Analysis

  • max time kernel
    192s
  • max time network
    199s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-11-2024 22:07

General

  • Target

    https://www.steamtools.net

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 52 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Detected potential entity reuse from brand STEAM.
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies registry class 40 IoCs
  • NTFS ADS 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.steamtools.net
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb99b93cb8,0x7ffb99b93cc8,0x7ffb99b93cd8
      2⤵
        PID:3156
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:2424
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:552
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
          2⤵
            PID:988
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
            2⤵
              PID:444
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
              2⤵
                PID:5004
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                2⤵
                  PID:1200
                • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:564
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:1
                  2⤵
                    PID:1976
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                    2⤵
                      PID:4396
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2880
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                      2⤵
                        PID:4180
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
                        2⤵
                          PID:3012
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                          2⤵
                            PID:4592
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
                            2⤵
                              PID:4008
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
                              2⤵
                                PID:1704
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
                                2⤵
                                  PID:3368
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
                                  2⤵
                                    PID:1816
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:1
                                    2⤵
                                      PID:4932
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
                                      2⤵
                                        PID:1736
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
                                        2⤵
                                          PID:1580
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:1
                                          2⤵
                                            PID:876
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6512 /prefetch:8
                                            2⤵
                                              PID:4892
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 /prefetch:8
                                              2⤵
                                              • Subvert Trust Controls: Mark-of-the-Web Bypass
                                              • NTFS ADS
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3368
                                            • C:\Users\Admin\Downloads\SteamSetup.exe
                                              "C:\Users\Admin\Downloads\SteamSetup.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Adds Run key to start application
                                              • Drops file in Program Files directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of SetWindowsHookEx
                                              PID:708
                                              • C:\Program Files (x86)\Steam\bin\steamservice.exe
                                                "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                                                3⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of SetWindowsHookEx
                                                PID:672
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:1
                                              2⤵
                                                PID:3872
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
                                                2⤵
                                                  PID:3332
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
                                                  2⤵
                                                    PID:3948
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                                                    2⤵
                                                      PID:5000
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7332 /prefetch:8
                                                      2⤵
                                                        PID:4812
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5860 /prefetch:2
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:3700
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1908,18445529089659753314,12111341323497699971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
                                                        2⤵
                                                        • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                        • NTFS ADS
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5968
                                                      • C:\Users\Admin\Downloads\SteamtoolsSetup.exe
                                                        "C:\Users\Admin\Downloads\SteamtoolsSetup.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:13708
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c taskkill /IM Steamtools.exe /F >nul 2>&1
                                                          3⤵
                                                            PID:13784
                                                            • C:\Windows\system32\taskkill.exe
                                                              taskkill /IM Steamtools.exe /F
                                                              4⤵
                                                              • Kills process with taskkill
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:13768
                                                          • C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe
                                                            "C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of SendNotifyMessage
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:13844
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:752
                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                          1⤵
                                                            PID:3684
                                                          • C:\Program Files (x86)\Steam\steam.exe
                                                            "C:\Program Files (x86)\Steam\steam.exe"
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Checks processor information in registry
                                                            PID:524
                                                            • C:\Program Files (x86)\Steam\steam.exe
                                                              "C:\Program Files (x86)\Steam\steam.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              • Checks processor information in registry
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:11464
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=11464" "-buildid=1731433018" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                • Checks processor information in registry
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:11532
                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1731433018 --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0x7ffb8670af00,0x7ffb8670af0c,0x7ffb8670af18
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:11584
                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1560,i,2730179853664773797,1379776384379256536,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1564 --mojo-platform-channel-handle=1548 /prefetch:2
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:11704
                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=2216,i,2730179853664773797,1379776384379256536,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2220 --mojo-platform-channel-handle=2212 /prefetch:11
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:11824
                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --field-trial-handle=2792,i,2730179853664773797,1379776384379256536,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2796 --mojo-platform-channel-handle=2784 /prefetch:13
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:12264
                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1731433018 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3092,i,2730179853664773797,1379776384379256536,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3096 --mojo-platform-channel-handle=3088 /prefetch:1
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:12304
                                                              • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                                                .\bin\gldriverquery64.exe
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:12140
                                                              • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                                                .\bin\gldriverquery.exe
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:12488
                                                              • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                                                .\bin\vulkandriverquery64.exe
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:12668
                                                              • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                                                .\bin\vulkandriverquery.exe
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:12720
                                                          • C:\Windows\system32\AUDIODG.EXE
                                                            C:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004B8
                                                            1⤵
                                                              PID:12012

