ef82337fa50b97d58026e0476e9839f2ad0459b0b3011ad2aca49dee215dd1b4

Analysis

max time kernel
1050s
max time network
1050s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
18/11/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.html
Size

516KB
MD5

7f799cf933e89834bb04bf92ec450bed
SHA1

6fc882d74ab3c6a174597230ae62b8e03643dde6
SHA256

ef82337fa50b97d58026e0476e9839f2ad0459b0b3011ad2aca49dee215dd1b4
SHA512

f31c6ce9dc22c8573bd42902510ea3654c7324efde15759643b2a61feb3a29e698f3ecc20f05f39464259b576d0c48bc322dc9cd9d1e43bf0ff7dbd9ede02c1b
SSDEEP

6144:Omu1uxFuxruxyuxtuxSuxyuxMuxnuxtuxIvhg:OluXuhukuPuIuAu+uFubu2hg

Score

8^/10

steam discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Executes dropped EXE 25 IoCs

pid	Process
1692	SteamSetup.exe
5716	steamservice.exe
5852	steam.exe
11348	steam.exe
11408	steamwebhelper.exe
11444	steamwebhelper.exe
11572	steamwebhelper.exe
11708	steamwebhelper.exe
12000	gldriverquery64.exe
12092	steamwebhelper.exe
12184	gldriverquery.exe
12236	steamwebhelper.exe
8768	vulkandriverquery64.exe
1544	vulkandriverquery.exe
14324	steamwebhelper.exe
14472	steamwebhelper.exe
15080	steamwebhelper.exe
15324	steamwebhelper.exe
5768	steamwebhelper.exe
5784	steamwebhelper.exe
8256	steamwebhelper.exe
4800	steamwebhelper.exe
9504	steamwebhelper.exe
12500	Clustertruck.exe
13500	GameOverlayUI.exe

Loads dropped DLL 64 IoCs

pid	Process
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11444	steamwebhelper.exe
11444	steamwebhelper.exe
11444	steamwebhelper.exe
11572	steamwebhelper.exe
11572	steamwebhelper.exe
11572	steamwebhelper.exe
11348	steam.exe
11572	steamwebhelper.exe
11572	steamwebhelper.exe
11572	steamwebhelper.exe
11572	steamwebhelper.exe
11572	steamwebhelper.exe
11572	steamwebhelper.exe
11348	steam.exe
11708	steamwebhelper.exe
11708	steamwebhelper.exe
11708	steamwebhelper.exe
11348	steam.exe
12092	steamwebhelper.exe
12092	steamwebhelper.exe
12092	steamwebhelper.exe
12236	steamwebhelper.exe
12236	steamwebhelper.exe
12236	steamwebhelper.exe
12236	steamwebhelper.exe
11348	steam.exe
14324	steamwebhelper.exe
14324	steamwebhelper.exe
14324	steamwebhelper.exe
14324	steamwebhelper.exe
14472	steamwebhelper.exe
14472	steamwebhelper.exe
14472	steamwebhelper.exe
14472	steamwebhelper.exe
15080	steamwebhelper.exe
15080	steamwebhelper.exe
15080	steamwebhelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
12844	GameBarPresenceWriter.exe
13120	GameBarPresenceWriter.exe

Detected potential entity reuse from brand STEAM.
phishing steam

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
12500	Clustertruck.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 11348 set thread context of 12500	11348	steam.exe	166

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\templates\controller_ps4_gamepad+mouse.vdf_	steam.exe
File created	C:\Program Files (x86)\Steam\depotcache\397951_285661690570693680.manifest	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_uhoh.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_click_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\switch_controller_danish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\launcher.vdf_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\workshop\downloads\397950\829671465\Sounds\nsmbwiiRedCoin4.wav	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_mouse_mid_click_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\appcache\librarycache\823130_icon.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\userdata\1054407670\config\localconfig.vdf~RFe5d611e.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\steamdeck_right.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\btnDefBottomRight.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\x64launcher.exe_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\workshop\content\397950\777938731\Models\Custom Dunes\Custom Dunes.obj	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0335.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\xbox_p1_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\controller_cradle.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_dpad_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0526.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\flag_bottom.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\steamui_postlogon_swedish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_dpad_click_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\scrTopRight.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\fav_addTo.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\vgui_indonesian.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_trackpad_l_swipe_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0406.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\index.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamui_russian.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_outlined_button_x_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0307.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_ltrackpad_ring_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_ring_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_rstick_up_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_right_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\chkseldown_sm.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_dpad.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\locales\pl.pak_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\downloading\397950\Clustertruck_Data\Mono\mono.dll	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_blue.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_collapse_friends.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_l_click_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_rt_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\osx_max_hov_new.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\switchpro_dpad_lg.png_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\common\ClusterTruck\Clustertruck_Data\Managed\UnityEngine.dll.mdb	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0309.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_dpad_left_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_dpad_down_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_mouse_scroll_down.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_italian.txt.gz_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_080_input_0070.png_	steam.exe
File created	C:\Program Files (x86)\Steam\appcache\librarycache\70010_icon.jpg	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\durationcontrolnotification.layout_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\trackerui_finnish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_ltrackpad_up_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_up_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_button_a_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_r2_soft_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\xbox_button_share_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\osx_close_down_new.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_dpad_up_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\libavif-16.dll_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	steam.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping11408_1701807454\_platform_specific\win_x64\widevinecdm.dll	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping11408_1701807454\LICENSE	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping11408_1701807454\manifest.json	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping11408_1701807454\_metadata\verified_contents.json	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping11408_1701807454\manifest.fingerprint	steamwebhelper.exe
File opened for modification	C:\Windows\SystemTemp	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping11408_1701807454\_platform_specific\win_x64\widevinecdm.dll.sig	steamwebhelper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameOverlayUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Clustertruck.exe

