Resubmissions

14-11-2024 19:12

241114-xwnq5asbqr 8

14-11-2024 17:14

241114-vryz7avmhm 7

14-11-2024 15:28

241114-swc76s1dnk 7

Analysis

  • max time kernel
    1799s
  • max time network
    1778s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    14-11-2024 19:12

General

  • Target

    download.jpg

  • Size

    4KB

  • MD5

    923483ef136405ae231fd91ae76fdfca

  • SHA1

    3be3a83a5c330463b407585f7cfd2c4860f1594f

  • SHA256

    bd86b89c66706bcdab4a02763a8dab5cb02dadd671377d5619689c6c9047d586

  • SHA512

    b3c2c74d61b45d7677a04a127b0500e4b7cc9dfaadb0ad0a85a905f0dca2c8375bbba07d80acd5a795b572383c61dde16683e1e448a8c3b45cdfce622bb71a7d

  • SSDEEP

    96:YgUi3uZKoBRrq5YNVDfDUXd9LdTkpKp4k/VR+gdTwghH7IVfAReACf:18KqeyNFg3Ld5lTxHu5N

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Detected potential entity reuse from brand STEAM.
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 41 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\download.jpg
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:60
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\download.jpg"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4884
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
    1⤵
      PID:880
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UndoSave.mht
      1⤵
      • Enumerates system info in registry
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4904
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xe0,0x130,0x7ffdd9af46f8,0x7ffdd9af4708,0x7ffdd9af4718
        2⤵
          PID:1988
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
          2⤵
            PID:1932
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3192
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
            2⤵
              PID:1364
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
              2⤵
                PID:1172
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                2⤵
                  PID:656
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
                  2⤵
                    PID:1792
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                    2⤵
                      PID:3336
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff690885460,0x7ff690885470,0x7ff690885480
                        3⤵
                          PID:3400
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:904
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
                        2⤵
                          PID:5392
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                          2⤵
                            PID:5668
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                            2⤵
                              PID:5980
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                              2⤵
                                PID:6084
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
                                2⤵
                                  PID:6104
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
                                  2⤵
                                    PID:5316
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
                                    2⤵
                                      PID:5308
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
                                      2⤵
                                        PID:440
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
                                        2⤵
                                          PID:1844
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
                                          2⤵
                                            PID:5428
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
                                            2⤵
                                              PID:6000
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6320 /prefetch:8
                                              2⤵
                                                PID:5740
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6968 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:6024
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7036 /prefetch:8
                                                2⤵
                                                  PID:1576
                                                • C:\Users\Admin\Downloads\SteamSetup.exe
                                                  "C:\Users\Admin\Downloads\SteamSetup.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Adds Run key to start application
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5692
                                                  • C:\Program Files (x86)\Steam\bin\steamservice.exe
                                                    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:6020
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4396601518513033106,1354906123777748487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6988 /prefetch:2
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:9944
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:2328
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:892
                                                  • C:\Program Files (x86)\Steam\steam.exe
                                                    "C:\Program Files (x86)\Steam\steam.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    PID:1372
                                                    • C:\Program Files (x86)\Steam\steam.exe
                                                      "C:\Program Files (x86)\Steam\steam.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • Checks processor information in registry
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:9924
                                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=9924" "-buildid=1731433018" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
                                                        3⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Drops file in Windows directory
                                                        • Checks processor information in registry
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:10040
                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1731433018 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffde53faf00,0x7ffde53faf0c,0x7ffde53faf18
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:10076
                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1584,i,10374094558209940136,18144170292542789302,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1588 --mojo-platform-channel-handle=1572 /prefetch:2
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:10228
                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=2176,i,10374094558209940136,18144170292542789302,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2180 --mojo-platform-channel-handle=2172 /prefetch:3
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:7536
                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=2752,i,10374094558209940136,18144170292542789302,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2756 --mojo-platform-channel-handle=2748 /prefetch:8
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:10748
                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,10374094558209940136,18144170292542789302,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3132 --mojo-platform-channel-handle=3124 /prefetch:1
                                                          4⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:10980
                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=3836,i,10374094558209940136,18144170292542789302,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3828 --mojo-platform-channel-handle=3860 /prefetch:8
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:5860
                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3844,i,10374094558209940136,18144170292542789302,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3808 --mojo-platform-channel-handle=3848 /prefetch:8
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:6360
                                                      • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                                        .\bin\gldriverquery64.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:7896
                                                      • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                                        .\bin\gldriverquery.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5668
                                                      • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                                        .\bin\vulkandriverquery64.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        PID:8964
                                                      • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                                        .\bin\vulkandriverquery.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:6100
                                                      • C:\Program Files (x86)\Steam\steamerrorreporter.exe
                                                        C:\Program Files (x86)\Steam\steam
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • System Location Discovery: System Language Discovery
                                                        PID:10952
                                                  • C:\Windows\system32\AUDIODG.EXE
                                                    C:\Windows\system32\AUDIODG.EXE 0x4b8 0x298
                                                    1⤵
                                                      PID:11028

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Program Files (x86)\Steam\Steam.exe