                                                            Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Program Files (x86)\Steam\Steam.exe

                                                              Filesize

                                                              4.2MB

                                                              MD5

                                                              33bcb1c8975a4063a134a72803e0ca16

                                                              SHA1

                                                              ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

                                                              SHA256

                                                              12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

                                                              SHA512

                                                              13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

                                                            • C:\Program Files (x86)\Steam\bin\SteamService.exe

                                                              Filesize

                                                              2.5MB

                                                              MD5

                                                              ba0ea9249da4ab8f62432617489ae5a6

                                                              SHA1

                                                              d8873c5dcb6e128c39cf0c423b502821343659a7

                                                              SHA256

                                                              ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

                                                              SHA512

                                                              52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

                                                            • C:\Program Files (x86)\Steam\config\config.vdf

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              6e6a2b18264504cc084caa3ad0bfc6ae

                                                              SHA1

                                                              b177d719bd3c1bc547d5c97937a584b8b7d57196

                                                              SHA256

                                                              f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

                                                              SHA512

                                                              74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

                                                            • C:\Program Files (x86)\Steam\config\config.vdf

                                                              Filesize

                                                              11KB

                                                              MD5

                                                              612584a1e8b99080f804e0a9f74bccae

                                                              SHA1

                                                              5f46f8e32845ca54a69cc1ff153f0588ac39fed3

                                                              SHA256

                                                              2fa80681bd132783dc3b25d86125db6630e2e9b302a586d5a9cfe125045bebf8

                                                              SHA512

                                                              1859f19858600ff889f8e5fda87075696d524750d2012f631800c3338dc3223fffeda8d432411aaa94d8cfacdca4dae5cf8ac9eab93b2fcfb7c9f6c9b22c5877

                                                            • C:\Program Files (x86)\Steam\config\config.vdf

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              a2ec2e91c3ef8c42e22c4887d032b333

                                                              SHA1

                                                              e2c738a2e9400535b74e2263c7e7d1ecefe575f2

                                                              SHA256

                                                              8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

                                                              SHA512

                                                              b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

                                                            • C:\Program Files (x86)\Steam\config\config.vdf~RFe5a4596.TMP

                                                              Filesize

                                                              184B

                                                              MD5

                                                              3cdebc58a05cdd75f14e64fb0d971370

                                                              SHA1

                                                              edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe

                                                              SHA256

                                                              661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7

                                                              SHA512

                                                              289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

                                                            • C:\Program Files (x86)\Steam\config\stUI\Steamtools.exe

                                                              Filesize

                                                              16.3MB

                                                              MD5

                                                              1a475aa5000d3958df447de17e0dc14b

                                                              SHA1

                                                              8a45a8a2b38a524633a99abc7994aa0ac46c03ce

                                                              SHA256

                                                              1208c4d240918ab0b4767bc6a5c0cbe83ee7f21408fb0c5ea68769ebea759b3e

                                                              SHA512

                                                              e86be352a5732d18db772f3fc80a70ebb223d68148057663ed18aab5c2221fe6d1cb48d4f4e22940419e9144aeacdc03ea05739352f86aed7ce967afd7e80911

                                                            • C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

                                                              Filesize

                                                              15KB

                                                              MD5

                                                              577b7286c7b05cecde9bea0a0d39740e

                                                              SHA1

                                                              144d97afe83738177a2dbe43994f14ec11e44b53

                                                              SHA256

                                                              983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

                                                              SHA512

                                                              8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

                                                            • C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

                                                              Filesize

                                                              20KB

                                                              MD5

                                                              00bf35778a90f9dfa68ce0d1a032d9b5

                                                              SHA1

                                                              de6a3d102de9a186e1585be14b49390dcb9605d6

                                                              SHA256

                                                              cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

                                                              SHA512

                                                              342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

                                                            • C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

                                                              Filesize

                                                              23B

                                                              MD5

                                                              836dd6b25a8902af48cd52738b675e4b

                                                              SHA1

                                                              449347c06a872bedf311046bca8d316bfba3830b

                                                              SHA256

                                                              6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

                                                              SHA512

                                                              6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              0340d1a0bbdb8f3017d2326f4e351e0a

