360ebfeb4db40b
SHA1 b910825b0e4f68e2748035c185121d23548f4d7f
SHA256 3eafa5253f75d8d875e33735aa3593defd7158f589f79fd1db3f959637727391
SHA512 f168a1adb47de969a908fcb7ed6bce51659d62a58da5ccb6fd663f1ccdde66fd331d8a9420590f04e0f37c391adbb734d6f784885afc759f75a08db18285e906

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\gfx\vgui\kevlar_helmet.tga

MD5 31d80cdc3818eeafd3ca28d5fcd336ee
SHA1 4ef5b5f7ea3b5ff74978a247386111210e5e3f6c
SHA256 9965f2a662f293cdf978df9346b611c38cebb22e7612206516141d85b459b711
SHA512 37eb6ae89c5dfc4c2f1a2e5b8638544546ca8eb94742afc6b35f0a000605f6bceef860ae0a257ddbb2e9687cf12893b9979d279e7534e00970f4a9faf8b2264a

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\gfx\vgui\mp5.tga

MD5 8f81a5c99134e03be3bbbaca938174d6
SHA1 23b12b6ec08950370967446e4b7c33f18de9fabf
SHA256 1c4eb081e6dee76aedf965d6e092f6d1b6ed16da2a6628d192baef9d8978eb2f
SHA512 0d3c9e63061d5ec2f15add9d938a11ce9f4e88ce24934f7951854703b06ead537e400919629d81c2f4ea38e37818c1fb76ceff8f191483d19f672fb2f9163928

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\gfx\vgui\p228.tga

MD5 8aa5f3774c87e501403a7ee33c8bf5ac
SHA1 4b7ee9c96c0447348bd3742964ac8083ad70ab46
SHA256 a7d026358f15a6757675b2744a69ec195dac359cf3860fc7820e7ac9994e3e9d
SHA512 dae5bb75c1e72dc934c7785c20087237356cffa154d8a95f97a6960ecd0457fb1d0d2296035978900c35cb5fcc89ac62b570880a0078aae0e853b9dd89850e10

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\models\fleshas\knife2.mdl

MD5 49ca3759064e007e105a7f5981e692ea
SHA1 a72fca3ca5132e3adfb201954615916f019f117c
SHA256 d9540779c22fcd7a64bd0ba8eaab98f7896dd24782abfa8b1908ecbaa1b77513
SHA512 705d8b6f2594d337932cbb541d5e63a4610b31f9d37d433079c9cd0ff5e09f318826d932795922b1cd180cf7fa7a23d5d1b9f545af198ecdb50e229190404cce

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\models\fleshas\m4a13.mdl

MD5 59d996b7739920b92a5d22d841e9e5d0
SHA1 54f5fbf9ac97fa0b45b1af2cc6cde4181966b827
SHA256 353d8b1399da73a22ef6c59b0a1489f6624c81b9166656dc4afb3b67466fc421
SHA512 9d0cc98aaa6e151a3b550c4916159c8e04114f5c4446f249a98bc07201c78b0ad4973c20708e2a8fd9eb4aa5833f91559d3fd7cfd47e549e602b9b21a9a6b263

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\models\orange.mdl

MD5 f14b062b101904f583e08c1566b54c62
SHA1 78861b98e5e81e9cbdfaa58346852b0beab92cc8
SHA256 a0d966a613a07719f3c16a16dc56e066e67a37f783004a6b98d0606a7d7b7c2e
SHA512 96845df3db85768eb7199102a6a883830b0a9df8ef7cfea5ff1de73b80ec3e93c21c39dfba687035df0785d66583c6a68aac07a53c99118bf25c406ac2964af7

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\models\oranget.mdl

MD5 d2f9bfbdfab24f89f6d2ddbb93adbc91
SHA1 282bacc14bff72671057a8ec708497e317c5144a
SHA256 1af4daafab2661cea253dd1c5f5cce5d7144d56cb76706820773c678cac8ee35
SHA512 2701e68cd88ba4ec28257be2c45cb6806376ab45bb6f2114ef3b46f7711edf1c380fdf640bc5aebf66df339d777b1408bf2f0c982f456a050abaa71b67d7ec27

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\models\player.mdl

MD5 52d571170973589af13778226ec1c2e4
SHA1 37ff26b8601b2983a67ff85634ed64dc5fa56cdb
SHA256 939d4c34cb8b7339afc286feddd45c5d88f103e3a9ae69066ab372da276f3b0e
SHA512 f84808140913810fd11de6005cdd6186152c17fbe65ad099cca6092b3c8ad3e4d56de590220c39a86f0e6f12a67a38da9cfe0c0de40cd28015ecf71feac0d749

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 e42770cd06dad9c1e4e8241204924908
SHA1 3be7202f95b79501980b3ad01c5a7e5aedee0fd3
SHA256 fe4e4c83955abe008f2351f9f5a49e76eec4f466de84b1a309724ad8be7fefd2
SHA512 ffdda49d1b46aa9e6457964d19fd277e73b581daa2a2b2b48fd90d112be70904c8033591231f352863d287647873505c1c5d422c011a7b4830630c095b70e5f3

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\models\truck.mdl

MD5 c83d00749a8de6252f562a64fb2b7972
SHA1 b73554a99f795b222328a6028e947bb9d2602b56
SHA256 5644bf4f0093c1f126950cf70a2fb8cef8103c72f369e99ac4d2c7bbff6801e2
SHA512 56a26be5a46990c9643e0afc6caa29e099f7f9297303c37c2211d1146e0c6a5b9b973a864bbb225d5c6938b6b78b7a3abdcddae8d025e34c9fc4e680788d6ce5

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\models\v_m4a1.mdl

MD5 69b1a44f116900fc3f884f1d52205dbc
SHA1 0bd69a5ad2915a619d6f9b0191d7db7cfae6969b
SHA256 9248c63dd811d85a062c0d4cdae7213f19a500b4bc73d225c78fa1e61e664033
SHA512 31a422eff02f87ca36e127e55ff367ca87b47e33df43303aa160031f8b88935e989039e0901b279f93efe3f9683b6ad425e4ac30b22a75de317029ad9fdb7c8c

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\models\w_kevlar.mdl

MD5 0d0b376429b7d62707dff6dc60e95a98
SHA1 f41e8942a54ea395aabb81bffd9c99cada299852
SHA256 0efa0d78cf766e5c7dcdfeec4a442ea9b2051e921c130ccb2c52461971e0fe7e
SHA512 75b86c571826bcb3308e2be2e44a9227b7d8d758c447323904db6036450a1d38582736ec0a07aaa587105c10973b91e3c3bb937a93d4333aea00b8e21f5e8af3

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\resource\LoadingDialogNoBanner.res

MD5 a495a4afb542e78ff4ba0ba8d54227b3
SHA1 026453abf705437eb63cc6fcd3d0edfa3535e1c0
SHA256 63ac1c7f0b7d0d73668df220cc22c9b7d18ec505aa8007505a6d9923b7e5c8c5
SHA512 e4235d17a07b1eca759aeb8155f5ca553f0778c2ed3766a51a6158db720d33a8ff2b470cee02e73c286d681cbf878016d43c6657ed2732b58a4a6bdb8eb0b814

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\resource\game_menu_mouseover.tga

MD5 b36770a623540b29126b7e59825baba7
SHA1 1d9687967f4ff66169ebeade7bd7f1a6d813e919
SHA256 2e89fd1e81a94d42fed066a19f7c86a81b4b5cf033f36dc9e5e475afc5a466d1
SHA512 d054597d5d8a32f22ac571320f6947b3f2bb47e15e695a9c0ffd771203f4a157d4c5feb389b38a8677947847f89abbd33b08f29e9dbbfd7699fb3230bb7d7533

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\misc\sheep.wav

MD5 dece445cf19d136a6d63fd2257d76c2e
SHA1 96f673a1b7133e170feea7450f4c0a6c86bdddb4
SHA256 79da45b8af813e701e14c9468050716ea74b2344ceb69d8f9cdae4ec103f4e26
SHA512 5f336c3564db9f3bfdc567179bad847ce0957874874a876ae2276ed604db9e46a0ebe4f23765c492a84e797bc5fe869d53b9bfe9a8c9021149ccd8aac7155d01

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\plats\vehicle7.wav

MD5 986c5239062f646cc3fb80ea0a21d4d0
SHA1 6ad28c7248b44ab456d6e60d6b9e067fda8e4ce7
SHA256 a97ae9246e33d39f63971a3efc2b0eca9fa4f8496cc1744dc2128f4906c9ddf6
SHA512 f5f5013bb9f398a3779f2af1bee3414c622aa544227667d1adcab2e6ef699ead0666dc3bb0c3c88812d973691c7edde8d0daa84ba19831a308e3fb29ee3def86

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\plats\vehicle_start1.wav

MD5 31eba199827cbd827edaa33db0c4d2b6
SHA1 ab0d8e0f3ed37098c8f2416e7515b5c7009f2877
SHA256 a12b5ebd21782f35a0b72bf2a1819bb279ef80b41dc4c9db018134211b02fda0
SHA512 24aad7ffc3d039925c1b9ad6e3ba921a5f583a7ff85674e77ad80c2fda434f4b53f6e853a66dd79d9d4dd94ebcec3afac2318cff6f840ccabd6170619c6e7125

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\player\pl_pain5.wav

MD5 c0fb3625cc1585cd433c32d7735093c0
SHA1 00bfc4a048b1040bb6bda52ec43e67d99097297a
SHA256 7d47f61514a0ae116b6fa8cd93563c52885624d0b7d71011e78f2177acb203ea
SHA512 da38a127fa81bd64080ddd8d3178778caa7d64e136ef83c03bfefebcd3278474ec5dddc3ba384394f392b0074593e808165d5373a4d0a365f9443382938dcda0

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\player\pl_shot1.wav

MD5 e5368c8411d0664461ae61c8d75ec269
SHA1 e23025a19b0ed3075b9297565e2db42a20e1cea2
SHA256 dbe1f165e3e986dfbe97551c98a761c133040c26f020f54ccebcbef99e4516b1
SHA512 9fd4fc40566985fb21834303585ecf6fd1d56d1ca476af4f01f3ce68a6678c02690ac9ff3e87143ef2c4f62fd2051e3418f4a8aa33a14283fac4ea0b6233657e

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\player\pl_pain6.wav

MD5 c7f10685ff1747bdc02343681469d3c0
SHA1 2cd369c18bc47d6a1f710c19c7c3bdb44a373f31
SHA256 47355ecc7540834db51b7e5184a08ce7aeee6d2d2092d485e1f0742d678ace8b
SHA512 7dd78bfbe97909d045450aa0cdbc62cb5c5d8a2b763533a8c47910a3e7a7208337f21a4eed7fb6ccfade701245bf44a18a17249c06d08bba86eec196ccb7469b

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\ak47-2.wav

MD5 fadf055f1bcb523b01caab44a3ec3119
SHA1 9a08539cee6451e8b6eff265e529201e06ff680a
SHA256 76f1f571d72c1a0c30a682b7767db1d32a8282fd555498740cdadd1b7385c61e
SHA512 52c5cbca4f41472b36b109bf95ebc4693433902750482c919b44233d8488e10695e06cab0ea79a88eb6ae314fa6b879f70725cb4729cb39769a8fb456079f48b