Checks processor information in registry 2 TTPs 17 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GameOverlayUI.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GameOverlayUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Clustertruck.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Clustertruck.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Clustertruck.exe
Key opened	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Clustertruck.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\ = "URL:steamlink protocol"	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\URL Protocol	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\Shell\Open\Command	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\Shell\Open\Command	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-641261377-2215826147-608237349-1000\{201BBFE8-59A4-47A8-ADE3-4CBEB3204C1B}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\ = "URL:steam protocol"	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\DefaultIcon	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-641261377-2215826147-608237349-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 231952.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3804	msedge.exe
3804	msedge.exe
2708	identity_helper.exe
2708	identity_helper.exe
6072	msedge.exe
6072	msedge.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
1692	SteamSetup.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
11348	steam.exe
12500	Clustertruck.exe
13500	GameOverlayUI.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5716	steamservice.exe
Token: SeSecurityPrivilege	5716	steamservice.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe
Token: SeShutdownPrivilege	11408	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	11408	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11348	steam.exe
11348	steam.exe
11348	steam.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe
11408	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1692	SteamSetup.exe
5716	steamservice.exe
11348	steam.exe
2984	OpenWith.exe
13140	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 4332	3804	msedge.exe	81
PID 3804 wrote to memory of 4332	3804	msedge.exe	81
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 1108	3804	msedge.exe	83
PID 3804 wrote to memory of 3288	3804	msedge.exe	84
PID 3804 wrote to memory of 3288	3804	msedge.exe	84
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85
PID 3804 wrote to memory of 3852	3804	msedge.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x128,0x12c,0x10c,0x130,0x7ffd0ef746f8,0x7ffd0ef74708,0x7ffd0ef74718
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6a5cf5460,0x7ff6a5cf5470,0x7ff6a5cf5480
    3⤵
    PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4872 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2104,12066496822045632821,17308770521664232274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6072
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1692
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:5852
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:11348
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=11348" "-buildid=1731433018" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:11408
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1731433018 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffcff7daf00,0x7ffcff7daf0c,0x7ffcff7daf18
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:11444
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1588,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1592 --mojo-platform-channel-handle=1580 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:11572
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=2180,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2184 --mojo-platform-channel-handle=2176 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:11708
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=2772,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2780 --mojo-platform-channel-handle=2760 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:12092
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3148 --mojo-platform-channel-handle=3140 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:12236
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4000,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4004 --mojo-platform-channel-handle=3996 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:14324
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4276 --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:14472
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4024,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4036 --mojo-platform-channel-handle=3996 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:15080
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4052,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4064 --mojo-platform-channel-handle=4056 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:15324
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4004,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4508 --mojo-platform-channel-handle=4536 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:5784
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4424,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4440 --mojo-platform-channel-handle=3992 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5768
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4508,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3996 --mojo-platform-channel-handle=4236 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:8256
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=4056,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4084 --mojo-platform-channel-handle=4532 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:4800
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=4536,i,2241888202191485282,2072634690386589476,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3996 --mojo-platform-channel-handle=4088 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:9504
- - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:12000
- - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:12184
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:8768
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1544
- - C:\Program Files (x86)\Steam\steamapps\common\ClusterTruck\Clustertruck.exe
    "C:\Program Files (x86)\Steam\steamapps\common\ClusterTruck\Clustertruck.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    PID:12500
- - C:\Program Files (x86)\Steam\GameOverlayUI.exe
    "C:\Program Files (x86)\Steam\GameOverlayUI.exe" -pid 12500 -steampid 11348 -manuallyclearframes 0 -gameid 397950
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    PID:13500

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x414 0x4f0
1⤵
PID:11888

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:12844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
PID:12888

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:13120

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:13140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:13248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.2MB

MD5
33bcb1c8975a4063a134a72803e0ca16

SHA1
ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

SHA256
12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

SHA512
13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

Download Submit
C:\Program Files (x86)\Steam\appcache\librarycache\1161040_icon.jpg

Filesize
638B

MD5
7ecdaf8a54ec52b20640a88527512903

SHA1
3133a4d748ad3be61fe9db759339cd5de73339b5

SHA256
7bd8b75aec0a4d4a377f3ca3a023fd8b7c5fc7dc6a2a66d17f8cdfe5b731ab0c

SHA512
60ae2031eed0c38264f0d8db22a9b6efeb3f80c791e916e15a1730853162d56e0da014dbd93a5479bae4f3bdd5705ca89be70c90574a524abd1c276ed5c55a2d

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.5MB

MD5
ba0ea9249da4ab8f62432617489ae5a6

SHA1
d8873c5dcb6e128c39cf0c423b502821343659a7

SHA256
ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

SHA512
52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
6e6a2b18264504cc084caa3ad0bfc6ae

SHA1
b177d719bd3c1bc547d5c97937a584b8b7d57196

SHA256
f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

SHA512
74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
a2ec2e91c3ef8c42e22c4887d032b333

SHA1
e2c738a2e9400535b74e2263c7e7d1ecefe575f2

SHA256
8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

SHA512
b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
15KB

MD5
e4b42c643bad8e59dc0bfa379e9f51e7

SHA1
75b1c46bdd6c2e7b7412b8bd33bc9f3485228b69

SHA256
cbd81fab7a1a62b55af54e86bc59a5ce8d4b0c9f7bc8ea5377c64529fbe77e71

SHA512
12d6d1ddaddaf7045826797e658e30427e7d95c991a65a1be690ea911f35735de4aac730090ae3e79d96fe63f85bd07a801e18a81ed0f5df5103c26a4ade6705

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
24KB

MD5
cc2c6e41ec8a7dc21d738550639dfa77

SHA1
d14bc6538e351c441fb1dc14833ba277aada4908

SHA256
29bffe51c6e7b9755748c253cef08841e5267ccda674b3b1f3912afb9b3d20aa

SHA512
54b5deab7fe6c0265a2d5b41f89144183a5f2d8f7066c80ed8ce6908dbd974518bc4747273ac9e9115771007172f4dbe09fdbd9edb96cffb45c0e383b5d50585

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf~RFe5a880d.TMP

Filesize
184B

MD5
3cdebc58a05cdd75f14e64fb0d971370

SHA1
edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe

SHA256
661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7

SHA512
289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
0340d1a0bbdb8f3017d2326f4e351e0a

SHA1
90d078e9f732794db5b0ffeb781a1f2ed2966139

SHA256
0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

SHA512
9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
4c81277a127e3d65fb5065f518ffe9c2

SHA1
253264b9b56e5bac0714d5be6cade09ae74c2a3a

SHA256
76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

SHA512
be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
2158881817b9163bf0fd4724d549aed4

SHA1
c500f2e8f47a11129114ee4f19524aee8fecc502

SHA256
650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

SHA512
f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
9e62fc923c65bfc3f40aaf6ec4fd1010

SHA1
8f76faff18bd64696683c2a7a04d16aac1ef7e61

SHA256
8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

SHA512
c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
10c429eb58b4274af6b6ef08f376d46c

SHA1
af1e049ddb9f875c609b0f9a38651fc1867b50d3

SHA256
a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

SHA512
d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
5c026fd6072a7c5cf31c75818cddedec

SHA1
341aa1df1d034e6f0a7dff88d37c9f11a716cae6

SHA256
0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

SHA512
f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
189ba063d1481528cbd6e0c4afc3abaa

SHA1
40bdd169fcc59928c69eea74fd7e057096b33092

SHA256
c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

SHA512
ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

Filesize
4KB

MD5
1514d082b672b372cdfb8dd85c3437f1

SHA1
336a01192edb76ae6501d6974b3b6f0c05ea223a

SHA256
3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

SHA512
4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
202b825d0ef72096b82db255c4e747fa

SHA1
3a3265e5bbaa1d1b774195a3858f29cea75c9e75

SHA256
3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

SHA512
e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
58e0fcbee3cca4ef61b97928cfe89535