                                                              SHA1

                                                              90d078e9f732794db5b0ffeb781a1f2ed2966139

                                                              SHA256

                                                              0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

                                                              SHA512

                                                              9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              4c81277a127e3d65fb5065f518ffe9c2

                                                              SHA1

                                                              253264b9b56e5bac0714d5be6cade09ae74c2a3a

                                                              SHA256

                                                              76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

                                                              SHA512

                                                              be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              2158881817b9163bf0fd4724d549aed4

                                                              SHA1

                                                              c500f2e8f47a11129114ee4f19524aee8fecc502

                                                              SHA256

                                                              650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

                                                              SHA512

                                                              f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              03b664bd98485425c21cdf83bc358703

                                                              SHA1

                                                              0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

                                                              SHA256

                                                              fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

                                                              SHA512

                                                              4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              31a29061e51e245f74bb26d103c666ad

                                                              SHA1

                                                              271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

                                                              SHA256

                                                              56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

                                                              SHA512

                                                              f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              da6cd2483ad8a21e8356e63d036df55b

                                                              SHA1

                                                              0e808a400facec559e6fbab960a7bdfaab4c6b04

                                                              SHA256

                                                              ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

                                                              SHA512

                                                              06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              9e62fc923c65bfc3f40aaf6ec4fd1010

                                                              SHA1

                                                              8f76faff18bd64696683c2a7a04d16aac1ef7e61

                                                              SHA256

                                                              8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

                                                              SHA512

                                                              c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              10c429eb58b4274af6b6ef08f376d46c

                                                              SHA1

                                                              af1e049ddb9f875c609b0f9a38651fc1867b50d3

                                                              SHA256

                                                              a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

                                                              SHA512

                                                              d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              5c026fd6072a7c5cf31c75818cddedec

                                                              SHA1

                                                              341aa1df1d034e6f0a7dff88d37c9f11a716cae6

                                                              SHA256

                                                              0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

                                                              SHA512

                                                              f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              189ba063d1481528cbd6e0c4afc3abaa

                                                              SHA1

                                                              40bdd169fcc59928c69eea74fd7e057096b33092

                                                              SHA256

                                                              c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

                                                              SHA512

                                                              ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              18aaaf5ffcdd21b1b34291e812d83063

                                                              SHA1

                                                              aa9c7ae8d51e947582db493f0fd1d9941880429f

                                                              SHA256

                                                              1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

                                                              SHA512

                                                              4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              1514d082b672b372cdfb8dd85c3437f1

                                                              SHA1

                                                              336a01192edb76ae6501d6974b3b6f0c05ea223a

                                                              SHA256

                                                              3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

                                                              SHA512

                                                              4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              8958371646901eac40807eeb2f346382

                                                              SHA1

                                                              55fb07b48a3e354f7556d7edb75144635a850903

                                                              SHA256

                                                              b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

                                                              SHA512

                                                              14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

                                                              Filesize

                                                              5KB

                                                              MD5

                                                              7e1d15fc9ba66a868c5c6cb1c2822f83

                                                              SHA1

                                                              bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

                                                              SHA256

                                                              fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

                                                              SHA512

                                                              0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              202b825d0ef72096b82db255c4e747fa

                                                              SHA1

                                                              3a3265e5bbaa1d1b774195a3858f29cea75c9e75

                                                              SHA256

                                                              3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

                                                              SHA512

                                                              e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              7913f3f33839e3af9e10455df69866c2

                                                              SHA1

                                                              15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

                                                              SHA256

                                                              05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

                                                              SHA512

                                                              534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              58e0fcbee3cca4ef61b97928cfe89535

                                                              SHA1

                                                              1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

                                                              SHA256

                                                              c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

                                                              SHA512

                                                              99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              9b0b0e82f753cc115d87c7199885ad1b

                                                              SHA1

                                                              5743a4ab58684c1f154f84895d87f000b4e98021

                                                              SHA256

                                                              0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

                                                              SHA512

                                                              b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              eb8926608c5933f05a3f0090e551b15d

                                                              SHA1

                                                              a1012904d440c0e74dad336eac8793ac110f78f8

                                                              SHA256

                                                              2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

                                                              SHA512

                                                              9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              6367f43ea3780c4ee166454f5936b1a8