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\c4_beep2.wav

MD5 72608220f816dab6cbf84173d5afb54e
SHA1 931fecf4f25d742949e50d4abf427cceb58f00f9
SHA256 6a6d5a7b9eca859811e4917acb000a4a501c05611bd718f811a341f749fc63aa
SHA512 d99f2b228d368ce9454a70089de0cc790f1255bdba210794f4115d5f0d169a98d9fb9075dfe6a4a5e2efe4a75ac494f582e72454615735b2d85e96775229e899

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\de_deploy.wav

MD5 4b734d9385e8488462429ec4ce5e5317
SHA1 f2beef1d46ba5761284a55c0e5efbccc89ed9db2
SHA256 ee25642d00d071694c0ef8a89e75eb524ec90a79df8908df76911435571b6884
SHA512 8d661cf3db8adcb185c75764703d7d6f4b32a2ff7ecca1d6914b7e72789231a715ce5f41b07923fd1b7f239d8c5d50bfa5fafe9b531d4c8d469d8bfd652ba7ae

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\famas-2.wav

MD5 a50e22ff3e45ba3cd3d8bab2ce45ed9f
SHA1 5d2d5e84574731fcc26619aed70df93443b80c1f
SHA256 02d5379cf520fbd574f9d6b69134f84a09255c6a1f3ec320c905d8e70942789b
SHA512 cdcf6a17ae944981b4f4681e2a49b078ad9da90830206482643c978a6266c73ec7d77080b941c7da129fdb555e3d5b39a9d04b7e5058793466c1c2fb99d8d463

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\famas_clipin.wav

MD5 d8868bfcb4e6831deeb5137db40ae84f
SHA1 e2091a7b473d12ae8f446203a6445305618ac8e2
SHA256 ff821788730e6445b676e6fcf0d50cfb5695111d3f568c53f72c3639d5616955
SHA512 9d176286cb04bdef664b12893f83bc4e8cb6daa8c40473b5353ae79b2d25175d7d140b6084b2d2f0e69f3d4e225534f10d5de39feb7d43886eb8bb6770b8bd11

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\famas_clipout.wav

MD5 349b78e5bd36f6f5a2c3bab8a474ecac
SHA1 d0a49fa09fa43a46f35447073b2d177f4e26f74d
SHA256 676625ec6e1b323243d0d62988606c7b3b509ffb2e5b6c2cbc9a225ace6f8f79
SHA512 a07dae9f0ae0e379d51d080e815430884c52bb24d3d70d23e375a8296981a8cd8d6606a5c135d8bcfdde11aea2de72175efd93260600b04211f5eac353aa0db3

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\famas_boltslap.wav

MD5 ee863ff30f0efbd0fb4c7e9083415d64
SHA1 385bd969d869ad7011b9690fb013a75b7bbd7ba5
SHA256 9c6e01989d1b4f101a7f911e0f59f17c585906a335fdfa38be6c489a85b9b1a7
SHA512 c0e9d236bf77c0e0d988473dcc52c9ec72c71d6585c78ea539fb4d5519278ab49e75649edfed817317152eb6c0115b42555bf3d887a77b3594fb2388a07218ff

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\famas_boltpull.wav

MD5 9d534d7ccbda6dc0e47bdb72e716f9b0
SHA1 abdb00407f4063e8ff0bf146a4fbd1e0ddfd58e2
SHA256 f0fa216389e4b1ef7c0a7f0b8db4c6d246abb5fdfbefc4318e425c9c8399fddb
SHA512 356f84beca95a561c64ccc466dea0c6814aacd5eeed94fb196f437f512bf2517439e3f1e89aea766b00b47060da2455a552df302717d4669b2feec9fa7d8f87c

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\famas_forearm.wav

MD5 929fe892924ce546b9ce635fc03b2ef6
SHA1 6564c812792af93a31207eaf2adacb3f31660330
SHA256 fe8beacb5dde14a0566033d7e00bc9e247132e8051e0f0a100210cc4b2b02d36
SHA512 e262e10effa8a1667968c365276dd36e3a1361d0199d30a11a84b467e806bbac16f4a471fa028695d4e9f5acf9aed99ea56e78c15343a7a4e94ca5acfb5e27ea

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\flashbang-1.wav

MD5 1d37be7a407e04655c1f4bba182de6e4
SHA1 38e4bc79f9eae8233597cdf0320fcabf08960ded
SHA256 2896c9cee195a7bbbe50b8193b53ba8fbd251e5a938389075f6d8aee186a06b6
SHA512 3f2d125479fa89d8be066a1828a80b6a5482cb25a108073e919de1bf399015c78ced4c0cfe778b5ac30bb3727f5844f7e59a23de1c04fab0e764eb721cae6756

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\g3sg1_clipout.wav

MD5 66494ec485b910d91cf037bebb8a899e
SHA1 78f0c5ef25be0e261d035d98efbd44c17ef94f00
SHA256 523128273afaa928c151f46fe3f9f8d36d01bdb1fbc4118a7d80b64dea1ad1db
SHA512 a25c0dab97536fd467bef303de3e732224b7d4061331f1e6a3d053ebdf8e05c861535fd4dc8690c7f9a03bade835244b3f4f0b9133eeaaf4ca08ea551172af24

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\galil-2.wav

MD5 4025c701a464fa6761de8bc3436aa769
SHA1 a4e49d4907d16f4bf04292a4c3287eab2634682e
SHA256 01c6de7d4f5b90e7f993ed2afff212e887df9bd7f0606f4aaa7a4673ae39665b
SHA512 3c3b8501d3c26feef2b093b1e30e974eed9965758185381a47e18239b28a3eb45a22c427de850ae67520c79963e6a78ebfd4b5912afa640ff9561e8c1b2ce45c

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\grenade_hit2.wav

MD5 7e7c4656f8ef80a72ef0d1e41317f511
SHA1 775a6ec4f092b3e8bcb59c21787ef33e9237ae48
SHA256 ffdaf0a862ce1f47615dc1ac59af868010796eeef50de895414c40a04da3680e
SHA512 a257ce57532a8497f8df5860ae08729c78f90477f0b96264f2f98dc31ee034ec2679ace4ddf1ed4ad14ba08170354fa00e984e2dae4a17491fb5f8b7e009391b

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\hegrenade-2.wav

MD5 f9ce1f567cfccb61b0b25cb689e1081a
SHA1 05e8b80c15e8d950088c6a54d8dc173d94c99260
SHA256 b77e091ade1982812d948aa0f853d8580a91112f71e1bfe48e50faa02fe408f7
SHA512 fc4764032911836f656be881de5cdf35464abc365e668ae104268f9cf47a435e5d0fe93bbfd526bab722e5d7355a0c7510261fbdde73415eb2d5dbb9ed1b04f1

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\m249-2.wav

MD5 38aa27d5b03e3d9b357619e8433c4321
SHA1 fedf9dbc1c4ffcf5bdd259dbd10b0d70546a34aa
SHA256 d19add08916d098f0d97f20145ce80127731b3ab4703d96eeaf4dbc790d6048e
SHA512 322d7f261183175a9af949a47722bdd04cd8faeb004918542d93a4c11c27aa9d1a6bf332712972ea0b4f0c83b1ef7f57657bab8e741f79ca5c37b1d2f535664f

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\mp5-2.wav

MD5 08b52490d54af93647d18cfd17702f0a
SHA1 6ea7794250709ec9583849ca734013d6a51a0cb3
SHA256 f448c5ede6b657e8e54a0dc95cf4df9335e59d81c67fe623ef7849d298fac87f
SHA512 e9fafaf54184c063af1e7759efc795e8af7bc72dcf43cecdd5d96cc3d2cfed1b12d5f1a9ab02ed004148bc05fc1c15139d234e82e76476410d552f58e681f85f

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\p228_clipin.wav

MD5 2876bbba2adae9cf3456ea95a2c0b546
SHA1 737a3eff26b380e189ada33a028f63d75b8f0e8a
SHA256 2ebbea31183105b5d305027e960bb89dc2e2582b81ba712b01b1851501b6092d
SHA512 5423d77697905521a1718b2209a7e29fc34c94f481bf093f2ea45c3c43eb9dfce38fc8c87802c221a1813c582b626fd84446540178cba918d8e021d1b4b5dcfb

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\p228_clipout.wav

MD5 3d352efef15d6f7019168991cff7cf32
SHA1 10030aa93a41d80b35d39e59dda86e4c164f1a5f
SHA256 616e07c58c0d3d332c3c7fe65c1b7e6ef49d5c26d09d8132d1e7c36c3899ea46
SHA512 bc51565450631d2954c0736c7899aa7111aa1584b0cd20ad239a765662d5935aec7fc7b33f3fcb2d43e5a69b1a9c9728a63a5a82134ee4dce7740cfa22e9480f

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\sg550_clipout.wav

MD5 e4f0d92ee2ffcda3b464cf4934358e93
SHA1 5c5c79181331ac18ca710c586c70fa5d1236ccec
SHA256 61c2443035604b8bc34068e6fa2830de9a9ea43cddb5a4b5e4f714f0cf2ebdf6
SHA512 9ef010516cd30af7d64a366cced0667304fbd405913a5fe7d970e9de0a7cef44c06ce00dba7ba047472c1037847c068fe77f9151340150c701a1916912da304e

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\tmp-2.wav

MD5 50b1527eefedeeb9062fdcdcfd37202a
SHA1 d9af14a67d6c099734b14b2889d1e86383b989e3
SHA256 ad639a5078516499cbccee2600b5ce084643e5aeeea336340862f6fcf5608d2a
SHA512 45b9f6a0e7683c463d8ab81f429eec404bc167df076afc6b82deb652d947dd8c8ffb7ffdc3f68f94273d3a87ab37d8897cbb732fc17097af7f8d678f32878837

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\ump45_clipout.wav

MD5 823dde376e26c72a64bb70fb2e8a45ca
SHA1 301edb3ce6d3b2393d049b65eab9a9bfc28fcf1b
SHA256 ed42a1b2b755015baeb5396a6991e5d2e66dd9b234db3ae414d52ee63ff5e5ab
SHA512 c27d42032e598bc989ea19ed42f34891586904f0944901ecba8765ec5e182786419760129bff68155a7a565b352c7a9e5ddd2d03a82865ef1dbd0b07f3505f6a

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\usp2.wav

MD5 7fb87870fdbfcc2e3529fe601fe40377
SHA1 76b933a95ae595ca537fcfc35b1f3ee18dc77e91
SHA256 20fae7d8f92159564ce249509d28f3557ec3ab850080b49eca21119e09722456
SHA512 14715cea5796851e8a94964ec36b961be1749583bc76ae53e46f77acbc5f58c7e600c33e8d3bf33d70cb6c08014f05639b6910c37a86f52e0c9925f41ccdd416

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sound\weapons\usp_sliderelease.wav

MD5 44576162dc98c5a0e265a6dea7872599
SHA1 7ab27058d4166d603c51df914d62c0dc4c937bdb
SHA256 89bc64b6711ab12cd20a570174dddb6b48b35bb4e953dec8e1b4711a0d985d34
SHA512 91c8aab8e6e1024e75c24a56238b775016ff48bac6dd12035aaf61e1ca210bd4a40d8f5feae60ed1b0541617497aef8f21525d5a47d1cdd83be5e1a67985ce8c