                                                      Filesize

                                                      4.2MB

                                                      MD5

                                                      33bcb1c8975a4063a134a72803e0ca16

                                                      SHA1

                                                      ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

                                                      SHA256

                                                      12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

                                                      SHA512

                                                      13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

                                                    • C:\Program Files (x86)\Steam\bin\SteamService.exe

                                                      Filesize

                                                      2.5MB

                                                      MD5

                                                      ba0ea9249da4ab8f62432617489ae5a6

                                                      SHA1

                                                      d8873c5dcb6e128c39cf0c423b502821343659a7

                                                      SHA256

                                                      ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

                                                      SHA512

                                                      52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      6e6a2b18264504cc084caa3ad0bfc6ae

                                                      SHA1

                                                      b177d719bd3c1bc547d5c97937a584b8b7d57196

                                                      SHA256

                                                      f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

                                                      SHA512

                                                      74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      1b1b4834d9890509a4d2deb3ff1003a6

                                                      SHA1

                                                      8324c1a8cbbe47a55dbd251c325a9211f066dd98

                                                      SHA256

                                                      8baa6b9ada865e6368c6f1bc707b6d2d737bdcbc5b32b116e4aa095359e53c9e

                                                      SHA512

                                                      532b0905dd4b326d35a4286f0d27f2f5a86ee2b6413756062e59e07df1741ca72ff72b6cb18e6d0753a2f6154277be1d497042ab79781ffbf86e6397b4eaa3ab

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      ebc64d7a667462e806a20985034885cf

                                                      SHA1

                                                      2efac643510f5e89c618eaadf067955851b609fd

                                                      SHA256

                                                      5770ab44dda60306753567c85ede768ed4df2755ae5d4205f146bd0624487a87

                                                      SHA512

                                                      47171535e94a7b4248c317b3800aee2fee150384d8c6e40b1cd6ce6d490abf2253527f5ba769e40f8262f79a8345f981763204c8d3d269fb1cdf3aaf5eb1d74e

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      0d91197a8999891541d4f55a71a6daee

                                                      SHA1

                                                      ccf13ef1e9681ff3aef8ade0361163b60537b50f

                                                      SHA256

                                                      ef7d5f001b1501f8edc5d66673e75c0f74c83b8b7d2ca6ad2e72d0bbd8f5a6ba

                                                      SHA512

                                                      7da8e0279e7a2f2770b7fcddec83db0c26a5a8e27250d95568cdac3d3ea7c7d9d3e32fe823f42ba0c0bf8f9aae951217aad7a75749623645f0c004d57294034f

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      22KB

                                                      MD5

                                                      bc2627448777686cc17744927e2c90bc

                                                      SHA1

                                                      3b5222e58b0806fa2c5349cb0a779c7d2351c176

                                                      SHA256

                                                      d8b67aea5135f90d40565004a5036f2ef92b296ba98c2e3501d497d66ab012c4

                                                      SHA512

                                                      c45110c8119ffbdd20c449d96c2abb1a2ad686d6efecfa5afbce863388e51a2de881f2a1b39b44476949b15cd3e004798c340696e8ad3321e54e46f4a29b20d7

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      19KB

                                                      MD5

                                                      76fec91ea9d12ff288b5f279f9097604

                                                      SHA1

                                                      2601c85d4dce7cb921cb5ad960851f67e0bb6d57

                                                      SHA256

                                                      bc07eb3622ecceac174432f6af4890b96ca57f150e558dcd99c7d66a87f0eee1

                                                      SHA512

                                                      70cf8c2dc1a4e85d1ffa1079a828e9557995e6d274e0360b36bf909d8f5c16fa36d7fc019e29d472e5467d43db5c260ca5586cbcadc1713301fd8d7549d88db4

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      27KB

                                                      MD5

                                                      fe43a4baf7b79b0219e511c0e8ce4567

                                                      SHA1

                                                      8192ae8c83607178a1877820c611d0d654881730

                                                      SHA256

                                                      f350c7ff925c6da66912124389312540165d785a0fb87b4b2d0cdbe5ad87fd1d

                                                      SHA512

                                                      abad40218ff3f43ef1294facf11076d2db7d7640c74cee834510d43c8910406fe6d198af26dce62a36069df66ca958429b9c72b24f204878a6599a29a5d51d17

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      3e8ba41ab1e8fb4370ea427ba4f7d41a

                                                      SHA1

                                                      20fdfab0f625df42ac86f6a1707f93de71ebc2ae

                                                      SHA256

                                                      b8a2fb331a9a0ac97a03dd27d9a21c6cb7d8642977eda7291ffe8a08738916e1

                                                      SHA512

                                                      832cde1c63f02e8ebc1c4bcac3ad7ea429a68b714d8b550f58e504e1242cfaf1d18d3bde5552f8af3c92f00b3c6a927d5578a766e0ad48d32aee2f152c16cede

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      4a87618dbcc4b2ea4d60641c2ae8e90f

                                                      SHA1

                                                      e91e703c57c983efa4ff59799f72a9ec0b25b497

                                                      SHA256

                                                      07daaf06aa8194865c361b02dfd3d4fe76f6a7a41aa4c1cf901260a10a8cf6e9

                                                      SHA512

                                                      cb0c91b5eafff8ae1528186ced1b5d6cb7eb6151d8efe854817e86d73ea6248d1de04e0ca7e89da85b011e55aca7eee7feaf0469d502faa15959c03ea73c2fa7