                                                              SHA1

                                                              027a2c24c8320458c49cd78053f586cb4d94ee6f

                                                              SHA256

                                                              f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

                                                              SHA512

                                                              31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              e04ad6c236b6c61fc53e2cb57ced87e8

                                                              SHA1

                                                              e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

                                                              SHA256

                                                              08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

                                                              SHA512

                                                              0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              56dcf7b68f70826262a6ffaffe6b1c49

                                                              SHA1

                                                              12e4272ba0e4eabc610670cdc6941f942da1eb6a

                                                              SHA256

                                                              948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

                                                              SHA512

                                                              c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              66456d2b1085446a9f2dbd9e4632754b

                                                              SHA1

                                                              8da6248b57e5c2970d853b8d21373772a34b1c28

                                                              SHA256

                                                              c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

                                                              SHA512

                                                              196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              b2248784049e1af0c690be2af13a4ef3

                                                              SHA1

                                                              aec7461fa46b7f6d00ff308aa9d19c39b934c595

                                                              SHA256

                                                              4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

                                                              SHA512

                                                              f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              194a73f900a3283da4caa6c09fefcb08

                                                              SHA1

                                                              a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

                                                              SHA256

                                                              5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

                                                              SHA512

                                                              25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              53f7e8ac1affb04bf132c2ca818eb01e

                                                              SHA1

                                                              bffc3e111761e4dc514c6398a07ffce8555697f6

                                                              SHA256

                                                              488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

                                                              SHA512

                                                              c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

                                                              Filesize

                                                              4KB

                                                              MD5

                                                              29f9a5ab4adfae371bf980b82de2cb57

                                                              SHA1

                                                              6f7ef52a09b99868dd7230f513630ffe473eddf8

                                                              SHA256

                                                              711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

                                                              SHA512

                                                              543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

                                                            • C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              cadd7a2f359b22580bdd6281ea23744d

                                                              SHA1

                                                              e82e790a7561d0908aee8e3b1af97823e147f88b

                                                              SHA256

                                                              3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

                                                              SHA512

                                                              53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                              Filesize

                                                              152B

                                                              MD5

                                                              c0a1774f8079fe496e694f35dfdcf8bc

                                                              SHA1

                                                              da3b4b9fca9a3f81b6be5b0cd6dd700603d448d3

                                                              SHA256

                                                              c041da0b90a5343ede7364ccf0428852103832c4efa8065a0cd1e8ce1ff181cb

                                                              SHA512

                                                              60d9e87f8383fe3afa2c8935f0e5a842624bb24b03b2d8057e0da342b08df18cf70bf55e41fa3ae54f73bc40a274cf6393d79ae01f6a1784273a25fa2761728b

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                              Filesize

                                                              152B

                                                              MD5

                                                              e11c77d0fa99af6b1b282a22dcb1cf4a

                                                              SHA1

                                                              2593a41a6a63143d837700d01aa27b1817d17a4d

                                                              SHA256

                                                              d96f9bfcc81ba66db49a3385266a631899a919ed802835e6fb6b9f7759476ea0

                                                              SHA512

                                                              c8f69f503ab070a758e8e3ae57945c0172ead1894fdbfa2d853e5bb976ed3817ecc8f188eefd5092481effd4ef650788c8ff9a8d9a5ee4526f090952d7c859f3

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                              Filesize

                                                              3KB

                                                              MD5

                                                              4c910820ce4245c3ad91afd60f0c7b6b

                                                              SHA1

                                                              3513b80995107c1000616d1840ba8272d01dc7b9

                                                              SHA256

                                                              ff37ae33a3bca9e9735f9e6f41c9a48ea50ff8a4306fa5d21ab4a291492ea230

                                                              SHA512

                                                              628b6d1ed47b1a0094dcb8336ec06054bcac1f8a1a81547744a563cebab2c1924b7752c49cc62759db8f3b7c77ddbc88a382accd9fb40375546d180ab734ef17

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                              Filesize

                                                              2KB

                                                              MD5

                                                              e80c43824d61d9b27a0b775d952df84e

                                                              SHA1

                                                              b7395cfda85329710694178012892017aecfd654

                                                              SHA256

                                                              3b7528451c3fb33a9d7356c66042e0503f466314eaeb59912112a01cefd702bc

                                                              SHA512

                                                              2d7183bb9ec422e775e5dde129376d083b56bef5f2488038b296c4ccf5b81b1bb2f865db4577724a63f8252473537f882f5c445f717692e0d414679655ef7237