SHA1
1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

SHA256
c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

SHA512
99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
4KB

MD5
6367f43ea3780c4ee166454f5936b1a8

SHA1
027a2c24c8320458c49cd78053f586cb4d94ee6f

SHA256
f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

SHA512
31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
6KB

MD5
e04ad6c236b6c61fc53e2cb57ced87e8

SHA1
e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

SHA256
08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

SHA512
0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
4KB

MD5
56dcf7b68f70826262a6ffaffe6b1c49

SHA1
12e4272ba0e4eabc610670cdc6941f942da1eb6a

SHA256
948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

SHA512
c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
4KB

MD5
66456d2b1085446a9f2dbd9e4632754b

SHA1
8da6248b57e5c2970d853b8d21373772a34b1c28

SHA256
c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

SHA512
196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
4KB

MD5
b2248784049e1af0c690be2af13a4ef3

SHA1
aec7461fa46b7f6d00ff308aa9d19c39b934c595

SHA256
4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

SHA512
f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
4KB

MD5
194a73f900a3283da4caa6c09fefcb08

SHA1
a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

SHA256
5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

SHA512
25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
7KB

MD5
53f7e8ac1affb04bf132c2ca818eb01e

SHA1
bffc3e111761e4dc514c6398a07ffce8555697f6

SHA256
488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

SHA512
c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
4KB

MD5
29f9a5ab4adfae371bf980b82de2cb57

SHA1
6f7ef52a09b99868dd7230f513630ffe473eddf8

SHA256
711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

SHA512
543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

Filesize
6KB

MD5
cadd7a2f359b22580bdd6281ea23744d

SHA1
e82e790a7561d0908aee8e3b1af97823e147f88b

SHA256
3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

SHA512
53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

Filesize
4KB

MD5
f350c8747d77777f456037184af9212c

SHA1
753d8c260b852a299df76c4f215b0d2215f6a723

SHA256
15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185

SHA512
efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

Download Submit
C:\Program Files (x86)\Steam\resource\filter_profanity_english_cached_timestamp.txt

Filesize
29B

MD5
a87fd0c24c76721c0f59225558966091

SHA1
c8ca7e49a2fef879cf2cab10359b27ecf87990fd

SHA256
1935ba31980fda1527f0a20353fb916b5c9e53193620c8f3e8281bf8194609a7

SHA512
03781362751df77862170d85fe0b86efd0a1a7e531642f3ff4f8078ebd7aab96a2e7c679d6f5f427efbae70171aaf9b4307cfab9f5ab737a79b6c01258aaa1fa

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_397950.acf

Filesize
657B

MD5
621176d6a0595b0c5ae0fed7a3aee8c6

SHA1
8c04b9b9603ebac05b5225715cc72ff75f1a4b46

SHA256
df7b6ecd6bd6eb180789fd5c498ba8111d0ca66705f6f7d3a956cb0ff180280d

SHA512
d9c01eafd4aabb63f40c4f40fb061a1cb908ff9fbe609977a0f855967dd5a56e2748645bcbd0dc79bd32f44d8eee00203533d3af3ea4927af51c68f5d89f5de1

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_397950.acf

Filesize
634B

MD5
7705304afd7580462b7bd0f571dbc194

SHA1
6eff80a5031fb00df700f71d5e01ded1f7304a3d

SHA256
ec7edc8aef0053eca739e995a1318d9fb27dcd3b49f3f4700fe3279ebb24084a

SHA512
9a2d9cd89f690de6d02dbf90e2548361dda088a6de38bb3d747905097b40eed97ee36baef9d32fba9551c82ee0fd057cc4cdc4ae33d41381e34f7b4c09cebeba

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_397950.acf

Filesize
795B

MD5
3e5aaa5097fe4d677083a4b8b78db887

SHA1
45f92e0442339b5c8ead5d35ccb60a45aebfed58

SHA256
aced6088f2cccf29a89644a72134060860c7a1dfd7a539cdd54718d7fdaa8cde

SHA512
53ff694b74b51a8b4642a6294bbeb0a4017a5a0b6539bdd6dcfd82f8b2ee417a25a40e410a5bd782360e8359b7fd2fceae72102ad3eaa84f4ebc60d7c5bdcf6c

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_397950.acf

Filesize
634B

MD5
63eb0213b4261a497db10c321b32a99f

SHA1
ac74408fc9da47789327c7adaec8cf432cb0bdff

SHA256
3b0bc17e6ec5444afdd435ab2533529f9f79084ac682f5d51a7926f5119d9e20

SHA512
38ffe8bf237226349034d0b62e9087da3bbfb99adc9b92a0a21408545aa6edc25508414d22dcfa4bac59c459299c488ca8a8a2001ede3900c7da3450ea3ad6ff

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_397950.acf

Filesize
625B

MD5
e59592dd1240799911661c6626fa9284

SHA1
24058c4426426a2b73157f3a6e10ea4522a6c45c

SHA256
06244b33cdab65c17bdf248c04a0983b2c482c0f3a3487321cf923641923f2b0

SHA512
55117299c15082e8a700614ff91f0d7a7d6b4f3b4ca59eb0c5111e12403925c84979e462646405343164ef8ce0aea01c9893605a9b6e40fcd1b53d63db799a47

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_397950.acf.1361973762.tmp

Filesize
632B

MD5
bb374973f8169d299e91a1118700097e

SHA1
38a1eab0c9aa919cd318b95dbbb7eb3e4989b6bf

SHA256
495e06c067780104354daa6f05375b0f438bc4f6e001ad88ac15908abbd6ae44

SHA512
2f2949bd7fee98dfff53e06a6984c25efc95b9a479380c3cbf5d7296ffa8d6f78d7c140501cf2e0827ffdd60479c37ac2f047b0067101b2da4b52b7f2d1fca87

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\ClusterTruck\Clustertruck.exe

Filesize
16.1MB

MD5
8a54b7b8082c386aa90cdc4ed0d0d19d

SHA1
944f4e45674745d54428f6034e6dc1f2bbe11da3

SHA256
7bc6a5f6c4308fb1bc4a51f7da549de142fab9a47a841863818d66d0ce2cb693

SHA512
14bbf7daede7b0e918a300256f2a8c0776b444f4c789e64def2a5373214e1c27e3bdd7913b41ab24518a16dac7fecc316ee5f2c0a79ac8a5c88f68d021157819

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\397950\steam_api.dll

Filesize
208KB

MD5
a83ade32811f1419685e90f592adf505

SHA1
840388478557d9a916888451d11c463338684a09

SHA256
5d58f6ea6d46d44cc8422f3bc0f76b9a95f5e7e14007887a8e1cf54fa77a8eac

SHA512
8caec402ae13ce3843a12213effa74345ed3b140f4a085d06c0241872d9a09ec56a70eac576a749a1db479cb8e3aca57b6259bc9bedcb1db2626c0f5159478d2

Download Submit
C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

Filesize
231B

MD5
7e30281f006c1719ee908b92695d39f4

SHA1
2ded286d76185c0dbdada7ac17f1c92a5e8300ee

SHA256
0250ef2878d51e5a01d84b21f63509d2d2a2e5dcb030d71c5f7243f41c003429

SHA512
e19208dc365827cca4ea5638bd2301ec755e49f49c90ee96bc50292d01deb0317ae1fc20a63d05e1b63899a7d0d3608963f716465fd8613376e36c4cfcafbb55