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      25KB

                                                      MD5

                                                      a32c8286e9ee3d5fd8a4fa3372e96c5b

                                                      SHA1

                                                      0885f652ba940e78f2e06cd9cc69cd6a4500267f

                                                      SHA256

                                                      c785caa1204da639fb8d2a88f55dd00b69ab1179ddea33bbdeaf0b7c893d3608

                                                      SHA512

                                                      27d11b2caa0ca020424f6b1803f4b3ed1b68327af10ae993f1efd975b7ea328b3f00b287e4b3f3f3bff4dd9f4ecf7a39bb11cf20672851b5afb856778b46ac7a

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      19KB

                                                      MD5

                                                      b3573c4eacc8f8a8d4091d5ab8aceb48

                                                      SHA1

                                                      df9ad60dff57523274826f53acad187ccd68ea53

                                                      SHA256

                                                      666b83e5baa5e03ac16724b4b686938ea069006d6df8333e0d79d22f7adc0104

                                                      SHA512

                                                      57de990738eae75fbfbe39e3c638605e341597f6d466073d4866e606c5af83afdccea337b6a69e3981e6708950c8928e16dc2da5dcd23f97f949d695aa44dbd2

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      3e742ff9467bec3da30b81b921d0ece2

                                                      SHA1

                                                      f178114b8458e05a58c9e79db16d172f0eb2d820

                                                      SHA256

                                                      e8f5134e1e6453640342ded60730baae9111cf386bc42e7d9eb30883c6b87c6d

                                                      SHA512

                                                      302cb93f9430c19101d1444a0bf7f883301d2866d39d174a4f32925d702ce63b9513ff449ae4e23596d50f396d4537755fe0286c9d3423411e7d50a998ac6649

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      d0116ada45472a83d2bf37093558f8f5

                                                      SHA1

                                                      2701a7a6898d08caa2cd7edbcd52af3eceff7d94

                                                      SHA256

                                                      2c56bbed82c1465046fd88297a308851421f2de211ce9c12502b35a1fbbe0b18

                                                      SHA512

                                                      6eedf4770da9862175a814eada7e0a7513da11b9fa3700d3227175619a4ef45b67493edaff563a037280a0dc39e87e710b767098439eed8ddd0257663d000763

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      28KB

                                                      MD5

                                                      2d452f1c590220769f047f68e6693ea3

                                                      SHA1

                                                      0a88a9392054bf49f570a7bc56a282d102d28c7a

                                                      SHA256

                                                      f59a370425a80c1e05b7048b78b920d29a2276074121ff5741a8b81cf44aec7c

                                                      SHA512

                                                      21cb3033f2599a33e1d2e07cbb0339b5626822ac90b002f6b7ff4d848f06120e39a8e2f103492e9daed0ef5326225475efaa8101622580bdfd5bcae969126acd

                                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      a2ec2e91c3ef8c42e22c4887d032b333

                                                      SHA1

                                                      e2c738a2e9400535b74e2263c7e7d1ecefe575f2

                                                      SHA256

                                                      8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

                                                      SHA512

                                                      b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

                                                    • C:\Program Files (x86)\Steam\config\config.vdf~RFe597bae.TMP

                                                      Filesize

                                                      184B

                                                      MD5

                                                      3cdebc58a05cdd75f14e64fb0d971370

                                                      SHA1

                                                      edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe

                                                      SHA256

                                                      661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7

                                                      SHA512

                                                      289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

                                                    • C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      577b7286c7b05cecde9bea0a0d39740e

                                                      SHA1

                                                      144d97afe83738177a2dbe43994f14ec11e44b53

                                                      SHA256

                                                      983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

                                                      SHA512

                                                      8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

                                                    • C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      00bf35778a90f9dfa68ce0d1a032d9b5

                                                      SHA1

                                                      de6a3d102de9a186e1585be14b49390dcb9605d6

                                                      SHA256

                                                      cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

                                                      SHA512

                                                      342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

                                                    • C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

                                                      Filesize

                                                      23B

                                                      MD5

                                                      836dd6b25a8902af48cd52738b675e4b

                                                      SHA1

                                                      449347c06a872bedf311046bca8d316bfba3830b

                                                      SHA256

                                                      6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

                                                      SHA512

                                                      6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      0340d1a0bbdb8f3017d2326f4e351e0a

                                                      SHA1

                                                      90d078e9f732794db5b0ffeb781a1f2ed2966139

                                                      SHA256

                                                      0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

                                                      SHA512

                                                      9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      4c81277a127e3d65fb5065f518ffe9c2

                                                      SHA1

                                                      253264b9b56e5bac0714d5be6cade09ae74c2a3a

                                                      SHA256

                                                      76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

                                                      SHA512

                                                      be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      2158881817b9163bf0fd4724d549aed4

                                                      SHA1

                                                      c500f2e8f47a11129114ee4f19524aee8fecc502

                                                      SHA256

                                                      650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

                                                      SHA512

                                                      f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      03b664bd98485425c21cdf83bc358703

                                                      SHA1

                                                      0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

                                                      SHA256

                                                      fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

                                                      SHA512

                                                      4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      31a29061e51e245f74bb26d103c666ad