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                              Filesize

                                                              2KB

                                                              MD5

                                                              acb37b871fe711558c654c051d425180

                                                              SHA1

                                                              b6b025f8c2dbf6c0d53e95e0188403bb93d9268d

                                                              SHA256

                                                              0e4e8a38855398e5951f0613954c1c0800f70b22fbfc907706f6b4934b147cec

                                                              SHA512

                                                              43ac2b02a84bcec878191a98bc806e56bdf9271615b839bd575dc0c585b700b467ee158031e41aee96b43f6eafc441d87c895f0b160e1328cbfc13ca32baa2c8

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                              Filesize

                                                              3KB

                                                              MD5

                                                              6d3d445df03366d290db692f9908ad96

                                                              SHA1

                                                              b9f151bb486c41ed00845973cf9779bbfb8a4cb1

                                                              SHA256

                                                              46a322b6fb191fbffe7e50d94d380015d7e36cb8d92e0d987fd35e8f2a5af5b7

                                                              SHA512

                                                              401f829aba9bd6cb5c5feb46d3be45ec1c978a50fe61922d3486e797a509c88c46973ef93545bcf16378d0edc6c01aad8dd0a1607460d77d0e8c521374cdc413

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                              Filesize

                                                              3KB

                                                              MD5

                                                              f551b49790304517d89b0d10cc9bf584

                                                              SHA1

                                                              c9f9b3ed350b493d2d44c214972048b716bd38a7

                                                              SHA256

                                                              d1e4b44e6fba81a6970e123a115940d0208f31ba7575a200aa850362e2ee2f68

                                                              SHA512

                                                              25070c75b5596aafe361af13dc576ba5c9f511015b2fd90ec7ab467b8cd5de04c34d7c169d76a3469dc939b60b7489eb45085fae73e4e0677809d62318b57d41

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              8KB

                                                              MD5

                                                              7a652c7feb46bad1816133f4303accf2

                                                              SHA1

                                                              ed3b218e7e28ad3ef3a5d9df44f11e0420c8adec

                                                              SHA256

                                                              c5967297e0ca4ed5c92f0497c35def4ab98c1987e0486c959898fd2279ea805a

                                                              SHA512

                                                              f3b9aa2c52b613b778934779db9a53ad24fd409dbbc84a2fe4e05f06b7483053959114acbf3bba721ad9f58d6108c57d0dd168ba1911e7aff0e52437bceece57

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              5KB

                                                              MD5

                                                              a07c9b32214750cbe4786cd275914025

                                                              SHA1

                                                              5b1aa164761f01d30ae504c25d920481b172cae2

                                                              SHA256

                                                              2f24b797a008eda47f6d4a33da0f5afad5be2fb27ea6c6741e38f5621f52bee7

                                                              SHA512

                                                              a7341a634d7a0f5b82e4ca259f4f575b6c99c71e26426532f5eae02d411988e8169ecbc6f4148a54caca3062f8ae0b0f58effe29ff060cb9e21aa4ed63f60b3e

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              6KB

                                                              MD5

                                                              acd16fb4db72fad05dc91bacddb0328b

                                                              SHA1

                                                              53d5a1281cb614d3d216d9558661564d6766b940

                                                              SHA256

                                                              80166574d0c13e3239333557fa295402196cd4151913932d697316eac4f52c99

                                                              SHA512

                                                              67587360c4588b66cccec4b62871b6f370546769813cddb420b3eac92f042079cb8c08bec83fa89c4af3bfa58826ae1549eae5ca157494a4ed48f19a9f501114

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              148ada02eb5213db3785c5bd402a432e

                                                              SHA1

                                                              649ad9401906257f81b1a85b1b5a3a9a3704b6b3

                                                              SHA256

                                                              3471c21df56c376157624e0f1ff8963311e06317d225257de33e46e498571f78

                                                              SHA512

                                                              eba8560f6e416c293f0d1898046900064cb2957be8933c0d89dc6ef8dc6065cbd32967dd2bdf47341837b6f9e2a65270dbe834ed5c293a122f5dff2fe29d5a0d

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                              Filesize