Download Submit
C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

Filesize
265B

MD5
54ecb114a6443eeb26157a7f57e7fced

SHA1
dbc45c5ae795b566493d75e30ba9ac728b4ebd8e

SHA256
dcf6c936de0ebd4aa68279b0337d26531ece86e3358ec4e7d9ad7d40e49f7f43

SHA512
89bbda666a5b5ddf60112d29745b1f15a831ed473e4d5f97a99f090ce04634430bfc72bed27ff1723b244a1cd819880df68d73618a1914ef4f28d37cd100cca1

Download Submit
C:\Program Files (x86)\Steam\steamapps\workshop\appworkshop_397950.acf

Filesize
1KB

MD5
477d01f56c20f0e7adfd15d879e45b67

SHA1
44fbb6d472a0db9f17be68ae0e819756522be145

SHA256
1613148286d6b7b4181a46ec7c615d41cd508f20621e982d903f2c19cb77ba84

SHA512
973191551b6800d9bbe7e993ff95ee4c3de2b92f0d3f076b3450f88a9fbeb2cb4bd9c580282694eba1a763cd4a50271a7d4e99a6be4bdb9aaafad4fff9a07c76

Download Submit
C:\Program Files (x86)\Steam\steamapps\workshop\appworkshop_397950.acf~RFe5ca214.TMP

Filesize
911B

MD5
1148efb6d8783e5eacbced6c9ea829dc

SHA1
b966a6f68ee251843e53f2a4c8bc3e602bdc9381

SHA256
2140782abc1925482c0b264af081c98639457e69eea60a4a6ffcce4aaef4495e

SHA512
6af3b12405ecb83163280021142a414a6bddf1dca61774f1e8a2d99c94a6a6b19659267cda1da4e02d3ba72f67a56acc521ecbc7957138466503eb1cefe02995

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\7\remote\sharedconfig.vdf

Filesize
165B

MD5
13c99ce9ed77875d9255224b3f8dbebc

SHA1
ee68b6c5195eaa85f90af435cdfa9fd6728c62d4

SHA256
4a0dfc020ee715fc0afb47f1d42bf18959d27b599d3bdd15b9eb192887eb4ba2

SHA512
d2048580ad4c18dc7c9986a0fe4a7fa5a85ae7e9ce93be0b65fcb11e8eca7984d057c2335783adf313a1d8b1d3c0fae1882087a4ee51ec36cae2e2b9bb09c1ba

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\7\remote\sharedconfig.vdf

Filesize
231B

MD5
e29d09d5cd22dcdc0e498444721e5aac

SHA1
79dc278e790bae72714d586634fb1d045b55992f

SHA256
9161a1de640c323b3e9a8de66e838edabb9d9da1f7100196c2e735dab0e5e63e

SHA512
84dc07dbf18506fba9e73b166eb3648b4732ac05c26e5a75ad5bca8eef72d6c78990a819240b2410356a1aa2c7fa230d0c9c05e491ff4cdee1d81b31f4032916

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\config\librarycache\2371090.json

Filesize
126B

MD5
5216ef382c2d09e344ae46f2c073acab

SHA1
91040770b2b51d00e6b7c32a37315eef249a55bd

SHA256
2200afe5bd5dccc0cfe9d34b29eedc49014dd673e5b9b2d1797e3f52a14b5617

SHA512
0a5bc2a98fec77d33e0aca0934d547746883d5ce2b6cfe23e36dc9afe5fbd51dfe12d955213cd0123b4ca004e225182bea6722d0870ea65ba5a808756e893f7a

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\config\librarycache\397950.json

Filesize
7KB

MD5
652b270ddd0cda95002c970273dad8ae

SHA1
e47a7e4b8de5cb51c5b5463886bb5c863ff91ce2

SHA256
7493ad813d9b8b09fe03e41d9b8f3f1e59391cc26ccb91df5996777e0768fbfc

SHA512
221cbe972ca60d66f9de3800b7a209fbde48f26d0e755001d9c123d9acab09f6aa0fac1139009c5ffedf3204016b082174735ddc5c308927dcbaa11b7551509e

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\config\localconfig.vdf

Filesize
3KB

MD5
1596ca843af99d0463c251893bcaebbe

SHA1
a15c2900ba00b0154548693ad065dda9ecf59869

SHA256
04af1425f7eae4f2aedae07220e1cb2e55e13086029ceb5a6de352acd729b6ed

SHA512
4c77e1e2ac3f07951ac6f12eef39d6d7c12c5e2c76f9f19ecd48ba2ce87e620d2f2561b1bb6fbf7b19e7710453603b79246f4482629f3421c85618311cc9aef9

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\config\localconfig.vdf

Filesize
8KB

MD5
05877f22c8f0cba9fc48897b91fa887c

SHA1
3f5b4c6e1cae71525512622e6ca75360708f6578

SHA256
43d084699e93127dba3b58fd0d9a276fcddea4cd4636a83f7138ea1ccd77d3c6

SHA512
d963b8834ffd5df6bdafc1e503b247063f6b215fb3770e05c447de9d33d89f71ca61433e7eee1b4b8b57a8035655cb6c111eea15d92757843f49f8c6fb129ad1

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\config\localconfig.vdf

Filesize
8KB

MD5
ab44174b1d714e79ebb7f46cf20b4a32

SHA1
3b4c17ee793c6b5dfcc8bda5d29a7409e163d2cf

SHA256
5cd791d3886ea18092f67ba47551f580ff4383e93bbe5fc65d7e34404330dfb0

SHA512
ddfa9dbda807fd50c5da14f37d1fba782e1d8c280c9dcf2664f24e11a5c5d86e43f3d53dd2ab4f2ed02f2d23012cd832f4235aafc0365d60b7bd99152db0473d

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\config\localconfig.vdf

Filesize
8KB

MD5
ee4c1705d4b0ef0620da4b023a07921b

SHA1
08778bdfb30c06f709676c60aaad5b7aafab3f2e

SHA256
92bd5fc1b13024115a3d6df8dd0cff5043535ed0379af487476328473c90702d

SHA512
6bc860d3f3cf9a29e554d144d8fd5b12c5a7f4d7d456e11bddeab9d3f9c86d03cdf636e56a187e11655335b4d15121317a74faaf0971b989405d51608ab1aeed

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\config\localconfig.vdf

Filesize
3KB

MD5
cbaa4e270eef797a89d353a259c02e5b

SHA1
5ed9cf5a6be6f06c1371effb2c58a0fb1400e8f0

SHA256
26453bd830c4465ddc1ec346a908fc2dc02a0a4e709e6eb51b723d90874f4b48

SHA512
f5eea88c96b076e44bf266a3dd62cebefce6262dbbc2cfa6d9b75f0e1aefec4f76cd4737dc5f7375e0a38f68cbfc8a8e03c5767f909b43b01df5a6035e11f93b