                                                      SHA1

                                                      271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

                                                      SHA256

                                                      56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

                                                      SHA512

                                                      f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      da6cd2483ad8a21e8356e63d036df55b

                                                      SHA1

                                                      0e808a400facec559e6fbab960a7bdfaab4c6b04

                                                      SHA256

                                                      ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

                                                      SHA512

                                                      06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      9e62fc923c65bfc3f40aaf6ec4fd1010

                                                      SHA1

                                                      8f76faff18bd64696683c2a7a04d16aac1ef7e61

                                                      SHA256

                                                      8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

                                                      SHA512

                                                      c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      10c429eb58b4274af6b6ef08f376d46c

                                                      SHA1

                                                      af1e049ddb9f875c609b0f9a38651fc1867b50d3

                                                      SHA256

                                                      a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

                                                      SHA512

                                                      d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      5c026fd6072a7c5cf31c75818cddedec

                                                      SHA1

                                                      341aa1df1d034e6f0a7dff88d37c9f11a716cae6

                                                      SHA256

                                                      0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

                                                      SHA512

                                                      f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      189ba063d1481528cbd6e0c4afc3abaa

                                                      SHA1

                                                      40bdd169fcc59928c69eea74fd7e057096b33092

                                                      SHA256

                                                      c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

                                                      SHA512

                                                      ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      18aaaf5ffcdd21b1b34291e812d83063

                                                      SHA1

                                                      aa9c7ae8d51e947582db493f0fd1d9941880429f

                                                      SHA256

                                                      1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

                                                      SHA512

                                                      4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      1514d082b672b372cdfb8dd85c3437f1

                                                      SHA1

                                                      336a01192edb76ae6501d6974b3b6f0c05ea223a

                                                      SHA256

                                                      3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

                                                      SHA512

                                                      4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      8958371646901eac40807eeb2f346382

                                                      SHA1

                                                      55fb07b48a3e354f7556d7edb75144635a850903

                                                      SHA256

                                                      b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

                                                      SHA512

                                                      14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      7e1d15fc9ba66a868c5c6cb1c2822f83

                                                      SHA1

                                                      bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

                                                      SHA256

                                                      fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

                                                      SHA512

                                                      0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      202b825d0ef72096b82db255c4e747fa

                                                      SHA1

                                                      3a3265e5bbaa1d1b774195a3858f29cea75c9e75

                                                      SHA256

                                                      3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

                                                      SHA512

                                                      e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      7913f3f33839e3af9e10455df69866c2

                                                      SHA1

                                                      15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

                                                      SHA256

                                                      05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

                                                      SHA512

                                                      534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      58e0fcbee3cca4ef61b97928cfe89535

                                                      SHA1

                                                      1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

                                                      SHA256

                                                      c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

                                                      SHA512

                                                      99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      9b0b0e82f753cc115d87c7199885ad1b

                                                      SHA1

                                                      5743a4ab58684c1f154f84895d87f000b4e98021

                                                      SHA256

                                                      0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

                                                      SHA512

                                                      b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      eb8926608c5933f05a3f0090e551b15d

                                                      SHA1

                                                      a1012904d440c0e74dad336eac8793ac110f78f8

                                                      SHA256

                                                      2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

                                                      SHA512

                                                      9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      6367f43ea3780c4ee166454f5936b1a8

                                                      SHA1

                                                      027a2c24c8320458c49cd78053f586cb4d94ee6f

                                                      SHA256

                                                      f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

                                                      SHA512

                                                      31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      e04ad6c236b6c61fc53e2cb57ced87e8

                                                      SHA1

                                                      e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

                                                      SHA256

                                                      08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

                                                      SHA512

                                                      0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      56dcf7b68f70826262a6ffaffe6b1c49

                                                      SHA1

                                                      12e4272ba0e4eabc610670cdc6941f942da1eb6a

                                                      SHA256

                                                      948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

                                                      SHA512

                                                      c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      66456d2b1085446a9f2dbd9e4632754b

                                                      SHA1

                                                      8da6248b57e5c2970d853b8d21373772a34b1c28

                                                      SHA256

                                                      c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

                                                      SHA512

                                                      196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      b2248784049e1af0c690be2af13a4ef3

                                                      SHA1

                                                      aec7461fa46b7f6d00ff308aa9d19c39b934c595

                                                      SHA256

                                                      4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

                                                      SHA512

                                                      f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      194a73f900a3283da4caa6c09fefcb08

                                                      SHA1

                                                      a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

                                                      SHA256

                                                      5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

                                                      SHA512

                                                      25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

                                                      Filesize

                                                      7KB

                                                      MD5

                                                      53f7e8ac1affb04bf132c2ca818eb01e

                                                      SHA1

                                                      bffc3e111761e4dc514c6398a07ffce8555697f6

                                                      SHA256

                                                      488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

                                                      SHA512

                                                      c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      29f9a5ab4adfae371bf980b82de2cb57

                                                      SHA1

                                                      6f7ef52a09b99868dd7230f513630ffe473eddf8

                                                      SHA256

                                                      711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

                                                      SHA512

                                                      543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      cadd7a2f359b22580bdd6281ea23744d

                                                      SHA1

                                                      e82e790a7561d0908aee8e3b1af97823e147f88b

                                                      SHA256

                                                      3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

                                                      SHA512

                                                      53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

                                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      f350c8747d77777f456037184af9212c