                                                              7KB

                                                              MD5

                                                              d1b7070e7953b972ffa8afb796182e00

                                                              SHA1

                                                              a98c32df504d961efc6dc071b2cf7df30af807d2

                                                              SHA256

                                                              5eb5fe22cc9a1377e0f074f2fbdd66423a3b7df1c8558067d12a342f91a8275d

                                                              SHA512

                                                              9101ee76d3512b92b3e326dc60ec6e28ed2e27f9d2a8dd389fb9b18a9b9f31fc40885ea9b22f285070770784b3cc5168ca4249691f1f897000d9d2830aaecb85

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              751d19aedfe46241a127bcfe0edd7565

                                                              SHA1

                                                              cb64097ccd86b9f426a89435886a9ababe582b11

                                                              SHA256

                                                              d166af2bfddacac694e5ce04e60bceb20665c1fcc2101660ac8be20ec9d1ac4e

                                                              SHA512

                                                              19b196862d6979221cca1ba9ed489d5d0290159cf7de18feb28b2dc8783b2ea0af927477869c825b5c6063f41a3d83048720793a6d6f74039016ad1fd8ce7957

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              b3cac67f1abed721c40a035364d7226c

                                                              SHA1

                                                              b5e9d44f7d999152ccd19ec522225d82e3c8e086

                                                              SHA256

                                                              0f75b23a205b083552f3c181220bcc5cd87de9f5917381c8ba2f266181b67f01

                                                              SHA512

                                                              3e381bb62c9ee45c7fdcc4db0a7b9c785b36108099b97b12bc4d16eec24d7b174ee8d4e3bd5620a3c6658693fd9cadb89bdfb8c67f5462ae6baed978edbe868a

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              a4d18c5819f101bb6182dc0e1c584902

                                                              SHA1

                                                              3fb6771d4b10cc6bcbbde5fdf2c32b11609a4555

                                                              SHA256

                                                              756359d1e5373a786ef0a5a6a6db0356699d8101e0963484b4e454366fa05236

                                                              SHA512

                                                              7aaa14c65f4196bc31b44a96f8fe93b38b02516b21f9f6ca057d616a7412fc1ee52d2554548169fc86150ba8c76684d294494a9061fa6e8b7012fa1ea44f1d0f

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5829ab.TMP

                                                              Filesize

                                                              372B

                                                              MD5

                                                              4c5d94d28847355106fa99c184eea29b

                                                              SHA1

                                                              6bdeeb8c6397719e9ab7558fa0ad0a3d5360f462

                                                              SHA256

                                                              297f56ff7d0da6a73ded9fe3acb62ca34dd158b8f5ee966e089d897313a88ad7

                                                              SHA512

                                                              31c7900b411ab54eef8396eb2a77dfcc9e4dc3be2df3825f5634d9663e10db8eddafb866d083913b0d4b7a15271aa12c6a9eb4519987b99523adf75efa4c095e

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                              Filesize

                                                              16B

                                                              MD5

                                                              6752a1d65b201c13b62ea44016eb221f

                                                              SHA1

                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                              SHA256

                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                              SHA512

                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                              Filesize

                                                              11KB

                                                              MD5

                                                              61f4149b6a1c7d01d603a101c0113db0

                                                              SHA1

                                                              096041dc5eaeaebb3697e9ef136e948e56fffa16

                                                              SHA256

                                                              bad951abd8ff782536be1f02d9027e4b055f4d64678c4ba286f3d03522e5a6f0

                                                              SHA512

                                                              5e4fe5ee1a4a52b65e5e7e7c6cbde6bd93f11ec33819cf2ba8aa810ad79ab9b71c82b0573eed33fd9fe053aab66c5cd6f4421cf69f27e49a4dc58ed057a5f370

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                              Filesize

                                                              11KB

                                                              MD5

                                                              9c255614d6706ddcebac61e3ac074508

                                                              SHA1

                                                              c4d2b69486d9b4ecd18ea8c85da220dbf4e217c3

                                                              SHA256

                                                              ab42f6bf6ea5386f924a0db8d64240df00b153ffddc1ae321f0bcf5b70eb092d

                                                              SHA512

                                                              e0d3596192853026673453a316868f6a0c3deec7fc96fcb987c8842de79edcf376b561d8ee66ae797726c598ce533e7b841dd26b73e1815e0e2bea53f6245997