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sprites\640hud6.spr

MD5 56d776f44221d97129d22368a38e744b
SHA1 f23f02b40c3842c9b59d8063ba6d44a525fb482e
SHA256 bc84cf45f5a024656d55d9bab18ed94371479533766a053f23f5acadbb03e281
SHA512 fbd1c775bdff709eaa7230ab7b0a741aded362824263656025deb6c879f76503e80f2e27ad4984998cf3674e08d044b87f5adf69775fb9b2b1c0c900e7efbe86

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sprites\black_smoke3.spr

MD5 0c7375ae29b0bdb8edf1ad0e8d87ed04
SHA1 b6ea11907a1b6c5508d69d8a10eee2c9a12f6c36
SHA256 8539f22177ae5ec673316d76939211dc9dc1c1c2dacdb6a52e100e1e7d5c15ea
SHA512 b229f19709d0e0cf923cd82420ad25ec308e8aed9996013e591e1d01948e1fb6235b5f94e1d46a26b67738cbea5f46ab6340983938a633a31cfd51230dcc1c26

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\sprites\pistol_smoke2.spr

MD5 cb5216837325d496cbf150594942534f
SHA1 62d923c10fc29c396637be0721215bd041216a87
SHA256 e53dcbe0ef346df5517ee76c1b38f3968f380ce390887ebb139ef3a5659e24d3
SHA512 0c949cc2df71d37c7e23df9b1ba4938ce72d330ce4960031ef927353d1026caf2c3bdd7ca60b0d424f0c20241b5cae46a74671c5f35ca72e8ef2ba41c6ce9587

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 8cb8079f22c5c2f19a449ec9d6fa35c8
SHA1 27e896d6f31053e3855ee7e0b7d0c5a53ab39f46
SHA256 4715f4df49d53c96394a6ff7015a1c5708a1cec5f0068a0c1ecb2897d9cdc5c4
SHA512 994c33eb01764857dfb6b54da93d9ab63dd385dc90f8e81d6c8a29397a30322e240565c2aa0f5c06d6852341f858b31838d75000ef95d23128ce69d89ce08fed

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\checkers\checkers_koreana.txt

MD5 822ee816c61f913cac2658d2a25f32d7
SHA1 5cb05989f3539fe5f3f703cf0d9bc83e988b6011
SHA256 b1644d77e436d5b8f4e1c45afbadb951afcf3587bb738d431d836b9d1ce3fa0d
SHA512 f59a586307499db9e6c6851d1fa2ef39bd3710ecbbd33d3d8fac205abf31609845c0961bc967e311f1978d8fffe9c02b0371799ddb7120e28b4266c810df8441

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\chess\chess_koreana.txt

MD5 d688524a824d9e448012d9ee119f8beb
SHA1 a783d71e7818bbc4b20ff3be5c58f80b30bf7b77
SHA256 1dbdd8e6e91f58687ae355a273a66e32aaee96a70e72e741b47672865469666d
SHA512 1f662c727bcb6448671b47aa2b9a5dd17be06f880c32411343d62a7f3115d8cf68d5e6e369db4f44dfd8033737eac93be0b11da1a7426330565c866bf2650b1a

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\SteamAddOns_koreana.txt

MD5 5f1defd406a56e18bb4aaa870b66bfbe
SHA1 0ed5b93b17b3b2afb28179e63d46ec6a40c3878a
SHA256 0b1e4a235336109cdc7ee99b1a1b0b6a310cf1b2ed76cd69f568783715d396e4
SHA512 7aa0b422f98f461fb7733c7efb4d852c1d212e190373c0aa59e4cc5734fd5b7a9f6c3f732d5b79801ced8816e686c34bb48f43cef2e3d72f4d5698f8d8999dee

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_6.tga

MD5 7f1329830ef51410b5887cab8597a825
SHA1 45524ad6270d9d968c65f6b08082cb40e291cead
SHA256 f3d004c958141c332ef9239f21190c058eaf79d2eac7f4d88e428a73f5a8e394
SHA512 bb82be797347edc2403e4eac04e0e00982ac50c73d4f597e29ab86c5b788b632b6046baaab483b194480ac9dbd53d0612a3f7f45548e030831bda407c5e6447e

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_Q.tga

MD5 5fcdf81a7184e1620bccd14c82c4acb5
SHA1 630ee9fcf91b907b7ef08ad0ecdda0a6d8a65e54
SHA256 4d9b5edc8c7e86a138bfc3547ac0524f8119d5e98897298ca2697b0dfe9c3ff0
SHA512 ac4adfffc67db750296c78fc05d410943d5c963db7b7c693ec3fa14fa5ad9729630ab5a7908b96b69dac323fc0952dc26307f70de38598f9805f9a13e8e3ead2

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_K.tga

MD5 e2a72fd8a0c6341dc716033268319e7b
SHA1 a4afce16f9acb4cded305265b5970b7a1986aec3
SHA256 10435a071c41d0a3f594e4393cb6ab4fd34013a7e6fcf56b604673b986688137
SHA512 7d01f87ff53f4b729b9af1ba4beb85a8eb468bdf04a4a0fbba93bc657a560ca5d4ed6ed50b1154f5c1214ce401ff036d51d29d6640a9f700ee4546587810749b

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_J.tga

MD5 8af7fc69e9ac916bf5f0abd31c4c4971
SHA1 393bd438864dc212c995c4cd7972b19902bad374
SHA256 e8ded46c3ffe5cf9f52b645c76e3dff028a1f096eed9cd2cea9b2b4e744b4a49
SHA512 8729e528074d84620ce21b415f31d4aaeaca964dedcdf7b2e1dca55e1528455486862c1cf5b75580cf17268b04c202bd06c2e45f6c1bebf365968064f1bd8dc8

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_A.tga

MD5 e23c9a14f3b549b69c33354ea1ee66cc
SHA1 7ec892499276834338b619c61d2de3967f397cb9
SHA256 b639c73b6e19686456d0f012a4ee5943053751121dcb80e76be4a61da821a083
SHA512 fd74607b208494a901f8f90a4e8de5c730586f64e90c0c38c271e8ff1b1e6c30745cbc3a70b9d571998b482671bbc20a5751bcd164bcf65fc76c5d23d1f85168

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_9.tga

MD5 7cec319d507176f9cba134ce947cbf0f
SHA1 e891c1fa742c7aeedfb1d0d5d2d7b609c9123c08
SHA256 ebb38afa60d6c689fde79ab1462c3662f7b73781c8d373c83041809d9424ddfc
SHA512 0f404328c34c2ee7fe2a3d7f71de1cd7f824f9bba2d9720d4941d598d602b1c76b750c5c8e2662787619eeaacc6d16ca49b428ee409670448d2e3f6aa630d44b

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_8.tga

MD5 b564773a476f82e1af60f876667923fb
SHA1 4bf7bb57bff314846a18b197b11431dc27068472
SHA256 9b1fb87fe0709cabbae11782f2c0a103d2af1cf2d0d88a62e36d5d15c5c21460
SHA512 8ba37007b3a4bfce91f7019537966b0529355e4c20bd1d3ab3ead33495d720daae6df1e15e5a9e71b9cf982951eba879bc4320918f78c65bcced68776a597a22

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_7.tga

MD5 453fecee830834b0f530edeab739dd9e
SHA1 a0399aabce336a94220242130b344fd23fcdb6b8
SHA256 9a1aa457774d9cd71dda661a55bd4c5ea5413c8f090640d57492084084600ee6
SHA512 bdb0b8dc852e5ba9401f7960068d086dc13d47d03de8829f7250dd710ae3f1688816dd40ebaf9ae9c1574091b79a00a61d6d222706a037e141873ecf493c0a10

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_5.tga

MD5 68e78950dc80a352447bbfef13b29b2e
SHA1 fb4050bf2e45ccdda038a79557b9f4b4644ac84d
SHA256 c78128c16670d46af556c5cd599da71bb4fb0a288a9735c9acba4c157378cd87
SHA512 79e3e8e33ebd002a7d8b6e2702b97689364a5de76b781c7c6ac1617f37e0b551bae7d733a5411c3a10e4de08de91e63b8d219ba84f8f5c4b6374f681ec0ced2c

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_4.tga

MD5 e6a420ed2e7c92ed685a697780ccfa4d
SHA1 df0351a21f4815786f5a93736b29e783141b501a
SHA256 dbcefc66cab9bd4d836db7df411759781eae7a5a226de936dd9062717882ab8f
SHA512 fc7fef156cefa890887bce7dc1dc32926b3662d2c68d88bc61f0486c524521f4fa3eb8797be730e6d41f0dd1b5cb6df32b30fec4f741aba97bb1076e8bc5c8f5

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_3.tga

MD5 56507cce6e20dd80b7f97c2076ef3aa1
SHA1 3f53a17c507505881abeb269496829e54d6e0c3b
SHA256 77624c254613fd8e55f4175756e69209ff2b62f96bf05fb61bcda7990e0c11e6
SHA512 5919150725869e4135dc996437894a93923ea2bd8b15f2b6c273c1ad2569c69844df3ffcdfc5729d181edfd9f3ce0e1c794d9ac508aa22c5fd0636e4998a350b

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\H_2.tga

MD5 3cbe3c04ac33e7f7fb599f3a7e60af0c
SHA1 db0a14811a89d288af07ccf4e5c5440f933d3c41
SHA256 44101a44dc5bde9067323316d990309092fc5be5ba1ffd3b8a5ab24fa88633c4
SHA512 5480e48646694a0c344d731e140c96e246ea895c16d6ce3b918c9a77b2bd4f714faf4253c6faed7dd43f5182aaae1cd47c8a2f0f684782f39ceeb22498739014

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_5.tga

MD5 a0f3cfdcd620c44c05b6b63bd6997997
SHA1 e3c05d25b9b874f9b9ce725f454adbc4d9b6dfb1
SHA256 c28fc8e2308d20790a52e6bd182fa9157bbe94643f890787c274025780d439c6
SHA512 8fdcb1645e0ec913c0f725caa129ee76ec2462f1ab85fe79cf7b772c8aa04fa5b92adbc17b16bc863ab7ab45a289fbaeea61aed8f15f4e9af61cac398b88216c

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_8.tga

MD5 d62204d127f026f86a94fc26167f7c92
SHA1 46ba5bec28f32d8d6f4ff9d94def9a0e6535165f
SHA256 38b7572783fe6255b3d9b35a4a2169a99763112c57a307ac00740a1aa3271c0c
SHA512 bc9b941eb3ad4b5b14df6798c3dce1be45db6f9fb1aba07e213b967c562e27248a41eaf520365f877f04183d8336a09d0ce4be67c96f76aa03066ac562769ea9

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_9.tga

MD5 4ba8511aea3061ddc630ac86cf258400
SHA1 1883e891bb6fc77b9c538bd8477fd0b8a229b631
SHA256 571ffaf007e0710ee208febbf04f261073163ab2534f19816f054ff0c6b654c8
SHA512 27c1205fd2f73d4ee1f91fa2b5d568bd6b5f90ebf0150f890378a8a856ef57eaf166fb511af4b908a7abbaf2dfdbcd63dbe17eaa543c81a617d42f6a2b44ece9

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_J.tga

MD5 1c0fcac72611928a93f173ccfe82c5f7
SHA1 15c618ab179fb8e4061745c87086757166d0023f
SHA256 a3dc3997e63e0645b3b0a2f25b2c909ad007ee3c993d8a4f96365b6feb9baf45
SHA512 4dec9965b22ed71456ddcee897506834e9215857d97d5e1095d9564681cf6b3e79e93da113fbbf66aeb226eccbd8596bb0d7a4a5d5fe2e0a9c509aaef91183a5