Download Submit
C:\Program Files (x86)\Steam\userdata\1054407670\config\localconfig.vdf~RFe5b6415.TMP

Filesize
1KB

MD5
80596621ec193f6b73e72bd7b2b34675

SHA1
b9c868307eb1b3311487569bb27adc81ac45b944

SHA256
04dde583957a60e0e6df8f1ef3d73aaf62eaa37fc542dd7307a6d236afe6b771

SHA512
66e48d535ed9d9d2a96214f5fdaba45557b52cda422299abf6e4bdbce05904eb0c17fefaa5f9d7c68c8d629460701fe9f2b1b498a519bd8665cf09816cd8432d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2905b2a304443857a2afa4fc0b12fa24

SHA1
6266f131d70f5555e996420f20fa99c425074ec3

SHA256
5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

SHA512
df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f5391bd7b113cd90892553d8e903382f

SHA1
2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

SHA256
fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

SHA512
41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
7fb90e5a3d532e95f85024c6f488c559

SHA1
780033c6b50641c5cff8b2ae3db5b024baa360cb

SHA256
63b4e56862b61fa10e103c0db0db93a5681130e3ff935b7be93185cc64080ca6

SHA512
772a987bf21a24bcb231336d893218bc0ecea1366aca6ace836538c6cd6e57c65ee99a0a4a765edce7166926202ec6390f55f83f08ec2a10dd554dafde9b5643

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
0f79762ec3c848dd6670df988bde00b4

SHA1
a74d7d6c4a9e56c30f3327a44e5dedbdffd6d2c4

SHA256
33f58632ed981f2ac66862426b82270c1f1961b8aae0b998b9d4028f603ba4a9

SHA512
9fe7b7d178114d47936d94dccc28830e3f0f8f54e0bc0ab135e80de5b8626b2f0c9f8d21ca3dab4ed9ae716b02b43d6b18a2f3bf867b89c3fab18ec678b7e038

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
912B

MD5
7cf00783e3589d3aaf05968113022693

SHA1
9d26632570a54988e023d74e9e4559f4bd511d96

SHA256
e68f7b05fd6adea8a041a393d31a684f5dbbbf209a7c8785e9d79679b7c3a9c1

SHA512
6af7733ffdf6ff425a37af2d23d6b3f36c750aaa6814c0abe3bc2fe969b57f195bdf387318af5913af7d3b38a19851f804bee0188c164db22eef6074fa914979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5898e0.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc4672ae409f46a7c523fb657cbc2f09

SHA1
4295a15c81a05c4596e514e0f9649740c5f8e817

SHA256
43b4ec0219c9a08c040693d0ba4c70d1879cc77332ec1a68eefe0f1edb7c6a48

SHA512
722903c258273d5ee0d037339c8d45c083885f4081c111a07cfc6d5f6666345cbbcc145de7f20281d3260ecaafeb0bae5d5e9c9cd993811343984767b681200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac0c4ca8e63b32cb15747f1d017777af

SHA1
5d5b01fd6e29ada368cd0ae304517bf2ed245089

SHA256
d5bea2b3dc4c30a403f89d4e25c7255cfa95aad03a6f25bb46ed0ae222dd38a1

SHA512
d3bdac6189fb9e50b68ca4e0c765fbc9cd3a76c38b2c5356701431c34fe74976ce21fda443421b32b0d887c5d6250a047b3a306930d23e2ffbc902c71516860d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
41167de4816e076d264dfb3fdfca5cc4

SHA1
2de890349da41e3da57ae0c7d6687345d0527a21

SHA256
b2765f3125c52ce10e69478fb79fe223186ef1f5946a20d8d9ed5426c3761354

SHA512
c6d783b916965b293abd89147a80dee3ae3c637bd050478a4d1464e03c23c9493542d1f7bb37b9a40f10bb55216b19e3a81110e1f12848caf350f978b7037986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89586f728f553294dd5ec1c344238c8b

SHA1
6250671742d9ee001e5eee883ae50471431b48f6

SHA256
6862283db7ef62f0d785672c4033d926870599426f410ee772f2968b1b29a176

SHA512
a6ccf2b818c40d531217df63442d0391e4ced1e565f47d112c9dc4dbf5c8a8a8ad8971ca71185c45318164ca0a62498943e7c3d697299a8a488607131e1497fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
010460ace0b2e01c4b5632f4197badca

SHA1
c1a2da37526b4f158e98347a8ce26fe649b4d5ec

SHA256
2c9dae5e0e2eb2f0f26836d4e2c082db7a74488d8e5a4e9dd02216c267c16811

SHA512
9f8f0a26fda590217f5df8f17e0fa34ee46b45d67f0c6a9e543ae4a61e0e084f9a6afe47b5effe04fb025522182637a81a195040838c13f277bd4c76f30251ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
841648cea0ee9545443bc43ff98a70a7

SHA1
46e2e9e4756b486127c3bccc6fcde1623969e8e5

SHA256
9709a40ca255a1acb8f4608eab007ad6c6c30c6efa3bae9cd0e855cd92c6d933

SHA512
742361a778e3052a0df3ca3e44eb62880d8ef86d1084db7aa330e2307405a7057a9e2045494f5b97faa5cdd6afe90ef55a3ce92b4817749f40cce37114c4b4e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7ad9709100fb43b77314ee7765b27828

SHA1
5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

SHA256
04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

SHA512
fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e122fc93c0ad25d45d09ba51a3e86421

SHA1
bb52a7be91075de9d85f4a4d7baeecc3167c871b

SHA256
a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

SHA512
12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
f8f97317fc5de6726deaa3fcf781b18a

SHA1
1bb8ccc62a57ba8538af24e2970b25c4ddfb6f85

SHA256
43e5e32a588b1c7aef05cb5ab8d8fb7a522407a68bed733d02e1ca62b420ed2e

SHA512
0bab909a4fb8773f31c4de367e29002eed69dc28380ab22ac281c620f4e36820e49666e6ca030ece38f2075f47c561b6e52f898d82d648f025b1926db1bd61f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5841a8.TMP

Filesize
372B

MD5
a80b8f996d5cc03bca72b06a3825cd9a

SHA1
0d941c24abf412420358908d37b26b5b389046b5

SHA256
ef7f000110917365ac999d6c679efd1816cfd87d63a4f3a7ecbde447a3ff0a60

SHA512
dbb64487f00a2656ad667f6e268365cdeed88f0e740a0d218e71b698b7321bd0d7970d68a2eb8d0168509229a473abff831ef9002247f18b6c96b4a251a3fd95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2021c0e929b3b94577acef497ee75e5

SHA1
f763b7aef3eef8af4cae6da86e4c9bf0575e0c94

SHA256
943dde10280ba3d07ac0547a09521bca882d76b407aa1b6872ace54b975c5c7b

SHA512
acdd57b8002e25374f5c43d584769224754b16bfa38b42c099c9edb4684da807653e48dde8bc033915efa2d03770a856ac28557f4ad1ce760690d76121e46cb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4c836dbc239f0730e370ddbf3e7060f4