                                                      SHA1

                                                      753d8c260b852a299df76c4f215b0d2215f6a723

                                                      SHA256

                                                      15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185

                                                      SHA512

                                                      efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

                                                    • C:\Program Files (x86)\Steam\steam.exe

                                                      Filesize

                                                      4.2MB

                                                      MD5

                                                      d3484bb0997b56404bdc05122c8193fa

                                                      SHA1

                                                      fa96d4613a4865830e608093eb83b8eb8be8482a

                                                      SHA256

                                                      f5c97342e82c944e810094bc1097201f1bd41c64ba615aa3d68f7a9543a6d2a0

                                                      SHA512

                                                      157deb211acf9a0c2db0d392f2442889aec05aa90de3e08ebae6b784e12bbe4d4a20d187b085656410024f66609e2bac7449f6605c02249e57ce8d9ad8f165ab

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      b9fc751d5fa08ca574eba851a781b900

                                                      SHA1

                                                      963c71087bd9360fa4aa1f12e84128cd26597af4

                                                      SHA256

                                                      360b095e7721603c82e03afa392eb3c3df58e91a831195fc9683e528c2363bbb

                                                      SHA512

                                                      ecb8d509380f5e7fe96f14966a4d83305cd9a2292bf42dec349269f51176a293bda3273dfe5fba5a32a6209f411e28a7c2ab0d36454b75e155fc053974980757

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                      Filesize

                                                      152B

                                                      MD5

                                                      d9a93ee5221bd6f61ae818935430ccac

                                                      SHA1

                                                      f35db7fca9a0204cefc2aef07558802de13f9424

                                                      SHA256

                                                      a756ec37aec7cd908ea1338159800fd302481acfddad3b1701c399a765b7c968

                                                      SHA512

                                                      b47250fdd1dd86ad16843c3df5bed88146c29279143e20f51af51f5a8d9481ae655db675ca31801e98ab1b82b01cb87ae3c83b6e68af3f7835d3cfa83100ad44

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      48B

                                                      MD5

                                                      bb75bfb5bf97b8006e55734e71a840c4

                                                      SHA1

                                                      95d65d3258cbf593a4e7338414c80133f897e569

                                                      SHA256

                                                      dbca1d99980f2f2036d65ee303626f0359f874c7ab343e073bb905f614a6acae

                                                      SHA512

                                                      67a50a17e8879ccdf6beb0116579a5f31fd6e0552645a655bd28733ba33d766fc2d624b1675127508692beed24ea65a15f276374caa16d36e7c02626061f3f9c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      29351a581351ad997921f9a692fbbb62

                                                      SHA1

                                                      fad3dd32b34686c7769872605c74082c6a319d79

                                                      SHA256

                                                      33ba34694a41901fa2017f10d13e985e97844b09d00aaa7714edc67dac0b7aa2

                                                      SHA512

                                                      2948789ac5034ef0d35bd8f2d807d88d7917c5ae317e1ba959cf1608cd06a7690ea84a061ea59e0a5f7a6ed00a4a720f9730ae22c50a4e84bc4661cdc03c0b17

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                      Filesize

                                                      70KB

                                                      MD5

                                                      e5e3377341056643b0494b6842c0b544

                                                      SHA1

                                                      d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                      SHA256

                                                      e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                      SHA512

                                                      83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                      Filesize

                                                      738B

                                                      MD5

                                                      0359e524fdd030519045aca22e51709e

                                                      SHA1

                                                      49cb704fa47e330198a79fe6eec1de0cdeb5dbbb

                                                      SHA256

                                                      92dccd3d2bcc94fb9be9b5be69537ea0fc28692f6cfb4aa1062ffd0106603469

                                                      SHA512

                                                      bbfc489fd2bfbb0781eb7274372696cbbc4be3e1520ca8371afc20ecb8f3cac68a4274b6030683b52ebbcc7456aa9b8b9ba5484a988845b92a5e684d99500e58

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58bd6f.TMP

                                                      Filesize

                                                      59B

                                                      MD5

                                                      2800881c775077e1c4b6e06bf4676de4

                                                      SHA1

                                                      2873631068c8b3b9495638c865915be822442c8b

                                                      SHA256

                                                      226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                      SHA512

                                                      e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      4KB

                                                      MD5

                                                      7cd3ea5aa71444db3ffc4e41b97dafac

                                                      SHA1

                                                      67f2355e14e4f8cb41c28d4fb22224542f39b471

                                                      SHA256

                                                      17139a84a69891cb9498d0f1b209bb13960192a417b512eabc055ed0fb046e47

                                                      SHA512

                                                      780d123b95b8b916599caa8ccfbac58422676b75626dc47e5d29d0ccc44a56397436e05aaea223237fd0d6e01bbae0daf4452749a0b398682c46d50c5fd7e6c9

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      72298bce5e10a2dec07122f8326db042

                                                      SHA1

                                                      162725e938478e6ef3ad10a18c432cca86e5e4fc

                                                      SHA256

                                                      681f0a743ebc9db81e4bbb1ab8c01f8130775d229912ab83e271b16513090a8d

                                                      SHA512

                                                      476b5c9a1f7da9948914be995eb9484862b8bf99cf89ab79a5a561eff0a27a34c2b271812f58e1343abb3932719221c7fcb3976838e4741740b890702b09a3dd