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_7.tga

MD5 77a1903e062b6d061f5939b9f9e16a57
SHA1 4fc9fa554e13608a81e71deba4c315d8b4614e31
SHA256 8895705ba81ce49d8dbf357f74ceff695832b3cb75d92f85d46619627f13d602
SHA512 023c6ce0325bb66c5dbbfbffd8d0ec76ddeecd6ee296d34b0d61ff94d3033d410bbb53b8202fa653f657ecd26be4e5d76093401705549edbb6ecf28c50b41f23

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_Q.tga

MD5 59e34530e32e758ae2ac970b2747e783
SHA1 d46082c91cb26c80450fcddd2150cc41e87edec1
SHA256 ed01d6ea4f63167c63600833841fa78c39f5a33370ed26d945d40d0bb12e14df
SHA512 3702fc2d2a1197663c1a90d4fe76c15088cc56bdda22b3da0ae2722f87874ea69ea3f82348d25f51b2fff2ebfca926c6487a106f5de75e7be996dd2ba0310bd2

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_6.tga

MD5 c9fe9023f4bfea0b144c3a79af6adbe6
SHA1 ca15a12c0da8e5ad15feaf663215e3162b82b1ad
SHA256 3d6c5222cb8ab008a21a671c20eccf6c290af6912a4d8517b5a05aa9e46db0e3
SHA512 8991722118eb7654f535d7a4dc2f64c0971083065121e9a2be49bf65ea5fe020833a7525bb7e325a42dbd5f426564cde4bea7153493995b490ce93a7621cc7e7

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_4.tga

MD5 cb809b26d457b8869a8d400f25033162
SHA1 e7c0998a4c677e017181e06538a190dc9a29dd4e
SHA256 fc47a8415a1e25f0921e7c7691863f9d80309a1ddc4e574cfd48b8e7b961ef30
SHA512 199ebcc1a8ff4e94340c377070672fd2ccfaf9d9bbb628f638cab8c03567825830677256cff73f844a4c5ca4968d4e6dcceabc080adb6016fa078a5c97e1ad50

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_3.tga

MD5 e2dbb9a5247f4eb5f77a464f0f4f4d52
SHA1 19e596875ce9e9e34f9c457a1001d3c26905bb20
SHA256 b74075802947515053289fddd05b6da09db765284b6d63da932b23342afc4d0d
SHA512 24afc937cc63d541ae8e8d94cd9fbcf9497e50324fe04baf33bc48c3f6fbc9c986f29e4e6bb955e1f4b3b83c1736655cced2ed5b06e547520444ac26046c9ed0

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_2.tga

MD5 fedeec806033ab73e7dbb5ed2c06f4be
SHA1 8c77b9c9842e8a04322094b3fb21c2d78af43c1f
SHA256 40c583c8740eb42349f7ba5fe0c34b8cdc06bfc16153e26880d1620acaada5ad
SHA512 4059086c97b3322607f9b40e8c2f3eb744032d45848b1d350e814aca1f539a107974997c3d43ec56b9a5ca002f776463684ca13bfc75f908c6a4f232ecb26bf7

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_T.tga

MD5 3e4403440b7297e44055fa90fac3c6d2
SHA1 160db9b19adb5860e2b448685155115cf3a5442c
SHA256 2150c40536c2039ed8bc149c7f0cfdfca668d70818d64a248ed4009c58e0f59b
SHA512 476fccd4bdd7c7d3d0ab57b9c89c223603d8567f814b5fab3bb8c1d7bad90e572a32ec40fc20bf13dd8c63825704dfdcfa0f49f715e5702bcd8f652098faba2a

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\common\cards\S_K.tga

MD5 ea6b2ef47a1e151950b3c60ed95fe258
SHA1 8ac9c9e4b21104cd993d07d59cf423560829b1a8
SHA256 286202c02bd45dda8ad56463ef9b4a1980d8174780a1ea17997f06f47f0af4c6
SHA512 282cc94eeafda373b4ea1ea37e5367841d92c61361e954b388ab85f372592979442cf98b469da03f68c046eae20e7fad4aa53919c6eed3496c037229b10dbac7

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\go\go_koreana.txt

MD5 3f2a6e41a274c67d01cc7ef775045d7f
SHA1 fd0edeaa3a9af16b14a4e942ca050fce8a62ef08
SHA256 2f29705c61627a3c22fbc81dc965a15b93652da90c81caf37ba2e14f7c9e4865
SHA512 6c9ae2591e8d3c6ae31ac67a2b81e988d7fc0228bf43b38e51342b06e3e25d5a478acfd010ace99d870aca9fbd98ef22cf5a97c42125720699756fb6ac7aa51a

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\hearts\hearts_koreana.txt

MD5 258caaf1421b164b270b616bd985b4c4
SHA1 1df4c8c5581843f4f3e11c1bd37ad186d7e65f2d
SHA256 56d19c75ab38a6fa3c49f6bf29cd954cb6f82d6892f318a212e0d0d269b8c153
SHA512 1e5ec526ead074c7d27e84b0210cb7e119f19dd245d580ddaffacf85b024773da422aa67c16fa0857b391a11587fa98fb758aa81b3b95f6fe67fb63db1eebb81

C:\Program Files (x86)\Counter-Strike-1.6\platform\AddOns\spades\spades_koreana.txt

MD5 b4527be1f2b379fdaa5b091cb8525df1
SHA1 e1e4ec04d0b6a9cc72f1f60f6d6bbea8a88927f6
SHA256 4123a2f5f159805e15d25739da5ab629eb2b063a701e9ca794851845bf95eee7
SHA512 ef6a05befbd4fadb6cfd2f48cb6ea9791c9333c29d149ade6163628a53ecfdcc92557e0b1a2f69da0cde3ea54476e6e9068388eb123c5708318ae388180546fd

C:\Program Files (x86)\Counter-Strike-1.6\platform\Friends\icon_offline.tga

MD5 08091f474e938ea73aac90c9773a6013
SHA1 c4ff881bf1c3f0f0db3bd58f47d666df6a0ff885
SHA256 50443605d94d7bedbb03c2200d7cb7e98b0eaa91e3489cd7d77f69a407b73e0a
SHA512 7f569511d12a36fdcf6193aa52a2845b53f6d2a2e075426708f542f0012360a48cdc520ec6b26b0d1dd9f86c0ba41c8205483d340963aa0acfbaaca03a7ee0f5

C:\Program Files (x86)\Counter-Strike-1.6\platform\Friends\trackerui_koreana.txt

MD5 a12febfaf76faa8724f0818112ec7d1c
SHA1 102231db7da26eddcaecf1cc57eb7f1705ab6ab2
SHA256 7dd1c65299103398375aa4d2c537a0cc2aec051e002769002214903fd5796001
SHA512 1a789c67722260c8cf2f944b8832362d4b97926fcb1c382022eb1ec2467c571ec7e9059a5b1e3bdfe06d900ddd955ca3f95c6733ed333a941e8c54f1b6fd3d8d

C:\Program Files (x86)\Counter-Strike-1.6\platform\materials\debug\debugsolidmodelhulls.vmt

MD5 9740483914ed241cb2786354e7fb5975
SHA1 3200274138b210b86bbe5c588f85f2fc6b20f939
SHA256 da23f86d607d9d1d3464b3dfc92948510444163eb796a68ec8d41f5de7b992d5
SHA512 876d9040eb6c1589a4b029c0d59216a9bdca34d605f27342d84349d336a84aa30d4df54d7ce1208df771807fb6e4f5b08c3405d6d78524a9f632171468e78bbf

C:\Program Files (x86)\Counter-Strike-1.6\platform\resource\platform_koreana.txt

MD5 557be40fabfe9d9cca9e4445510882d6
SHA1 609b73443d1d6400f84909adcfde403add54e439
SHA256 50f50e22f4b83b84c0790aba00b94e795a5f8d4464470ff517a13c6b4285c440
SHA512 54e7cf693b7798d24c9e9ffd4cb75cfceec1c8ba80bc4b0284e559c6adf9593800de690b029c0b68e597473d8d9a25c772defc40b8f0b12f02f49d3c0771c329

C:\Program Files (x86)\Counter-Strike-1.6\platform\resource\vgui_koreana.txt

MD5 61c7be0d8ea191138eee30db1e1f2272
SHA1 c2c54d37372b9b580f481665f5878c0a33beb53d
SHA256 17f880ef2907d845d2980d80560161601be411fa6a4ceb971a2901b90970ceb5
SHA512 3a254684e6c4d1df11e15f67a66e6f5d59607c18ffa92a03dba1e4e6011f6e8929a324e26e124cb021aaa3e5eae8b6016e925f9b2c29c7e9a9e9a5e0e9ad71f0

C:\Program Files (x86)\Counter-Strike-1.6\platform\Servers\serverbrowser_koreana.txt

MD5 791759935e06a12026d001f806e569b6
SHA1 9790f41735cb477b33c870b514c4c673860e9235
SHA256 7758f337170e5aba7268f2b6116d42f3ba298c77a32e3e2c36e165cf42c72f14
SHA512 b8f477211a648df573121ba51036e1c3b0ce8e2117f911b305a13d92ae4ec4d229b4f012a49255d502736377a69ce3b9bb4d5f658e6eeefd83255e8651767af7

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\cached\creditcard_back_amex.tga

MD5 e5e3a9fa341ffe9e575953fe0a0aea24
SHA1 7755b4a3004cfdb1763c03f5b92b0eeefde003b7
SHA256 824cd8b850e621062e7e9276f494ac5f077bd7b90cae1c54822b4cd9ded100c5
SHA512 ae33a0c016111e0ff9e4d74c651d6ecef7e373df0a839063572ffe8678a54f88c61285a9694c9a2d3208b6b8c76fff2e72cf5f19beed699bc5beea07a16395a6

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\cached\PreloadSubscription_ActivelyPreloading_Payed_NotPlayable.res

MD5 9797ccddca9b1e80121f5ee479352c97
SHA1 86422037a3ea6f459de4ed179d3f0dee9887439b
SHA256 7461a89e4f4ae9695907c5c35440a96b5d69c3aa35671ca65ecdeacb29136f87
SHA512 b7b863a6f196afa3564fde6b1c52d0133e655f7afa34b5820549eda5fa2336527f3138ab013164660fad8f9244c9243d861463d18df7fe1a33c6141af2b1e531

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\cached\PurchaseSubCreditCardDiners.res

MD5 18581b2844d1b35bd0dc170f8557bc42
SHA1 05e8657b8f73f2608aeb07edd8f469f3639d29b7
SHA256 7f00fc14809350a11d04cb655e996beb4d829ae7c2d7ca320968661961e18fd2
SHA512 cb2be96b5ae7cc5c593f954092ec663b8ff41e06f2597b24bbec8883a025baa75bbc6c15cb24fa29389e05b7bdb0d017bb47ef747a524eea53b77fb4a479087a

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\cached\PreloadSubscription_NotPreloading_Payed_NotPlayable.res

MD5 369af8febb9873bdeeaac56849aa5edd
SHA1 c6efbc06e5f70605e4023dfa469d4891734898d8
SHA256 274dc979c3ce26ccb18b3c8dc38e79b31a1fded218f2fecaa460760a72afe0ed
SHA512 be7868ae847fc457788bd1eb77522f44505e9894a2c18e6516dc696dabc38748ffe9ad2a1aacaa4c163588b68ace93a4bf8d921ff8036798d36cb216ada32360