SHA1
69443059022ba324b15d0c6dfb1ba78933acda91

SHA256
6a1dbd529b414a6808877e37392b290ec141bafdb3dbc6fb1bf6f45e755a9ecd

SHA512
14ff5eb42026f946d9f20d9a703c0ba4d29995f311e94f2ec57172787708538ea64e50f16648d3b0521cf284ad98151de62ea34a493f77a8d18169739458cda9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af59e021400b89c36d23624e68604360

SHA1
b82a5e5c66cafc72f3f779f374b1650a4eed8b58

SHA256
15bef4221e57977eda1177687fdca1e93db6a18afde190b359172d43fad0c926

SHA512
b169664705fbc5e57cf228025d73d125d3850ab31cdac30603be2c815d8f705daa197fc434f50d8eaa6c1bcc36249ed47e2132b16d3907224f2aad9b75ad281e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
9edd64697b554b00b74514638f5f03b1

SHA1
163378fdff49c91040449b0db179afed116aba1a

SHA256
a07bfc71023922180301bad45e73b57ccd40ca3558e39cb862ad51e8c7054406

SHA512
a4be300cd50f8a0127f2ca304ff1da619256eac68c6a42d5319dfcd159692cde2f2c6ee8fcc246f03f431811e0854ca4822298d9372f513ae97a31c51e87cb28

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000006

Filesize
24KB

MD5
944531387ce01bdf7ad736937b9b13b6

SHA1
df6268ebe74638714887588a1f43506b915e717b

SHA256
d6c997210287cecf290cc7c5cc99c13a46d874786d1747cace5f00713069e2a7

SHA512
25cbff327f7af6013476a5453847a5f0a4354a8efe773a4f7f8e29c4b8c12ba8105ed344109cf0a83ee6fe986468c2318b212d2eddc1dc2a6fb4ad9c7f9fc4c2

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000007

Filesize
19KB

MD5
8f661b8c2dc08d06a2992b1006fbf95d

SHA1
51f7614ee218ca027670a3bb0d7cfe1f23869602

SHA256
8bb39a6f700638d352b26ee0cb86fe5fd1127397dbc18d50a5bf37eb9ef6519a

SHA512
80789cf71769f1c03910535c610c942aa4be684433bcdff360ba309a6c15b3878920a49d1d1303c322de64f200b8e5d316b428b66668d51f9ddffaac0aa5f80f

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000008

Filesize
78KB

MD5
b63db6116a515c8ec16b58bbb1a0db89

SHA1
c8b53c1566bc23bf614f3faf2dd0e2be49aae50b

SHA256
58cf7a378014be774e0348655722edbf63b5470f6a4e84b19bb46e10349189a1

SHA512
b114bbb09dab653809bc63b9b7ce66be04b4baa50fa4ae938b1cafd86eac94b7742ece421fba8c491ad3b95980960acc9d30dc6f0c5e609f1494571583641ab7

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000023

Filesize
17KB

MD5
a421438ebae11fcb4808982f78536c8e

SHA1
cb3287d6dc2557343cc2e4723f6bb5e5534ab075

SHA256
8d40f05f3d7b0c08cc959534185a4ec52963c06322e7c31dbf90266d9a0c6bfc

SHA512
5f6e88895377f671f867464313290d9cea0ccf4377ed74153c3fa745456ac35f9686fcf0a2e9643316c60f5bb677dfabe1ff408a56318c48e0f7853954abfe1c

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
e3a3c17dbb67496fb22d050bdab6c993

SHA1
76609e7d583b735f10bafcf08c86b9a08a22cf93

SHA256
be8142f2012d1219c38582de3fa391b54097183e707d362c7bad8ee15daf9743

SHA512
781a280653a64990c019dcfc39281d824a25be34572b3a8c9819640f6910113cabf0507025c97c71929657ce27ca3d3c1595a1e9a5f7751e6696b4d7614a08e5

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
04a53fd9debddfd4254e8488b53b6829

SHA1
5717e555979478e04f9da01486824cb8b7eec3ec

SHA256
172c0bb727b81a4d58c7d2e106197db46821854965b7808f911174c5609164c4

SHA512
3cb9d55f22219bf1b00dccd0bf908238350113228ea3b0783446ec185a904c2622e4eb85c008f8b57fce9078e4b4db353b415deb5c3d1dfd4ef100fd730fa911

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
e2bbe5137500524494c3ec1826631dd9

SHA1
870807ba57a3db08de5731b149c17c05954db558

SHA256
429b631bc8cb946daabd460b183fb9c9ab645a9751ae42e3e99077567ea9a8c9

SHA512
6f2631590e898edc707adf47d04262d15b0e7f826f7f4209b27e4d0926946d8f4e14809438e234129b064565ae805ab1b8e10515eb72dc908db9cda28897ff19

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
744B

MD5
b097d3d255e63783586f5cd157dcc102

SHA1
3f9ffd05e8b70bd5047918200b6fb03b2e129be8

SHA256
8afb034d0a9f7f4ed73d6fe243d0bfff12eb6bdb6a447920580e848354b57d17

SHA512
f80c9ea622c05e9a98efaab3df2e77e7d8e75e070c4a77d9b49839b7a7a0488afd628ce7f5838049248e1007dc4077013bb94f6ae35fa58a32200d6948cb4ce0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
856B

MD5
3734e9332d6f010f9d2d3a0f85ed09b8

SHA1
66863e321a2e0515a291585d8973b4006e29b68c

SHA256
e38fc00a83fe74fe2079c8e1769ff40905c6952f0a8db685ecca7c862ab6eda4

SHA512
fb77d8a9ec42b64c9ab3ff27449bd1b0ef3adbe1cfa4c853ac53002404dd28e786679dc7ddfd98bbcf84c2ecb0a12de2503fe7fa67f16b3883a37cfeb804e9b5

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe5b949b.TMP

Filesize
529B

MD5
329213138503cea26757ce9ab8d1239e

SHA1
b96e69b9ee5dd29bd13d7c719e55c6f6c8f99278

SHA256
4e7e79023dd18f7a965943f03d86f4404419905823d50d6765881f8380cede7f

SHA512
6d7959efdef188263c1093c06294e16548ac5218c7c8f25b7d39385c6298708bb487757e788733d16c482c92fa844441a393dab45fd0fdb9e4727ac1fe41a02b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
687B

MD5
a234a2ce2b63567905da9c148b7f86f5

SHA1
3951e5b27597c6572c89ca2387d8f75dd8be03ce

SHA256
9317af787f27a544000250ad366f2a46cf0d8964dfa785e076f490cc52d5095e

SHA512
7f87a8e27b9c013d9d70808a7b274535a6bc5ea3c02c28e2a8a112a1e03f70542943f2f2220f925c4d3beaa38d35bb150b7296b6e9e65b67e1b401f613cab0d5