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      de9322f0ecbb5131b66a42628eb3239b

                                                      SHA1

                                                      703f36823bec61ad98f8e21bbd5d0324252ea8b2

                                                      SHA256

                                                      8f9c5d488a8c054ab45fd144465aa3eab0674caf9b38f27eaa595992efb4b346

                                                      SHA512

                                                      600a74f71bbe67a6bfd5ea6282e43420c5af5cedb3c65af1f042df379807449e511eab30becc5af8ee100ea6cb4304353eeee2f88541efaf76c08e7c9313dc94

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      48a3193089f4ba422efc3780b4508526

                                                      SHA1

                                                      f865fdcd43ca317a38079f7dc3121300c7f877a7

                                                      SHA256

                                                      0ed52f87999cc89f685c74ef32081877a4d6cdefb335f97beec8419f43bd6d2c

                                                      SHA512

                                                      54946b6b4e7b2dc5ad14db0d1185406293def7d2ef6964372893c69a4dd3e24e2718d91394e8270775c0351b37233bb2a8e7feb177970728d252be6333266da5

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      8d884700207b94d65aeaa2d098b07321

                                                      SHA1

                                                      f36af33ad43626fbb6dda3fb423f39d94fc7295d

                                                      SHA256

                                                      825ac5fcadc163e4d517567d4dccdbe57159fc5f4f20f1e73b8d912ab8fcb8d4

                                                      SHA512

                                                      08d3ff9a9c70c961d5d71f344cc7113e3abfa1fd3616bc0e42920a102565860568ef486e07737b5376cb483c0fca39d1b237c05a7cd8e8cf3cfe050aafd7847c

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      f9055ea0f42cb1609ff65d5be99750dc

                                                      SHA1

                                                      6f3a884d348e9f58271ddb0cdf4ee0e29becadd4

                                                      SHA256

                                                      1cacba6574ba8cc5278c387d6465ff72ef63df4c29cfbec5c76fbaf285d92348

                                                      SHA512

                                                      b1937bc9598d584a02c5c7ac42b96ed6121f16fe2de2623b74bb9b2ca3559fc7aff11464f83a9e9e3002a1c74d4bb0ee8136b0746a5773f8f12f857a7b2b3cb4

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                      Filesize

                                                      24KB

                                                      MD5

                                                      d3412a01d4c3df1df43f94ecd14a889a

                                                      SHA1

                                                      2900a987c87791c4b64d80e9ce8c8bd26b679c2f

                                                      SHA256

                                                      dd1511db0f7bf3dc835c2588c1fdd1976b6977ad7babe06380c21c63540919be

                                                      SHA512

                                                      7d216a9db336322310d7a6191ebac7d80fd4fa084413d0474f42b6eff3feb1baf3e1fb24172ea8abcb67d577f4e3aea2bc68fdb112205fc7592a311a18952f7e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      206702161f94c5cd39fadd03f4014d98

                                                      SHA1

                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                      SHA256

                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                      SHA512

                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                      Filesize

                                                      41B

                                                      MD5

                                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                                      SHA1

                                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                                      SHA256

                                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                      SHA512

                                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

                                                      Filesize

                                                      16B

                                                      MD5

                                                      46295cac801e5d4857d09837238a6394

                                                      SHA1

                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                      SHA256

                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                      SHA512

                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      b89bfd0117b1280b7b455b764ee69a4d

                                                      SHA1

                                                      2fd069e644d24b3aa590ad744701cb7bddaf3207

                                                      SHA256

                                                      0adf10f3c8837e7332a3cabd7b7cc6158441a736bb2b3e8971cc4c92f3502fc3

                                                      SHA512

                                                      6f745fb5f87f4ac9ec02990a921e88c4b17a4e96a3b4ab6db559a1bf8eacf78de1f5de41a9bbf2d0b8c38b099c69f0438911f5a3373318c43e9bcb85d06a43c6

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      6693355ca5d38b23ca0b823288ac7461

                                                      SHA1

                                                      9fa3692f40d396f6154b18529ba519e66c7135ca

                                                      SHA256

                                                      4ee266b5af0da1e6e96134e2cff352fcf2a697ed029d54ef36bdf692c435b58b

                                                      SHA512

                                                      621c771f1816437b6d28da752fb6eaae81c62810b07d1cf694e5ddb80dd7baa4bf90da76d977aae5accb0c287ff034a100bca61e1f6a5044e42b6ddf9a6f0bb7

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                      Filesize

                                                      10KB

                                                      MD5

                                                      953007b77699a1d0ae2603bd7e3aa0eb

                                                      SHA1

                                                      db7a2ec293d52d053f4f1961d67ff7bc02c3fff9

                                                      SHA256

                                                      1e67692c60c491b809895ab6218424e83228f45f4882ea097f841f3e39cc6611

                                                      SHA512

                                                      a101e484959e44ef117b2a11662851158169fc48f6173f47ca0bace75de9cdc50b50b8279b422d073fb0a21c6401a66b91606db6c8313d70c1cc6543791fed22