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\games\condition zero.ico

MD5 3485998ef1bbf8ccc866af56eea206f8
SHA1 cd0ee6cb22904e712f408576a4fe9e74e045e098
SHA256 ef29dbcd5c163b52dbc9bb1a403653708507e601ddd827971928edb640235490
SHA512 eac31c91f1143be9c3300a25a2959c410533fff023a74f191af7ffe97e688b2fb8682902f94d9c4eb302e4952e969e24685395b8b7a886405d99d2bffa5c7a15

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\games\Half-Life 2.ico

MD5 fa223dc178f827155f6a1dbbac6dc762
SHA1 f3389f48f7477f746f8c898e500aed255e662749
SHA256 2effe91cd1e8777ea7c12417003d8279f3657dc0732cad23ef042e7bcdfff4c4
SHA512 ebeac290694b703b9371aca29a4809d50bef1b229c6ae4248a9da08a7203375728746074d85ed73dffcc712bf74d1693c145d17bbe99f1bf2015f0476e0f4e0c

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\games\half-life.ico

MD5 f02c1d45a1a86f5d60ce9e310e24d144
SHA1 d991f95d96e1c76d2acb944bb09447628cd96caa
SHA256 01491c012c29f4706f0cc8f1117eb0f882b54f720bfbf320a3271ffac6c929dc
SHA512 88dafe4039264818c4193f563376db890ecea2f8f67df7902dd76aacd08be4cb47197257d02217eeec1a81295615b30b89e91d097837193a8fb64e72d03d7334

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\games\icon_lostcoast_dull.tga

MD5 200380f4259d09ec3f433e421cd5a55f
SHA1 9afc9cf71fd5949198b77bf7ec396a89058d6dee
SHA256 e136089e82c2d98a7283b55dcd93c5332a332149e7119d015bb7c353435ea9c6
SHA512 c77a433055077420eae1fcae302fc0738f592b8081ba2bdcae2015a3296672f1df2518934821d424e3a8c9535bf1891cbe7394c16ac68520099a3d7dfb4c50cf

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\games\icon_sourceSDK_dull.tga

MD5 8f365d1e50c281639030d5d324d34cbe
SHA1 42c9ded0015e890e2de60093cf61bac99d4da5f6
SHA256 b91bcaf3aa2e26c0454f709f99ff45349fbb1be2baa7094d1298b217440ff32f
SHA512 12cb7fd74ca7797b83a740cb8ea0a1ddcf0dde1ccf9c84e1af7134f402c58b7e5e1c310c9cb0d5d44aaa751e5b7b5af6a4414a5f4dd530c3b909a0f1966566e6

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\games\icon_sourceSDK.tga

MD5 5293c8b26b32fea1972f3a53a62fd307
SHA1 81c749f4232d97300636281e28c6236ca3d589e5
SHA256 d55509e345d96fa54092b7cd9b46a9ec6e6a2b249ce71048e5edfbaef7fbb6fd
SHA512 427328c999947a45a839e0679e4e4d62041dfe8ffeb32702c7511cf3ad5442d6e5f63a5a6f0749a28e08eedb162fe34a429d7dd192bc4d1f0565398cd78fd317

C:\Program Files (x86)\Counter-Strike-1.6\platform\Steam\games\icon_lostcoast.tga

MD5 0b5cc5aecf0b47e2886c384908532dbe
SHA1 add589f862a5fb871f8c84871501791b5dfb3c62
SHA256 e5972753625daccf5bd9b735261b60375b5f46cc5adcc8d1c18fd36cde5d7d1c
SHA512 859647325ab25bb1d412001bf425babbc720c7cb72c3255768fcd03b29b34908f68946478f5855e96358de74230aac396559411d71860c0e5bf5414929a69d6f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 e87087c61b9c3fc6a0d96c12eedc7f18
SHA1 009b7b9939b17ce295db567939bbd6dca1504026
SHA256 b4f9d3d6f684b794d57f3052fbee9bd0969071cf0ebce255b3198c47176ff725
SHA512 615e1ffa83e6f2f9e9e492905edcc14c2deed805a59af072aa9135fb78f9b45ce296936d007fcbe74ec4ff55833752fbc20e7ce24d1f29055281941094efc4ae

C:\Program Files (x86)\Counter-Strike-1.6\valve\cl_dlls\GameUI.dll

MD5 7050fafa87936d6a22b445b2252c2364
SHA1 eef08a9359dfc428b567d56528edfc2de6fb9120
SHA256 5359ffc4589711c625f88ba717391a05cfa91ce273e580a26e27298ad91f38ec
SHA512 50d962f491678bd900a33f889e751573a60aad70744b09fdb2de5a5433246589f45068c600e13529e99789a2e8d580d67bdde37e88db6fed78146b6582f157ae

C:\Program Files (x86)\Counter-Strike-1.6\valve\events\crossbow2.sc

MD5 8cfcc0a84d0b6b51995ce17bc9f194f2
SHA1 f86d5edad7e5a3e2d994517da5ebd7d748a8c666
SHA256 2c7d43b8dc6ea01a32acddb7798b9dabf0ec44c7a6dcf75160539a7fe53e029d
SHA512 5f75243ff3e13b557859d89593432f5e29f014f2bc527bee363be3369e884feccb15ee593094c7eb0f8e4786b6a352cdf9fc6039636782cd23712cadc114ee1b

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\palette.lmp

MD5 5fb93560c8ae637ba463d084b0ec505e
SHA1 1b2a6a5bb0a579b0f3df9cb6c6152a9c65cb9e62
SHA256 036b7ea3c8c03be214bb7d22b8d63ac27f63d547e42ca677fef344ddc780961e
SHA512 0883834f1150791b4e060e080e7a07eeb60310b88e0334db094c64af5f5b147ebd51cb1e3baa514ea53d286df9876df86d7d463c7e2675c14a5050d0be4003a9

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1280_arrowdown.tga

MD5 cd89fd0107ed6c76e1fd0e9c11ec4617
SHA1 6f5f187108b235dd6fbf3218ba05b52cfce2a38f
SHA256 0c97e1d6a083ad204bae5ecd4e8b29ad97ec48cd932377094606b67aacc4dc51
SHA512 2a7050c21cdf75affc26b39e1f6e20774436af8124fc08afd54176d574c9c8b3c2b4d28ace11c1d9b775ae4bda0fb340a202854fe209408c125a941690a014ce

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1280_arrowup.tga

MD5 2bd62a8772833f2d5450db895d664e61
SHA1 15d350619c9737624707d56536d775194348c6e1
SHA256 6e25ee365f0f7eae04736cf6a4461509c6b3310ef9ac250ae5dc008591e4c627
SHA512 4a763fe534dbecb5979263e54f9995d5d621cdb166b2f966552e1b2aee54a339f9782a47074f27abe39cf1ef26aaf9de862f464668fb0896232adf73684f2e0b

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1280_arrowright.tga

MD5 a42119bb4749b3951b240c36a8d04abc
SHA1 d907e5f48ca812316c95d46c560742ad1b46a0c8
SHA256 a1fcee4ada231c29bc7957dd9a913fe788f632fb049f1bb4307f6a78fc61003a
SHA512 f49320861ea3ace9c67b06c7842acf3f38a4a6fa7c9390419f4b98a8d944706be5db4f38c1cba277ccfa151a20e0cbbf8dce1d19d3406e866e4dadf004d82840

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1280_arrowleft.tga

MD5 6e3a6f819835ed86d2482dde1977edca
SHA1 1dfa68c5bf8c8d3d1dcf9f083b38205698cd7729
SHA256 2b203d84e0253d71fe2de06b430072f1f33c45b11a34625053859803f97b1422
SHA512 f6a41b7a789f88a7f78a0a563feec8371f4396fd95821136751f921d05d8a8af63a7aff9abe76c378ab6a8d27f2c90aee94e9c921afb15b73d381a861977fd02

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1152_timer.tga

MD5 6deae390d10e5faef07cb793138a4ea2
SHA1 0e1b89e5e5e61f5e8959d3d6e17fc874f3d14a8e
SHA256 1efacc8931f4e6558fc9f854527e25e004d8c3fd90f1f5209273236924a9241b
SHA512 70c1ab592e46440f759ffdaa2ba1bbb9206212670762fbdbeb04f85da2304120e0a052ea4164fc0e0326e82c013924d0db0ea27fc21041489fc6d6d69b69d93a

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1920_arrowdown.tga

MD5 3ba8009f5fe7d44a44085581bf452fb7
SHA1 bc4479ff25f3a44133b3521af2c74d3ea9c174ad
SHA256 2ec11caed5f1a7f27ec3e163f210dfc403579a80eac9044fdca87b35d96cf989
SHA512 f3447c164ef35abc8ef5e560e4600f9682bb4b4d188932ea704ec18d2c30d210cc95b6146ec34c9846ddeae03d8ac4000831dde6e8950221b2e01891408b1c5b

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1920_arrowleft.tga

MD5 aace3f2394f8de3358e8830c8a38a2bc
SHA1 c46024be49f337b76c0e86557620dfb5c281ffa4
SHA256 88bac6a026b4968863453efd64240ad13b94cbb70e519c36c37e8afb97859096
SHA512 80339d9b45f04a65ddc451c80fac25ab97281f7a7f7bdc2a817f070c9394f27d006bf95497991723e53533468bbcfd7fa197a8f25d5917a22e05b78dce30905b

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1920_arrowright.tga

MD5 3498dbc609accf33f9176f35683e9ad8
SHA1 bbac94fcb8ac6c22cb05d23060062709010a1b97
SHA256 94bc7f32eda56dab718a2e8790e4de25200fe1d11626c38d3068d287b6a1b78a
SHA512 b2e0880dcfcca7eeec2597f0ac147d328e818d90c145252cc5cb6005230c226b0de5a170a3dbd761067fbca094c409c4e85cad4c76f0c05c42c450efab11bb7d

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1920_timer.tga

MD5 8db670d55d945ddc8c58813d5c2bd1ab
SHA1 f345cc4d2e504e0a47a4428b605463f0aad0fc56
SHA256 dd5424ce7ba6978cb4b0368943e50896d6dcb18e08df3f0fbb8c942c27ddf27c
SHA512 14364b176fe43042fb2fe5d5acf536872c06212a76e0e6d5a5f93d0f87aa4201012f7d98a90770a04f43b62c3114a0fa30b3652137243fcb166724bece73011f

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\1920_arrowup.tga

MD5 7de26bb1432749154d7b7934a6aa6fc1
SHA1 c6918704f5e61e19aa2112c499ffb96fe02899c2
SHA256 b5073a6be382c7e04ba75d6239c653aed7eec2082dc907dc08288acf33cf4f52
SHA512 07848ed71d4f2e885f7e0cc803430ea9595e4417d8781079c88d947eaa2fa7ee2c24e4ee4a61a482fedb1f04f1cb74a3fe6b635a94999cf4c621e5d45c0fc711

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\800_arrowdown.tga

MD5 7c2e90b8793df88727a00b38f20fe5d5
SHA1 c0e55d97b26891043117567863dba7c7a8814b70
SHA256 c0e525382bc3b0fa03415e7db5bbfe2e0ac547ff921a0525fc284b0d6b072fdd
SHA512 5f34d05c36348eca7f453d158d4165dc865e4645266b722edd78e42371c53dd4a7792828cbb400f0c9513db8c8c69cf9f5542a9335e098bf20d27992ed3dcae8