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                              Filesize

                                                              11KB

                                                              MD5

                                                              e24c15bf941f1b937324f104fe4157fc

                                                              SHA1

                                                              a7c8da4a62c6bf50834d1f15087faa128715fd36

                                                              SHA256

                                                              027f1c3206c8120a68e4b21bd55a13f8e0b58e28f3353d83714ef36b076f58ea

                                                              SHA512

                                                              b96dfabad4f531e3a2f5e620821f975912f02560f73c157a787f0b7b5d805bc282ab81ba2c20f9593566d02d3a3ac59f8c4092b69e30afe3bf08fdd3dc4c4beb

                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                              Filesize

                                                              10KB

                                                              MD5

                                                              d33a9011a19b32db8f66ad4ce6d0fa94

                                                              SHA1

                                                              4084f12d77fac7b505abbd2185dcb8ebcd66a655

                                                              SHA256

                                                              eb6db5f1355dd2a8a0fb7189a39c14ffd67bb015c856960275635c8605e9c74e

                                                              SHA512

                                                              0ffa5189ffcde4da4e3846651414b4c2b03abea3b02c42fa9d6da7a619d01bedc651f864ebd33f63b39f6d78b42a0607ac04b5fdca92681646e7d63c5d469e38

                                                            • C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

                                                              Filesize

                                                              8KB

                                                              MD5

                                                              cf89d16bb9107c631daabf0c0ee58efb

                                                              SHA1

                                                              3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                                              SHA256

                                                              d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                                              SHA512

                                                              8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                                            • C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_1

                                                              Filesize

                                                              264KB

                                                              MD5

                                                              d0d388f3865d0523e451d6ba0be34cc4

                                                              SHA1

                                                              8571c6a52aacc2747c048e3419e5657b74612995

                                                              SHA256

                                                              902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                                              SHA512

                                                              376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                                            • C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

                                                              Filesize

                                                              8KB

                                                              MD5

                                                              0962291d6d367570bee5454721c17e11

                                                              SHA1

                                                              59d10a893ef321a706a9255176761366115bedcb

                                                              SHA256

                                                              ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                                              SHA512

                                                              f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                                            • C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

                                                              Filesize

                                                              8KB

                                                              MD5

                                                              41876349cb12d6db992f1309f22df3f0

                                                              SHA1

                                                              5cf26b3420fc0302cd0a71e8d029739b8765be27

                                                              SHA256

                                                              e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                                              SHA512

                                                              e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                                            • C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\CURRENT

                                                              Filesize

                                                              16B

                                                              MD5

                                                              46295cac801e5d4857d09837238a6394

                                                              SHA1

                                                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                              SHA256

                                                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                              SHA512

                                                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                            • C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\MANIFEST-000001

                                                              Filesize

                                                              41B

                                                              MD5

                                                              5af87dfd673ba2115e2fcf5cfdb727ab

                                                              SHA1

                                                              d5b5bbf396dc291274584ef71f444f420b6056f1

                                                              SHA256

                                                              f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                              SHA512

                                                              de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                            • C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

                                                              Filesize

                                                              300B

                                                              MD5

                                                              e41d48dc2e8f479f0c627592301c5347

                                                              SHA1

                                                              b96540523e8ba3d6dbcd734b0b2aee6057a37ac4

                                                              SHA256

                                                              ab99298a4290a430d6f104bc4715c8ffa2d51963356eef0312c67f3aaf1a790f

                                                              SHA512

                                                              7d597d12622256f879c85ce194bcf178f1ce5246d987407c852a038df56cae7690e80174bbea5cc4429caca1fefab2645f0aba2d204f651e9ae5897e57a87c79

                                                            • C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe5a6e3c.TMP

                                                              Filesize

                                                              59B

                                                              MD5

                                                              2800881c775077e1c4b6e06bf4676de4

                                                              SHA1

                                                              2873631068c8b3b9495638c865915be822442c8b

                                                              SHA256

                                                              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                              SHA512

                                                              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                            • C:\Users\Admin\AppData\Local\Temp\nsyE6A4.tmp\StdUtils.dll