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

                                                      Filesize

                                                      216B

                                                      MD5

                                                      7d7501c9fbc9057b21db55ab5b9a501a

                                                      SHA1

                                                      1f9ecea9936f90b23629323ca68ad0995623607e

                                                      SHA256

                                                      551d5c9a7baa2bc54aa791086f2e7819ff6422f4bc7f6a33a842bdc04a5e1f4b

                                                      SHA512

                                                      10c7866b68efbcfae8abb060925cf74c208ff09a6455c43eb610344c4e2ec661447e9a76634265b4a1e8fc831af46ca18e971cbe6e73fac8e1f924496d93feb2

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe59cfaa.TMP

                                                      Filesize

                                                      48B

                                                      MD5

                                                      d5ea8a7bc18d892bb2fd621c412171db

                                                      SHA1

                                                      db0960ba3814c8744e41636138e4f6398c5ab09b

                                                      SHA256

                                                      a33a26e2b9ef55cd270d0abb7b2679d258ebb1739e134305e56a8ea86d666f05

                                                      SHA512

                                                      7b7435f06982ec821524951d049f91c0120f83b05985bff0d309d23bafa9a3c68a5418d33be8a6a1b4af0f2444afc6627a44693d7792c3ccf154aa400358815b

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\GPUCache\data_1

                                                      Filesize

                                                      264KB

                                                      MD5

                                                      d0d388f3865d0523e451d6ba0be34cc4

                                                      SHA1

                                                      8571c6a52aacc2747c048e3419e5657b74612995

                                                      SHA256

                                                      902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                                      SHA512

                                                      376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\GraphiteDawnCache\data_0

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      cf89d16bb9107c631daabf0c0ee58efb

                                                      SHA1

                                                      3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                      SHA256

                                                      d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                      SHA512

                                                      8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\GraphiteDawnCache\data_2

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      0962291d6d367570bee5454721c17e11

                                                      SHA1

                                                      59d10a893ef321a706a9255176761366115bedcb

                                                      SHA256

                                                      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                      SHA512

                                                      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\GraphiteDawnCache\data_3

                                                      Filesize

                                                      8KB

                                                      MD5

                                                      41876349cb12d6db992f1309f22df3f0

                                                      SHA1

                                                      5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                      SHA256

                                                      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                      SHA512

                                                      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

                                                      Filesize

                                                      744B

                                                      MD5

                                                      fca46c21114c354ae202da91e7aa43b5

                                                      SHA1

                                                      60938245698ce8ae39956568020f4adbf5683bd3

                                                      SHA256

                                                      d400110590f47e78d039d7082e780f8151b15a884ce58795a7e7469953364373

                                                      SHA512

                                                      fc66c3e3c831ea6cbf8de1fef27d9cb48495c8d1ec3c4a821aa648e258dc113e824e29d9aa0e590496c5811b2996aa514b42f971ad9a2c4a3e43d89def630e3d

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

                                                      Filesize

                                                      856B

                                                      MD5

                                                      32f2d4e04c6d9b3225d1bc1d7da63c23

                                                      SHA1

                                                      3c1f1630e54304c2a62d4cc7fab5092b308064b5

                                                      SHA256

                                                      901f65dbe398101e80c016443056949ddc86b65573a2c5746dfb1e701ad074dd

                                                      SHA512

                                                      8cbee38323500c817f963efd100df8e60d5830ef88e088ead1ba8c84d761db416df5a7a17211506b8e5c2393237a7418905baa5a35b44ff9ccfe3bc7b323f4b7

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe5a8a01.TMP

                                                      Filesize

                                                      529B

                                                      MD5

                                                      57f5dd71c32dd2e46bf23a53aa879c58

                                                      SHA1

                                                      04b76578c506392e43badec26445ef81a1d1c4eb

                                                      SHA256

                                                      174bc158a907c9f17bc40cff5bac4f924d3cc5d55b6dab1186e04b83b63d94d4

                                                      SHA512

                                                      d917d65d53dbd62664a3030d82382fe174961d5a462e2bf1f96f6e58db8a44d4ab108790ebaca04f1ad6eee8d8f3c9712ba68e8e250e924845bb546c17c56e93

                                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

                                                      Filesize

                                                      300B

                                                      MD5

                                                      a06e6467f55b1f6bc47e80ecdd9b25e0

                                                      SHA1

                                                      32437223293f9addd606580ddf4bbe70918e08e2

                                                      SHA256

                                                      a02813d04157124b30832483526c16e4220357fd4f3e93bb89a323892ba9cb3f

                                                      SHA512

                                                      8fb06a629afdd6c087358d6e968a16caf502c2ee7ba21aea1fc27e86cce1b19e485fb31ce31bd620b7d935a29bd38aab362c2c3694fd672754ef99ace3e5f031