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\800_arrowleft.tga

MD5 a2ab48d4f11c9a3f89137d8593b8727f
SHA1 4488849e1a295ae7b12da606f14dfd1797d6a30b
SHA256 35005356b10fd6a8e13bd8e48e1348993ef3f52b46cbcd3521bb1954a9dab74b
SHA512 37510459d4ca27b36c68ee0efe6046632bcd8edaad5b8ea29c570be4a6ca4c12ef5d8959bb7e581aa8b062f0936ad7035d3d7e07210c02ca815c93d964bbfa13

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\800_arrowright.tga

MD5 f7035af9a5f4f627998433e6a063e76d
SHA1 b36a4047d775b09e72c7d37527fa852733346cab
SHA256 d4edfed0ea573008b33603b16be4dc6da0e08b815f7d78393271b26de4d4e54d
SHA512 8749c185c1417c4b7c9dcc110bcf52fef37710167d58e649819a21e2b546fa2e41b84b1a499af07aa46cbede1bd833b27fed1dda99fdb5e21facccb3c59a9f7e

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\800_arrowup.tga

MD5 9a236bd4e3a85b8039286a780168c290
SHA1 d756c8e3b6c0212fdb8dd9acda8386f11ce32e96
SHA256 7c71e82e5d6a45ffb778def644c0dba8c5e6164b755832c674c3b931f0861d12
SHA512 42b14e028da153eb99c820a5604265fb822673dc1046929675fc29d30d0fa63c8e183bf4760735657e7d0894d45b491ed6103e539912b6ace49c9053795d0695

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\800_timer.tga

MD5 1926ecbcf1b403f0c4a30426ea74276c
SHA1 24d8e0d5f3477f85e76985a0fc579e392482c402
SHA256 99986396ea8ebd9ab4eb1221b52db2a8a024e67c748e0b8080d8dad24e4e9cd2
SHA512 8e944a0304620fb7428acbe883049167c0bc1596d8f294b1ebcb383899e6881c5e54221ea5a60fa7c14210e5cfd91831a8481020608c22747f43c2f9d7e45060

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1024_Scoreboard Small Text.tga

MD5 bca82506d597eed9b5507ff7ba16567b
SHA1 55ad94cc92b95ce8e2adf62df94a6a8244980e8f
SHA256 4eb392f4136f1a4b255ab26772947e62b80615ca8b1ccea93563c3f33539a8bd
SHA512 e817036968d39d3f86c2f6f241c6f80756bf139a700adf018feb870542331b230cad6369652eb2a26b26e94b14c3e27dc0112d3ccd1c512f73e8b056ddeb12fc

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1024_Title Font.tga

MD5 277585b15795e85bc33d82eac7c90cb1
SHA1 b05b40e3abf6e64c2f89aefddabc101c00ab63c2
SHA256 2a2d6cade3d2b0de9822efca3812d91af06f7140547b65a7b8eae0c8f9cc4430
SHA512 65970365f78c0261e34c567deae218e752b7535f3828467ae785617201e3194257d89fc91a097989beda2683d1ce347d11c2846e04c74b5c194d50b76bb0e617

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1024_Primary Button Text.tga

MD5 46f3cc3d5ca0f0e80d30ec38a3ed9702
SHA1 2b7902e73522c60bb4e5a6d7905f91967ec54b46
SHA256 824ad8824e4d05319556d9c08dd0d4c90fecd6150a0dbcae8c946740cb4e2c56
SHA512 9f85b11a9479af47963155fc823a9390794b3db05fb50011efaa87e1adcf772d18fdc1bd57f3ca556ded84d5fc5671236ee0705043771c83663612cd2b0f16d3

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1152_Title Font.tga

MD5 293f79e66c740942a2d7136b03ba42dd
SHA1 91edc4d29f62f6273762d623f8f91758ad28bb3d
SHA256 7a9f84fe3c6dab5ec161da7acef69e8f09256e3d7abae9c034bccb87000a02f7
SHA512 dc0e7bba7d7767499e26ac183df7dbe4e56ba8be85da7ed8b194edac0a02f7ce3f2f284f781a36c5e674bce6abe54470541b6b3ea57ca6586a76b2069533bfee

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1280_Scoreboard Small Text.tga

MD5 910e7f920f59348e20f787d9240fe2a7
SHA1 9f85998b0a73efbf34b2e732942a0caada57925d
SHA256 93eba9e5ba94654d73d76944cb9860e4fe8db92a6c734fcbc57864cb766caf1d
SHA512 a19fad5b08875df9f16993d48562cc2cb4bf5d918b5f102b0439c6d6d6fdb862783762d586393b0e0b6c324de3c38c27fbf09d4b48c55affd44aad2c1ee9726d

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1280_Primary Button Text.tga

MD5 4ed17a87a346560272c439dd5fc8da67
SHA1 230978ff39d9625424647bcbc8e90756e79cf58d
SHA256 3c0a85646aed020ee61e7286a5c0104a9a1b26a0aacb0c6b977420d5f1d192a2
SHA512 28e3ef3b2ccde25f5ce84d4370aba345162c5ac771ef0c0bc446ab041125f6bea5d042283b28e107962005786862729374e442dfd12b547cdfe58f61d44ad907

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1280_Title Font.tga

MD5 950ce4f2583aab6854f2f3daf43d275a
SHA1 041be03920912db7791d4098a8b3e1d6a8d7bc10
SHA256 8bc1a1698604836ab766fec452e5366774ef3057a74ac373de8bc2a9bbe58b32
SHA512 420d21c295b8aea3f28bfa299fe9f6dfcdb726f0a5b7b024ae379299b86cd229b654d870e826c21b7e095001f98bf646360f6aab5973587f6ddd2d4e2929b933

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1600_Scoreboard Small Text.tga

MD5 d3d6c70dd23590745a0f691c28f88848
SHA1 b46b4a8427c59e590f8adace2ab659da2f4f4e9d
SHA256 f472485bdddb0f7acdce7ba6dfb1520dfdab6b2e870b37f77f61714533c5fe79
SHA512 06a400b5462c9a307bb281cf725358a8bc64a27e34b5f6b95748d3006703e66c4a756ad86fc5e2de9c2a2eba534921234fc2ec422b6107ef7264f7344a258a92

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1600_Primary Button Text.tga

MD5 ec8766ea06b999dab276c2ed85397067
SHA1 d043859519210810ab69bc4172406511b0391728
SHA256 dff807e488eee92c3f841de1f330bac00b42c36e34320e6335ed6e5d926243a8
SHA512 5b69d36450816306ba280d2690c65f7478b84a4b1d8eba37b8a4baf8631d767859599e1b20bcabb930dbb7ebbfd07d89bb3336c9999809c50e20fc0661cfb77c

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\1600_Title Font.tga

MD5 a80b9ae2ceb6fd94580f6bc1ee9a24cd
SHA1 69b41ecca064e9528bdabf40ec4e0d398749ca30
SHA256 4741da08d0699272b1db37248f8e4b74d736035bc3df0fb54c19b09da732211c
SHA512 e69cdfd82942421f4eb1ee625d8e8a91216221efa0046e92987134b0f5cf5d6991b51bb11faa94a82cbb8b856bc4a920f53f99a5c31b67e13291fd722ade8431

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\640_Primary Button Text.tga

MD5 ebc1b6a271bf99cdadc78dae5e9a29c4
SHA1 afddb10163d0cacf30f7a2e9f9e4f534c8425586
SHA256 3988ddbea3e6fd927933a698d28d66572d51e59938ea16624f644afe2021818d
SHA512 ccbc9f59f59c46187954d5e8a70513542471a40e8653f59c8d58279777c9c378f2e1891c4949d8d5b104117410e991f756d768932fd5353dfcbdca3c37d6ac1a

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\640_Scoreboard Small Text.tga

MD5 07306c3fa68e4b5bb4fd4da515adfdc1
SHA1 ae0203c50a3ef107992d61f4b135efd6fdc809ba
SHA256 fad8e72511e03ea0b215e491da1ada731d7474a03d43c26a2f858c8fcee9beac
SHA512 d6d1b8f13d9263932f8757fed790dcbcdca681ca51a7581ca552631409b8c65de212436f8e161c60463edf8589067118d15537789e8aead85eeb156af5c29a7a

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\800_Briefing Text.tga

MD5 8148e0f0a6679ced3ca04fd6c258d478
SHA1 9afc1daad5e004bb9481147ec5fac15693897f2c
SHA256 60946960e36a56fe17b02ab7c618e3ca0d61b7412acbb9967271ff309a76b5e0
SHA512 918c03891b46c645ff9b1a497a77bfee752befdbc2e82b882ca3d665dea21d3de1b112848ebb9b996b201c14bc14a70231838eece3df04a431becd0852417bed

C:\Program Files (x86)\Counter-Strike-1.6\valve\gfx\vgui\fonts\800_Primary Button Text.tga

MD5 a06ae3f8fe07c419b05e2c803d14997d
SHA1 d88fd662df45404e6874997b58ed98b1e718e844
SHA256 17a5a27301be4a264b6cfa1b663910e158a75693ca032d2b8cfd3d41c66efa24
SHA512 315ec6aa137576b3dc3549bbdf1c4a7c82617fe2c0c7c6bf84297fbe6e2bad3d30ad8ec5588e8b3a0230f360e27779700b40d1934e5debe31c3e280c14c55f62

C:\Program Files (x86)\Counter-Strike-1.6\valve\hw\opengl.cfg

MD5 815488687110fd2650fb723e12ac17b1
SHA1 61bd1b2720de8ee30a0545ec175ca9cac973052e
SHA256 a38ef73f270f04ea4ab1f7c769a873c5b096c2495471c8dfc7714e09f816872a
SHA512 19223a2f7a19e1207ac6465c5b72a41cc1f32e265382df6831dfab4d424142fd3863f1a6a4d68ebdec4f0869ffbb99c416c06e9907d0952af0224eed87100f63

C:\Program Files (x86)\Counter-Strike-1.6\valve\hw\PowerVRSG.cfg

MD5 7c2d910a94700c4bc996be0e7be3d9bb
SHA1 37f28473f1226dcba50edc0b411998817eaa3b16
SHA256 ed1cdf2d0d7d7c1d5e437b552fb792f40c3a48f336eede90088d752af90c7da8
SHA512 bc1dde19236290780f012e2bf44d8972e3b3055b7d41c15934a3ba507c93e93f799badbf137d5ad49083e1823da95a16085538eb190d012c5e373d24e03cd69c

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 9d7fed12abde6641193edb10d5c1760a
SHA1 4ed9aba2ad9f42e743042a3245d1fc72ba9c8e90
SHA256 23f6f420a3b42a8c8f6e30cb684f07ef514efd31becce682f5bef807a28a4c1f
SHA512 1c471cf9239cd4c96596cf537d667abc7cf113fe519754e5804c86f19a14c1b1a0eea9cfb681064fb7472d786cb719adea9bbd2762fbb8635e3e9f89d40ba102

C:\Program Files (x86)\Counter-Strike-1.6\valve\hw\joystick.cfg

MD5 23b58def11b45727d3351702515f86af
SHA1 099600a10a944114aac406d136b625fb416dd779
SHA256 6c179f21e6f62b629055d8ab40f454ed02e48b68563913473b857d3638e23b28
SHA512 16b7aa7f7e549ba129c776bb91ce1e692da103271242d44a9bc145cf338450c90132496ead2530f527b1bd7f50544f37e7d27a2d2bbb58099890aa320f40aca9