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
4ded65bcb8e2d05daf35f3cb6d5b0416

SHA1
a16c2892dc5fdf837496cda4027895ba94e921d2

SHA256
29105c4dbc3a2c218924d7313b9b3d716538e927b0fe15bc903c902ec7daca5e

SHA512
f22471f6e71848c3bf9cb98fdb3e914098d7d39dd57986a7c1182faf4078d3bbb16943c06388244386216a807220bf454530ab9ce0f4a7e74ad3ec938a579733

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
ec436f927becad436a6a1979190b500b

SHA1
9f7d47017394cc70476f0f7b473bc70fffbffa16

SHA256
fef86524fed93085b01005ea9a901a7012afe074508ad0d65cb67bec3acdd2f5

SHA512
41374141534d449f7d591746be1e0b24502150941acd7f2bef65d79798a67ba259a047c2f3051d47eaee354afbba760d0d54df38658829bf6b66a0a5686266be

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
55aa4f571465d871f9ad29fcad691104

SHA1
6cee2636cff21fea3529ce57a588e5b9c82172f0

SHA256
4296b6ceafbf5a115e959217f16c5c63e49af996c29dd8ca97083a2c6d3d3f69

SHA512
1f282d7aa904a4a333e5af6dac04fdcafc43573d7501bcd0e3bbd2f7dd67c3c88f053fcd291cea481d54d6fc0356c3d20964151a492db35a9da994afed7704ae

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
b82d82ecc07fa47f2152a3cfca2d5e93

SHA1
26458ea192e9af40a8d4ce9fc01e272e5213fa56

SHA256
5db4aedcac8aedb6101c5b08d33efc38fe57fd456787c350cbcf69a3b2a481b7

SHA512
b6444080b28924bbdc1fe7f382d6600b8f80a6ec67ccc7842027745e3743ba3b805c2adde4ab11a203312342fd951714c0072117d367402d6cdfda9bbe76394e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
ffd844d2127271db19c90a3d801d044a

SHA1
64b6e225407235d5ab164806e2dda700e00d722c

SHA256
2127221b47c373387b8e86818f8d7d30b8b1253333e63c4b6d05e73ffdc00559

SHA512
3837215cb8114b6f806b87f2f650956f48b541b50d980e87053cb174bc91375957a8bf6145660c86c7b654fb362016a929bae716320723c75809fb5caecdc54c

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity~RFe5ba5c2.TMP

Filesize
188B

MD5
92386ce05c02789dd01e5243c48b6bd3

SHA1
7f98aa12b396b09d857318d9da6b5ba9ae52164f

SHA256
79dafed20d8f4b2e33518ada1b8c6eabaddc92514497ef71d6ac2570105fce78

SHA512
ba358b7cf7907a313d7f1c3976768f515246cc9292d596143bfd65a21b75cfba177cf4b3e9bec5e2416aa47adf4fb1f9fd8118340e9b7ce6be97789e8bcb2776

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\ShaderCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\ShaderCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\ShaderCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\UserPrefs.json

Filesize
2KB

MD5
602c49f9246967bdcff45b4f43cf2fb0

SHA1
4c5796e0c724bbd7a9244cc8a0fc9e8f40181f2d

SHA256
a3ad9649c1038078038be1abd591cdba73b4b4f5cf30e11bb6cb7a432b746114

SHA512
2f273c0dd0127071f4c768cfe7277c6efff84c1ef4f4271c1326db3658c84261794b106af3198717f349fbaaaf276163700bbb50ae20fe52ed0a88a192d46f77

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\UserPrefs.json~RFe5ae3d9.TMP

Filesize
2KB

MD5
68b20851ccb9834d21fb32615e42bd43

SHA1
88fab935f0b9484994097c08f785e9ecb7d68127

SHA256
a954b528dd65ad6c4c2091fa32f17abdb7a49454ce88e10bb6c377734c70c26f

SHA512
dcb0771120c8fe35213d60e9abf4b242af807324759e3c99e9b2569c00a941d885d53ef6fadfe69e6b740e0b52a6008602605d643801190a2d29175a7d065e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCD9E.tmp\StdUtils.dll

Filesize
110KB

MD5
db11ab4828b429a987e7682e495c1810

SHA1
29c2c2069c4975c90789dc6d3677b4b650196561

SHA256
c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

SHA512
460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCD9E.tmp\System.dll

Filesize
22KB

MD5
a36fbe922ffac9cd85a845d7a813f391

SHA1
f656a613a723cc1b449034d73551b4fcdf0dcf1a

SHA256
fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

SHA512
1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCD9E.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCD9E.tmp\nsDialogs.dll

Filesize
20KB

MD5
4e5bc4458afa770636f2806ee0a1e999

SHA1
76dcc64af867526f776ab9225e7f4fe076487765

SHA256
91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

SHA512
b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCD9E.tmp\nsExec.dll

Filesize
17KB

MD5
2095af18c696968208315d4328a2b7fe

SHA1
b1b0e70c03724b2941e92c5098cc1fc0f2b51568

SHA256
3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

SHA512
60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nseCD9E.tmp\nsProcess.dll

Filesize
15KB

MD5
08072dc900ca0626e8c079b2c5bcfcf3

SHA1
35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

SHA256
bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

SHA512
8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
c28a5ae90a1f1f587404a264ba410a09

SHA1
8242b9fee5c06b9306d5b1e2c19137d8c3f3de37

SHA256
d0f396439fd434a0ecdeabe39f2aeab8f6dac72b8dab559803fb7f3031a634bb

SHA512
550e5c07c15205dd34fea76cc2ac11decf189c49be74741e5c8cf99da2c112a375a4a23f27fcc5852bd933f5fbfdda54e0a483645fba4540343319f5e1e4dcf0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1aa9b8b7c765c665fefc5cd4a2d43cee

SHA1
8a63420a1c7f9e9ddda96cba2aac63eb3d033406

SHA256
475379f9fc54bfb1870b6cb638ab7b11f443b10c450293ebf0e36158392d5dc6

SHA512
bda4c4c502c1b4a09164d1f8f53cab2b20a6b69a4ec8e2865399c0d7c849d13c2961511d06193bd71252db673411dc17ce8d09f49992e34a72a4ac1b7180b1c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
425810b631934a29724dc12700a8dd07

SHA1
a541a937944f8120a84e5c75c3156e45b148eb8c

SHA256
eb1d785f4eba0a34e071a69355eb056fc8e7906b8180413917c252a29adc0622

SHA512
9146d1633e7193323b444c3cce89a265e56529457b1679bd9da4bc7a6b3c387456a7a8f323e0e9cc617044bb7cd7c73f561df3c14c6455cb2a2a43d9f1cee6a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
a74b5e426718937be319b9dd216a532e