                                                    • C:\Users\Admin\AppData\Local\Temp\nssF31C.tmp\StdUtils.dll

                                                      Filesize

                                                      110KB

                                                      MD5

                                                      db11ab4828b429a987e7682e495c1810

                                                      SHA1

                                                      29c2c2069c4975c90789dc6d3677b4b650196561

                                                      SHA256

                                                      c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

                                                      SHA512

                                                      460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

                                                    • C:\Users\Admin\AppData\Local\Temp\nssF31C.tmp\System.dll

                                                      Filesize

                                                      22KB

                                                      MD5

                                                      a36fbe922ffac9cd85a845d7a813f391

                                                      SHA1

                                                      f656a613a723cc1b449034d73551b4fcdf0dcf1a

                                                      SHA256

                                                      fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

                                                      SHA512

                                                      1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

                                                    • C:\Users\Admin\AppData\Local\Temp\nssF31C.tmp\modern-wizard.bmp

                                                      Filesize

                                                      150KB

                                                      MD5

                                                      3614a4be6b610f1daf6c801574f161fe

                                                      SHA1

                                                      6edee98c0084a94caa1fe0124b4c19f42b4e7de6

                                                      SHA256

                                                      16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

                                                      SHA512

                                                      06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

                                                    • C:\Users\Admin\AppData\Local\Temp\nssF31C.tmp\nsDialogs.dll

                                                      Filesize

                                                      20KB

                                                      MD5

                                                      4e5bc4458afa770636f2806ee0a1e999

                                                      SHA1

                                                      76dcc64af867526f776ab9225e7f4fe076487765

                                                      SHA256

                                                      91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

                                                      SHA512

                                                      b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

                                                    • C:\Users\Admin\AppData\Local\Temp\nssF31C.tmp\nsExec.dll

                                                      Filesize

                                                      17KB

                                                      MD5

                                                      2095af18c696968208315d4328a2b7fe

                                                      SHA1

                                                      b1b0e70c03724b2941e92c5098cc1fc0f2b51568

                                                      SHA256

                                                      3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

                                                      SHA512

                                                      60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

                                                    • C:\Users\Admin\AppData\Local\Temp\nssF31C.tmp\nsProcess.dll

                                                      Filesize

                                                      15KB

                                                      MD5

                                                      08072dc900ca0626e8c079b2c5bcfcf3

                                                      SHA1

                                                      35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

                                                      SHA256

                                                      bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

                                                      SHA512

                                                      8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                      Filesize

                                                      3KB

                                                      MD5

                                                      144f1c94acd473ac1122d9553896b2e2

                                                      SHA1

                                                      ee04a4b6fed4be0eea885b3a87d98a529576c15f

                                                      SHA256

                                                      9dc079bdf3f058942c1e2bd1629808319b5bb7e7225cdce2933177caf08202e3

                                                      SHA512

                                                      6705a4811fe448c78ff6ff0a5ed26500d4e9684178c810ef94bd501a2eeb2890da95f07fa6982345357a5b03198aa28e0ccab2690f7fad0bdb76520b99a48246

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                      Filesize

                                                      3KB

                                                      MD5

                                                      52f597b02efe3bf2aeb568bf90f97c01

                                                      SHA1

                                                      638572c97a310ccfc1b7417bd68c0860a4515f8d

                                                      SHA256

                                                      7086129cc876d85dae5e041740337c25af86e451f990088505a9042ac28d32bc

                                                      SHA512

                                                      36dee0ae92c047a3595fc40f8a71aa504519a67f534a48ed09ee461990663f0ec9a5c2f3f563dcb04ef3649ad906f392c123774c0da79f6d0b784962056d1dc6

                                                    • C:\Users\Admin\Downloads\Unconfirmed 850330.crdownload

                                                      Filesize

                                                      2.3MB

                                                      MD5

                                                      1b54b70beef8eb240db31718e8f7eb5d

                                                      SHA1

                                                      da5995070737ec655824c92622333c489eb6bce4

                                                      SHA256

                                                      7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

                                                      SHA512

                                                      fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

                                                    • memory/1372-12814-0x0000000000A50000-0x0000000000F02000-memory.dmp

                                                      Filesize

                                                      4.7MB

                                                    • memory/5860-13088-0x0000013480C40000-0x0000013480CDE000-memory.dmp

                                                      Filesize

                                                      632KB

                                                    • memory/5860-13084-0x0000013480B40000-0x0000013480BF0000-memory.dmp

                                                      Filesize

                                                      704KB

                                                    • memory/9924-13014-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-13009-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-13019-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-13030-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-13102-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-13024-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-13116-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-13121-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-13053-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-12973-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/9924-12986-0x000000006E3F0000-0x000000006F730000-memory.dmp

                                                      Filesize

                                                      19.2MB

                                                    • memory/10748-12858-0x00007FFDF5D10000-0x00007FFDF5D11000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/10748-12981-0x00000274AADC0000-0x00000274AAE5E000-memory.dmp

                                                      Filesize

                                                      632KB

                                                    • memory/10748-12980-0x00000274AACD0000-0x00000274AAD80000-memory.dmp

                                                      Filesize

                                                      704KB

                                                    • memory/10748-12857-0x00007FFDF6670000-0x00007FFDF6671000-memory.dmp

                                                      Filesize

                                                      4KB

                                                    • memory/10980-12982-0x000002451C310000-0x000002451C3C0000-memory.dmp

                                                      Filesize

                                                      704KB

                                                    • memory/10980-12983-0x000002451C3C0000-0x000002451C45E000-memory.dmp

                                                      Filesize

                                                      632KB

                                                    • memory/10980-13069-0x000002451C3C0000-0x000002451C45E000-memory.dmp

                                                      Filesize

                                                      632KB

                                                    • memory/10980-13043-0x000002451C3C0000-0x000002451C45E000-memory.dmp

                                                      Filesize

                                                      632KB