C:\Program Files (x86)\Counter-Strike-1.6\valve\hw\ATIRage128d3d.cfg

MD5 1a47243d1e17e287a9fa2d884ba38a03
SHA1 747dd8606f4df04a3ec9809570dc43b206e8ab57
SHA256 dfe8db504b46fb690cfff87234390a93680bb51acacd9e3c4f7929346700286f
SHA512 31646223619ba2af69fbf761e64682ed6e431bbbf7142e321a99dd9b0172fc7419cb47485e9490f8cc753bc6104277bacecae6e8e1626d4c1aedb7c64d72faa5

C:\Program Files (x86)\Counter-Strike-1.6\valve\hw\3DfxVoodoo2.cfg

MD5 b1df56c2fa4c6bf5f92393be578ad216
SHA1 d5f78af13490769f5865e2f859bb31d14f5d78c8
SHA256 877ef38f7cb6b18efd7e032dc073901b7fe351a4ed91442b7092e70879155414
SHA512 ed1cefdde7b834b1ec03d120481c86ac6125cfb0428ab409f9a08f119f23ecc1a1bdc17dc62edb45c2e111e03db624fb6842427b5546461305cd069d41ac1675

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 a2112f70a4b2de5166ea3eb298db8610
SHA1 7530f7f5a93f27a17e95467cf87d56f53d1efd81
SHA256 6abdc0c0c5cea39b6672909e80c9e98f4fc83aefb63799cba7cc628f103692ff
SHA512 0406db28c3b7e1cdf45033f4b5b7b2eaeb7c59224300030b0ce8e656146e17b3d4881b0a276d8916333dc8352653639d9ab67d9a006e041a4cd570f7a9687259

C:\Program Files (x86)\Counter-Strike-1.6\valve\models\fungus(small)t.mdl

MD5 5f394d005ec12f63949d0c6a62c1b7b3
SHA1 957d1d0598c7bd0079db345db2006d8e4b755096
SHA256 47b5e88f5cc25627e8dc76b85eb6ad64d8613b00838d0cca6a85f118af81c7b0
SHA512 c51142a1e7902d720154378a7b8e01808fb4683e5a12c77516fa474b4eb05c0d2cc37aaf1b3b0a33757aecdc9ff8008333df66ed0e254b01cb5640b8646e6fb7

C:\Program Files (x86)\Counter-Strike-1.6\valve\models\mil_crategibs.mdl

MD5 3b6e8c73f42cf52a73a36271d2b4ab21
SHA1 2735e47314af1914c6fb7d8dab9ed087365ec759
SHA256 a0c1b32de541fefe134335b61c1e9dd4b2af28b8dde35e70e74d129c0fe1dd79
SHA512 384c254eda0c2a2ce618c3ea85946ed2e7b4677e4162a50a1103de05cf8658ad59d85faaa74d8d4896efaa3fe7a470b81af691d0a00fbbf959706d78708ff887

C:\Program Files (x86)\Counter-Strike-1.6\valve\models\uplant2t.mdl

MD5 ab9f1bf1f7d14ca0032df954e1dd5212
SHA1 d51ab73cb33e1737b86ea0bf6db28aa895bb86ab
SHA256 748e6fb4465843238519d56774643c2d4fb3f77131ba49ee9ca2d700c42acb70
SHA512 c5dcb61363551755beaa4732a21ec870c9b077a44eb0e810029f056a7c89b7be4d6e2d4e48b860a4eedc707d057ba55b2b45c238cf4a99ec167a1c07686710bb

C:\Program Files (x86)\Counter-Strike-1.6\valve\overviews\undertow.tga

MD5 7d338c1ce3e861bb0281d9ce5737bf2e
SHA1 c76495c0ec30bbb7d2d5a66d779f08ed888bd99d
SHA256 8f50a0b4fe2f3cb543d834e43a3057c8ca4cfa59f5145eb8d42ed5338cca166f
SHA512 146abc1ba23a930519e0f6195c80bcf36c5ae6c07abadbaeb69ee20a3abae38f8743a9c8c9832734e55369308f62b0dda3c6443a7a5c748e011000fbdc11231a

C:\Program Files (x86)\Counter-Strike-1.6\valve\resource\BackgroundLayout.txt

MD5 11136b7cff2358ebf01fb0d8783fa793
SHA1 05f5a267828975d2c43f90b73962b971b9672954
SHA256 f1d2461e3936ab6397a852f4efb971ad807bea0c6c99ca8377886ccd88ada750
SHA512 b8dbb295b7d5a9b5f811d4c63f9dfd6dba232269f5b04c259f817ed7c915bfd12d2df0b71efc2442b40db677f3c16a8c12e8135da7b76dc55a607949599caee4

C:\Program Files (x86)\Counter-Strike-1.6\valve\resource\game_menu_mouseover.tga

MD5 603dbf858b8ccfca88e63a0d284fbbad
SHA1 8a9807bfa7d3c19d4870c408e1973239a5d48506
SHA256 251af645272b8f6c2e7f45cd0d9f4c04f86c385893a63c1a38a8aa6c70503a98
SHA512 ce2e434c4b0c11dcb9c83958b3070a48e1f18d3ba99655ea9d1749627b7928d77e2754b1a9ed5b595ca6c84992a2c82bc51af4fba35dd680b7e8da897d307a0d

C:\Program Files (x86)\Counter-Strike-1.6\valve\resource\logo_game.tga

MD5 784470fbf15dd96063d85b801d481e3a
SHA1 7ae39d6510cd2392d0da71d6dc6581ca0c8b1dd2
SHA256 0f5f4eb6936d716b674952b8a25617e6d79111a468404c23f205ce87c5d66f1a
SHA512 7febcabd85368c2f95afffb25110410b88430871ba4b5e88c706cb7bfeec543ac521c43fb2deb70b709f1d9726d42b2c5199757d7cc1e671fd1850ef2ba6f3f0

C:\Program Files (x86)\Counter-Strike-1.6\valve\resource\mic_meter_live.tga

MD5 8705ba060c4bf2cf21728a71a910b45c
SHA1 39365c55d7817a06d8551f16e0aabe84dfa1c9f4
SHA256 38e9b353145a885e23443275aeb5250e2533403ddca7761426c683e343ba4eae
SHA512 68bdf3da2b1d6a7b724842630612f81550673c1b8526ecc3134698eae387dc090cd41f21f1fd11f70208c7b22d8815dd82b5cde4ca30a101fab3f81a1f8a3c90

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 a395e1d74980194357df50546d7d8915
SHA1 68ad952df777c2f7adc2b6cbd371c1d16e4ddae6
SHA256 b63c88231e4db5c35bef794a556bd88976d592a36ff4d2650c23d43303c3eac0
SHA512 02c36626523f4d1d566fc666b3fe1d871c55e128c70f18d7815bf190cc266f5a06a8c4ce2c0ae3c78e13cf03eb15ad3a97aa65302669af8e77b5fc0bd4d6bde3

C:\Program Files (x86)\Counter-Strike-1.6\valve\sound\ambience\mechwine.wav

MD5 5bfb265b6ec9208a611224fabb35ed11
SHA1 4922ab20587c786b13cbec430d9436f53e0e1360
SHA256 1b0b9f054d82c238128b821c41bdeba0e81a436f37c1aec92d2e1dfd7be61c6a
SHA512 b061fd6408d6b89e5be3f8ba7531ecef3bfafd2f2687617f0fa5bada98cbcf1faa95ae9118383b4e48e5d140c317d244cbea938bcc17cd930199f1243ddef3ff

C:\Program Files (x86)\Counter-Strike-1.6\valve\sound\fvox\_comma.wav

MD5 299c3e28a49757ecab2e84ca9b220e62
SHA1 850cbc182e7000b6caa8b6af9986161a2554dbce
SHA256 0ffbcdb3466691fbc1043c69abe50434df646f997c52856a509de43cae501eee
SHA512 2caa0f84686df85905b355107ce2d50c1b8b6debadc50d49327330855e3ed2cea05768c1394cec746ddf90f7087a08ff98eda51272f89d7450923a5e41a13bf8

C:\Program Files (x86)\Counter-Strike-1.6\valve\sound\plats\heavystop2.wav

MD5 3f7ce805c3308fe4b6ded87504b32ed9
SHA1 8b51faf5dcb0d65ca9e27a61438d01282c2231f0
SHA256 465c5a7a363a2427efbab3990dfb82361f2309139c5ba4a135210cb3d714924a
SHA512 6d4e5ac1285f2bb87450087d437e49f834ad1078fe27cede7f7bad46b803dfffcb758579d63532e6bc51de74f0f6c120ebfe2d6eb56273c2f17c65cebc2d9d64

C:\Program Files (x86)\Counter-Strike-1.6\valve\sound\plats\train1.wav

MD5 811989e09124f54cb27fe6154b0f1018
SHA1 90c22fc3b248588e2d9759e6ef395303a86b7b60
SHA256 5271b9aa2961809f47fadecb693be2eebde2dbed62fbc4f5f4889fcd8c4a65f8
SHA512 560d26fdbec34ab687e40b8be6144b0f586449bd3a0eaf286ab972ad60b1eb1fe002649daacad36039a298ad24aae96e3531404ac2d0d7b0b47e194b8169e18b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 79acb624dc5d95cc58816d935498b838
SHA1 f835f6c15f4a9339ad37b393b50ca411f5c507b1
SHA256 15373c6bd8c2f360548e2ea278a3fda3b322b73483440ea80a7008652373158a
SHA512 1d1462caadd4feba4e503aa9e38661d226ca57124e61485b0b80f9a85c3e1f1d1b06e67e5272c865bfb4312808279afb388292eef1caa2a2ffa4213405bc69c2

C:\Program Files (x86)\Counter-Strike-1.6\valve\sound\sentences.txt

MD5 1a5c1dec3290519df29d41caa75926e0
SHA1 008195da6d18f03d7477a22edc4f6596a7b48288
SHA256 f6772a9af4364487053bd2fadf696b27c9d21184b62fb603a2797885b743f3d7
SHA512 7ecb648d724e6d0ef80cbb0e2628ca0f9f31e82bd5c0f2b441b13843c599cefbfb04d611f2511730afa9122dc5dd52ad281248eba385647d1eb63208c1d2e9bd

C:\Program Files (x86)\Counter-Strike-1.6\valve\sound\vox\_period.wav

MD5 076816713017d707a76164e7e473dc45
SHA1 65dafec97b5677bb38641d1c42fb49416a22129f
SHA256 0e8c2b05fe4e00ed75f3ff0bc27f2feb80f242fedaefab18761f4e0d87909767
SHA512 fcbb44367ba7ad3ef9e90643c04375fa8c202441a97c3115bc4959a117c38868d9fba80f480bd5a9d9483c6d480c45b577b858862e7bfff188800bd6cacf0d7e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 4a408fcb8ae09af8f33513e0842b0dd8
SHA1 0a3b630fe1c6484bb8807b5feb28fc2f076cb157
SHA256 d60436b0f8539c6cfd824def24e0cfeafbb93776e658c61bc9c6798c640d8c74
SHA512 8a197f3649757ef527b98756af014f8da3e7a3028d90bedce88721ea8ee987cb6bfb934aed988227e8ccd9e664dfbe6033c79a1b3d803e73b2aa6718d8a2e35d