                                                              Filesize

                                                              110KB

                                                              MD5

                                                              db11ab4828b429a987e7682e495c1810

                                                              SHA1

                                                              29c2c2069c4975c90789dc6d3677b4b650196561

                                                              SHA256

                                                              c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

                                                              SHA512

                                                              460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

                                                            • C:\Users\Admin\AppData\Local\Temp\nsyE6A4.tmp\System.dll

                                                              Filesize

                                                              22KB

                                                              MD5

                                                              a36fbe922ffac9cd85a845d7a813f391

                                                              SHA1

                                                              f656a613a723cc1b449034d73551b4fcdf0dcf1a

                                                              SHA256

                                                              fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

                                                              SHA512

                                                              1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

                                                            • C:\Users\Admin\AppData\Local\Temp\nsyE6A4.tmp\modern-wizard.bmp

                                                              Filesize

                                                              150KB

                                                              MD5

                                                              3614a4be6b610f1daf6c801574f161fe

                                                              SHA1

                                                              6edee98c0084a94caa1fe0124b4c19f42b4e7de6

                                                              SHA256

                                                              16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

                                                              SHA512

                                                              06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

                                                            • C:\Users\Admin\AppData\Local\Temp\nsyE6A4.tmp\nsDialogs.dll

                                                              Filesize

                                                              20KB

                                                              MD5

                                                              4e5bc4458afa770636f2806ee0a1e999

                                                              SHA1

                                                              76dcc64af867526f776ab9225e7f4fe076487765

                                                              SHA256

                                                              91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

                                                              SHA512

                                                              b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

                                                            • C:\Users\Admin\AppData\Local\Temp\nsyE6A4.tmp\nsExec.dll

                                                              Filesize

                                                              17KB

                                                              MD5

                                                              2095af18c696968208315d4328a2b7fe

                                                              SHA1

                                                              b1b0e70c03724b2941e92c5098cc1fc0f2b51568

                                                              SHA256

                                                              3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

                                                              SHA512

                                                              60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

                                                            • C:\Users\Admin\AppData\Local\Temp\nsyE6A4.tmp\nsProcess.dll

                                                              Filesize

                                                              15KB

                                                              MD5

                                                              08072dc900ca0626e8c079b2c5bcfcf3

                                                              SHA1

                                                              35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

                                                              SHA256

                                                              bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

                                                              SHA512

                                                              8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

                                                            • C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier

                                                              Filesize

                                                              26B

                                                              MD5

                                                              fbccf14d504b7b2dbcb5a5bda75bd93b

                                                              SHA1

                                                              d59fc84cdd5217c6cf74785703655f78da6b582b

                                                              SHA256

                                                              eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                              SHA512

                                                              aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                            • C:\Users\Admin\Downloads\Unconfirmed 505888.crdownload

                                                              Filesize

                                                              2.3MB

                                                              MD5

                                                              1b54b70beef8eb240db31718e8f7eb5d

                                                              SHA1

                                                              da5995070737ec655824c92622333c489eb6bce4

                                                              SHA256

                                                              7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

                                                              SHA512

                                                              fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

                                                            • C:\Users\Admin\Downloads\Unconfirmed 919692.crdownload

                                                              Filesize

                                                              978KB

                                                              MD5

                                                              bbf15e65d4e3c3580fc54adf1be95201

                                                              SHA1

                                                              79091be8f7f7a6e66669b6a38e494cf7a62b5117

                                                              SHA256

                                                              c9f2e2abb046ff2535537182edf9a9b748aa10a22e98a1d8c948d874f4ffb304

                                                              SHA512

                                                              9bb261b4ed84af846e07ffb6352960687e59428fd497faa0a37d70b57a1a7430d48ac350fbb0c3f0f11e4231a98ebca4d6923deba0949fdd7a247a3c02737355

                                                            • \??\pipe\LOCAL\crashpad_2800_MSBRERLZAGVSIGTI

                                                              MD5

                                                              d41d8cd98f00b204e9800998ecf8427e

                                                              SHA1

                                                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                              SHA256

                                                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                              SHA512

                                                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                            • memory/524-12899-0x0000000000DD0000-0x0000000001282000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                            • memory/11464-13039-0x000000006E610000-0x000000006F950000-memory.dmp

                                                              Filesize

                                                              19.2MB

                                                            • memory/12264-12950-0x00007FFBA74D0000-0x00007FFBA74D1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/12264-12949-0x00007FFBA7F50000-0x00007FFBA7F51000-memory.dmp

                                                              Filesize

                                                              4KB