SHA1
644f9d7793c89280a5186c2898845c8b1b17a697

SHA256
839a5be63496be377fe46712adffa66d26725d9b91ff23dcc54f9e01f1719992

SHA512
29ce14af039a2236260412afa0bf00d7966d5da616804374a42999bd4e97dba587ae909c3a3b270c6407a5d1d224a7fd9a23358ed1508c392dad76dee360bbef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
baecfff6110184889531a9dccfb9c73b

SHA1
ba1a6ffddc8167dbb0289dae0ea26074fcf900d7

SHA256
eeb38aaf434bf37222cd8e2f14166beaec214555bde2900969e2eb87881237d4

SHA512
aae56b6c75e97dd4668a3055e30e68cdba4545a5df7d5e8ccb64c7179309da73df0decd346fde97e254f33eca2a637a3918478bc4dcfc4d730897242d305e7b5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
1531f87064b0eadfa2b1e85947a18bc4

SHA1
02f4da2ea7bf918d7536e7311652003e548c3112

SHA256
e5b6e3bf83e482a144abf68469b1393bd5bf1a45cf2994ac565b715d329a55f7

SHA512
761cd2ef4c3e4c219a74ea5cf3f4deb1ed1b763017b7e9624c2363e7903828c099dc5e58a71e4c6b709c54d3e2de1e0ce25e0238ea3d3348a1a565c35eadeddc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
5023fc4cd26f339516e36e15d7d452d4

SHA1
db29e4738af37fcbb001edf69dd1681047ea0380

SHA256
e44a66eb0f6ba8afb9814312921d751c893eba45f55f2e58aa6a7ad0e7768d27

SHA512
402bd9a5a2bde0ce6c246ba4c8a196da0a984157e4854c85277f3f98e9b0775478801d42ef76fb5d2dec69fb188822d61a629aa02af5de7dca58866e0d6af39d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
6KB

MD5
e7a77d853defd70690bdf32607c4792c

SHA1
c03e784c9cbc652f4dcee77971a07406cffacc6b

SHA256
e52965e08f3e6304ee89e2fffe76c5fbd7d0bfe5d3fa9a83fda34ed4ca8d8bb1

SHA512
d1ba854babdebe18c3d4f2e6bb2a9fab2b438a214f00ef031331e9eca5136a0ec87556d9c44ac85b434554c8aa800cfc7969a3ebd6bbd3b4c8fb93cf60c5cf48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
6KB

MD5
f9f7177553186452aa7764334744d950

SHA1
7f0e0cc90ae93e097258d85ed948e90c923b0c8d

SHA256
6138bbda342c1a88b352969fa91fd5c9dc00aa8ab44d76f84f19d11993cf71c1

SHA512
ca46910f9d0da6aa35cac7f8f3eace2a1e59a7892707618717d190c1d8c89ba85e75d52ef94f35569b95e1fe326f5cbf99892eefe646568a8528141d1387c75a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
3898bc79df18e3294eb8ef54d1a70cc4

SHA1
287cf4205b3fe83f3d7900f0c7e3a322b9779d85

SHA256
86a46f5ea535d47d0516d2c1357014b9060797f3c8bd03277bbbb7b2f35c040f

SHA512
6fa470ded6081f28a7a4dfe1f3b1ca2b243bef156f53ea39ae873956e300b352ebd5c26306e27840500d35fe54daaac5e8cb91145ebfc49e1481e6c4548d217e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
4b4e288efb79ae33192d138c7d62c018

SHA1
5b29de13e9b956a21443be1a5050a511d9d826f6

SHA256
efd5e515099e99e03e8a8ccf5c81ebcf9ae3037bf55dea23122b91cea5a5c121

SHA512
40e0117e3bc9fc6382d093af748369130256f5436ea616c02c77f0c23df0d02603fe7b31191aeb33bccb5688bd4373288bf16b65bc06cd0562aa36f568ef9400

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
f7b5dab7522a1c0d76ea621e84c1e786

SHA1
acce7915de1485f94aa32356d12b0d64efccea72

SHA256
7fae5e960fff3ad53cea30cd32e512f258d7472a4798f0705e296e9f715bdb6e

SHA512
99e888ee673aa0821337a2a508b040e6ba7bcb1b4ccc1a4aff378f7224dc9f131fbb65c2083d771b0023fa59dc4426d4229f21b75b4a970a37a5b8b3b4e2fa73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
4117b82985b7d04cc163df350558e371

SHA1
8c162c6febeb80926a73d5214beacfdb608cc6e8

SHA256
6eea6883e390cf995115c9f6bc90b5cf1bed5e7d813e84464ded08c1b5bd94fa

SHA512
55971b3a7240147588c29c497119a75c6d68c758d2db8412244c41abb6f7851306b5db4c8f32cee93851d0d438de9baecc7d6606f21c95e7440fbe887a90372b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam\Clustertruck.url

Filesize
222B

MD5
53f214f78a1a7b4b20a7abce919aa83c

SHA1
e3720d77c9138ba24477ced947ab3c65b274826c

SHA256
07c6c8b75f4aea464c88d700b44ce7c66c352c32ae64a9acf618e9deb188409e

SHA512
61584660dd1e18b7bc31bf567ddbe969c43ea7e011d843b90b21e0a3b9da8efe63a2688fb8128b0c9ae65f10dae75932ac6aba9a41d2a75b8fd65036e647dfde

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 231952.crdownload

Filesize
2.3MB

MD5
1b54b70beef8eb240db31718e8f7eb5d

SHA1
da5995070737ec655824c92622333c489eb6bce4

SHA256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

SHA512
fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini

Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
memory/5852-12873-0x0000000000E80000-0x0000000001332000-memory.dmp

Filesize
4.7MB

Download
memory/8256-14071-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14073-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14078-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14077-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14079-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14080-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14081-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14082-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14083-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/8256-14072-0x000002BF9C1C0000-0x000002BF9C1C1000-memory.dmp

Filesize
4KB

Download
memory/11348-13378-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-14089-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-14001-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-14988-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13958-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13878-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13704-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13040-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-14029-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13061-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-15386-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-15369-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13028-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13143-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13084-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-15303-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-15374-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-15317-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-15319-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-15321-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/11348-13083-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/12092-12914-0x00007FFD1CCB0000-0x00007FFD1CCB1000-memory.dmp

Filesize
4KB

Download
memory/12092-12915-0x00007FFD1BF20000-0x00007FFD1BF21000-memory.dmp

Filesize
4KB

Download
memory/12500-15180-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/12500-15352-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/12500-15372-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/12500-15316-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download
memory/12500-15225-0x0000000000A10000-0x0000000001AFA000-memory.dmp

Filesize
16.9MB

Download
memory/12500-15184-0x0000000010000000-0x0000000010024000-memory.dmp

Filesize
144KB

Download
memory/12500-15183-0x0000000077130000-0x0000000077131000-memory.dmp

Filesize
4KB

Download
memory/12500-15181-0x0000000001E30000-0x0000000001E31000-memory.dmp

Filesize
4KB

Download
memory/13500-15373-0x000000006EAC0000-0x000000006FE00000-memory.dmp

Filesize
19.2MB

Download