C:\Program Files (x86)\Counter-Strike-1.6\valve\sprites\logo.spr

MD5 4a972be4bd6a377a7aa87189c3306b49
SHA1 94d2e6e78d5be777b7744e4b3ef1bc5ea7498751
SHA256 a2136f96a42941d2a37a95762b1eff7f2680d73ee92ae8bdf6db46b89f2a5834
SHA512 75c32d4a9144e62aef79c71926b78af966e9263c1f94511a41cb2f397ae608b0770a506b1b1d565a924debd8ba3af6975d8a357efc087d7d04291cfadbc2c68b

C:\Program Files (x86)\Counter-Strike-1.6\valve\sprites\small_logo.spr

MD5 27dc6519e03db41adebe095175cbe6af
SHA1 57ef15841c76fa6e9a14445e0f9fc741dbc54611
SHA256 52ce578669f260926eba402b70f0b15f5bc868aeb3289d30f5bd1c22e2716fec
SHA512 33b788488e11c03cb9867aab24fcf3ceabc49704af33d67f29c5766aa85c74c1b78da4ec00a1f8a164261d696bbeaa97bc99fe46b33ab8b4f84a426fde2cfcbb

C:\Program Files (x86)\Counter-Strike-1.6\valve\sprites\spotlight03.spr

MD5 30c0c19f5c5226225ac3959dfe1f1428
SHA1 5c7be5173586da26dd730a790a151b8a16611106
SHA256 5603d52c5f089950f372e2b00845738746abebaa2796b0b3e2f6d8d2f4111760
SHA512 c71799d84798c2e2a82dbde7ffa5a2c8698eaac615e77d337de7dafc9239c4b59bc2794b2ccd5740d3e19957549257bcd468660d0696f09fdca37485150c233b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 9b0c18880c37066eb1492f1b8f79d534
SHA1 09806673417fe98d9362e1ac412e2e48a8046fe2
SHA256 4405f8ac97f63b3316223798f3332834c76966fc9511f7ca8b15a2b92170ac39
SHA512 881014e6778df5f4ccff50c4c11c1d4217b4d06dc2f5e491ba42280d1a2eb75624ef3ed8591c289154d2d7507cf03bd9434654f07211cbd559f5fe62b26f3ab4

C:\Program Files (x86)\Counter-Strike-1.6\valve\sprites\muzzleflash3.spr

MD5 aeeefbc9a93f875139c647fa0cc5963f
SHA1 1bbf1c85689cc1742fd71cec96f4ae6af3576d82
SHA256 88c15af4711e34e6f456bbe0056ffebeedce84749b593efb3a472af8a637db0c
SHA512 a354d04d946a4e54f3a52c1a5c50090956a939a6cc9ec81f76d7a3d69726c216815e0330e75d8f3d84fdf3f051fd7b9cd9596f730190ee760e7c5a24f5d29daa

C:\Program Files (x86)\Counter-Strike-1.6\valve\sprites\streak.spr

MD5 aecc5ae7744a57ebf4be72800f4afc99
SHA1 ef85d3edc6e67effe4bb05e2f6402fcc06434c50
SHA256 0de493642bbd888f1b7a2df91150cf0958e60f36265e10d994533f3020dc8cec
SHA512 fe9cb6bf4bcc06e4f22396c1e1fd8a8ec6abf71e2bcd93acce2fbd0382beaa78b08d211a1136780052f18b9869240a50344860e8885c2a7d23999da6b3ee396b

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

MD5 423cbd9f4c47197dd8e4e37599bb8660
SHA1 063736dd70d5b1e08fbba2294ae458e5b91741e1
SHA256 1cf90e1d72ddd389ebd6ac82d7b6908c9096fcfe66fde2ab097ac06c85646b34
SHA512 697ee9e106d8533e5f8e290e624d8be32eb8e07a27a63f55438d7402afe3babc017344c446d07cda46aaf4512754914ed93e6ff52a844a5cdae622a694609ab5

memory/13640-148487-0x0000000004C70000-0x0000000005E9A000-memory.dmp

C:\Program Files (x86)\Counter-Strike-1.6\89Uv85GB.dat

MD5 e1cd35bbc28f73b7481e8835ee0f0b13
SHA1 ef40d489c61b178b54f8116548662ee876e0133f
SHA256 6ecef9ef0f62491d595b2f32c69b53c53a1b3a8a7c9dea39d56c6861f5b93bdf
SHA512 baf6f9063f95e6d699088ec4c0611825e030382ff913084feb7f913cc8f011d079b6c7143359391d8e30a5e26ac5a5358882b20e3ac31c5afdbe8867ff6f62a3

memory/13640-148494-0x0000000004C70000-0x0000000005E9A000-memory.dmp

C:\Program Files (x86)\Common Files\Steam\service_default_Public_versions.vdf

MD5 c250ea5d8ec72c091f6b5c9c001006cd
SHA1 13e1985d71b959e90eba3e9e782835adacc4466f
SHA256 cf27d5a4fb550d55a4ffc16e2ca31ffae06772eccfc1cfc7e9343ae523702172
SHA512 358d7782b5c74dc436523257f904f5b792e50fe424c49e9236510654efc929afc7fbe6df5777aa8f8459238252c9e0a90d941e61dfdaf7b3e7e4a94b6c4d8a9c

C:\Program Files (x86)\Common Files\Steam\service_minimum_versions.vdf

MD5 47ea8d10c7c8e5ab9259a6b164a9e2d3
SHA1 cdaedb2b5d5b937930eef504de997592e95f487d
SHA256 a75ecb06d45017d2289ec27dac9f418c6ef82a9352e012670a0c67161c25c52c
SHA512 8b85dffebf9e21e436d48292fb3bce54e01b1470bc1fc7dabbee2233743c7025cd7c59523ffa1d0f1ca50d2b1edf7bb18787aa4df61d7dfec155323ae0eb1ccf

C:\Program Files (x86)\Counter-Strike-1.6\platform\config\MasterServers.vdf

MD5 26210be859fb658d5fb8d34b2d1702aa
SHA1 88807b1ab435a42fab8542a6d1509784fd3a717d
SHA256 ba6755c9b41bf0de609e771dc169354e518361e0af4a0e754e4c6975255a3d0b
SHA512 7e7e2a85897c1b48409a694613c7f47d11dea3421de6c6f3e043804b7b02819aa2da69df45cccba82bbc816de491e2db8a0fe290e1d3091a9fd5f56a0d5efd5a

C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe

MD5 684b53315109fbe9b151d84f25e50120
SHA1 5b2a475823c6917a60148f38e489e7f20cbb8991
SHA256 b39d7a275b1b363e882f355d08155cd01eb34c5f4925f89e79f94f6e68d008b1
SHA512 dd0bc14687f8e9e1b751f3a7dafcebed1a7765eaa6aa98fdf7321cf1b1069cf15ed8361b2712b102a06ac3b32bfa4b9ebcff61a4b71f2258da4d858696352d80

C:\Users\Admin\Videos\Captures\desktop.ini

MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 93f0dee00b5e6c5ff51481e5ce7f876f
SHA1 8275ac3de42ad0a86fd8bd0221c513b6afd54e2d
SHA256 bb2aef252c9cbcf949591149ed5ea2b45533314cb6a3135ac4d2a557c8c50c88
SHA512 fdf9e7261a4d727f2270d612f18c23fd463ced972870840f94fca472fe46266cd7665dccb12421f3c0247d3a4f2ea9023e1fbd8ab5548920ba3189cd2e1f194c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1fbfc0acab0210a7278d4b1ab3b83b62
SHA1 5d93132fd1fd8d936e33913ef32870497a14f7a4
SHA256 1ee7f54f6f4e1fbff735f50b495ec943db7abb9c016c09f6ca6d9df06f65a2eb
SHA512 60315b4bf163fd0243f8c4784b635629f33b0f718b2e524029901e6e54be875b46ddf49e514d931ad21c47820cdf98ef12b3178612db97701616fb979cc169b9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 1f68973a218599ad48c7b85eb6825c11
SHA1 0387aa4c21b06c00f2f7aea2908e8787b087b41e
SHA256 1215712c15b7ebf91666ca372123827769fb41da73e5c894714844bd4fe9f7f5
SHA512 a215e8d7b013e9ae6d4c505f370e8d089dd7cd3466ea1456ad5de8dc133326f0d368fee7a856afcee3c58d1ea65b493e836a50334574c6996e04be0d2b209c43

C:\Program Files (x86)\Counter-Strike-1.6\config\rev_ServerBrowser.vdf

MD5 2b20b47f56f256e6e7bb7d7456db0660
SHA1 d21fa6746b0f9eef61f163d951e387859a87c672
SHA256 9ea05e172d735e2a7268b3ed84e6b8707eaf00891e9a5ad2719488d4b019f746
SHA512 5d16a5760a05583bc67ece45d169c525e2dbb70fb6bba665d74794a54aa0c2deb9031264598d2d5fdee473f525048ab16534f4e4a0e61881a6f1b8575877d4a8

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\resource\GameMenu.res

MD5 49d524256e8b8b4d4c9dde042d091a7f
SHA1 fcf4295df1f0c0f634b56571463a552630303663
SHA256 1980c3eee474ed42c15b1005407a135d83c85ba4641e58d52cd6722995dfd5c9
SHA512 6288550e048c93b28df87b8f53e6ea5217c24c5880cb00ede11cf67a33ed14d2381117323549624dbff024760b3b5b39b093949889e0d7719aa8f13ce5597a1b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 33549299d98c67d41d433206ec2819df
SHA1 08f089bf80e8030e92d360d7de1d5473c6352729
SHA256 702a9211c6729f886dc09046c8dd6a040e0d01ea9761efd8dc68f6ad72ecff7a
SHA512 3e8086283420fe92e8d1468f8a721f777a2f086b06eec2605fbcc36351e765fc11e84d72528cc3edadd72fcbedca4975db7d5436c97787ab4f37c3b0721f68b7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 c4cdea4b3e7f6649d6faf46f10e778d0
SHA1 a5fbe5b6be6c5a9bbc631b0690cafd8c34917ec2
SHA256 907c6aa3cb555fd22abd81f69fca54065f13adc31c01c3450cd66821e7c6b233
SHA512 5cd5aea27a5881d15ebb2eb1e9bbb027e2450472da6e71a28e5182d0562a979c4b372e25de6319630c73106b3a6f24df60605fa012e88fac546ca629065554b6

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\custom.hp2

MD5 60aebeb73a42ff3c24d14de456789799
SHA1 cd2a65a10b47632e794f18316d243c1340dffe85
SHA256 173bc1220f920502ecac489cabaee137a8e5a940e4a8540c862ce77a024d1350
SHA512 0d8429cdb98fcf938b94709aedf7a1d38c9794699f88414b23db387f1e0d84400a7f59fb99cc6c99ea1ea368cca91ceede96209078a90aaa04010dda913be733

C:\Program Files (x86)\Counter-Strike-1.6\cstrike\motd_temp.html

MD5 b4693d86fcfcf3fd021e723541173351
SHA1 af4da731ad97434a8a83e4e595e929ef27feca58
SHA256 530ce8a6d759e40da5651644ea98f0ded4d5c458597be58a29709197dd0518b5
SHA512 5a4b4bf9df6fcc0d3ad9e1e83349d4d7304ab45f7127eec35a40c0dd07ef469f93fb03fd0a7ef74e7eb06edd8bd2a1b7556ed056bd740fea86e533b34ed50120