6345a13c1eab921686d7ef594b6ac35e6e65839ac297795031014fbd9717508a

Analysis

max time kernel
455s
max time network
454s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
08-12-2024 00:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SWASetup.exe
Size

14KB
MD5

cd1436d99f11bc0382d6776f23c74831
SHA1

accc8e49ba85581de25288b9a461ae14b5554d91
SHA256

6345a13c1eab921686d7ef594b6ac35e6e65839ac297795031014fbd9717508a
SHA512

00374fa8dce13ce885714ab23b2d9111a8bb2194c17b5ccc6bd859aead6df36398fc2abed9d2840333e8a8dfa9f5da112e3a67a1141465300caad5b12c005493
SSDEEP

192:jgYX92TJJTcolI9FVigA6KtuY5AlF0o4Awh/b3B0OZnnWYlA8W2FCT1vT:Ls/aKu0AlFqAwFzSSWMQRt

Score

8^/10

steam discovery motw persistence phishing

Malware Config

Signatures

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: =@L
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	SWA V2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	SWASetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	SWA V2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Executes dropped EXE 18 IoCs

pid	Process
116	SWA V2.exe
32	SteamSetup.exe
1396	steamservice.exe
1760	steam.exe
2812	steam.exe
4352	steamwebhelper.exe
7948	steamwebhelper.exe
5996	steamwebhelper.exe
8032	steamwebhelper.exe
2508	gldriverquery64.exe
1048	steamwebhelper.exe
4192	steamwebhelper.exe
6176	gldriverquery.exe
7868	vulkandriverquery64.exe
7624	vulkandriverquery.exe
5992	SWA V2.exe
7192	steamwebhelper.exe
7884	steamwebhelper.exe

Loads dropped DLL 63 IoCs

pid	Process
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
7948	steamwebhelper.exe
7948	steamwebhelper.exe
7948	steamwebhelper.exe
2812	steam.exe
5996	steamwebhelper.exe
5996	steamwebhelper.exe
5996	steamwebhelper.exe
5996	steamwebhelper.exe
5996	steamwebhelper.exe
5996	steamwebhelper.exe
5996	steamwebhelper.exe
5996	steamwebhelper.exe
5996	steamwebhelper.exe
2812	steam.exe
8032	steamwebhelper.exe
8032	steamwebhelper.exe
8032	steamwebhelper.exe
2812	steam.exe
1048	steamwebhelper.exe
1048	steamwebhelper.exe
1048	steamwebhelper.exe
4192	steamwebhelper.exe
4192	steamwebhelper.exe
4192	steamwebhelper.exe
4192	steamwebhelper.exe
7192	steamwebhelper.exe
7192	steamwebhelper.exe
7192	steamwebhelper.exe
7884	steamwebhelper.exe
7884	steamwebhelper.exe
7884	steamwebhelper.exe
7884	steamwebhelper.exe
7884	steamwebhelper.exe
7884	steamwebhelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
546	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Detected potential entity reuse from brand STEAM.
phishing steam

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\steam_client_metrics.bin	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_trackpad_r_up_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\chatroom_locked.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_left_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_rstick_touch.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe5b1e42.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_r1_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\bin\cef\cef.win7x64\snapshot_blob.bin_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\btnDisBottom.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamclean_turkish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\platform_russian.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\joyconpair_left_sl_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_r5_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_color_outlined_button_circle_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\Steam.dll_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\friendsui_danish-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_portuguese.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_trackpad_r_ring_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_button_create_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_lstick_click_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\steampops_koreana-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_rstick_click.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_rtrackpad_right_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_button_share.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_dpad_down.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_r1_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\filter_banned_czech.txt.gz_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0511.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_030_inv_0110.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\emailreminder_close.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_buttons_w_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_button_capture.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_click_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_lstick_down_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\xbox_p2_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0426.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_controller_bpm_down.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\platform_vietnamese.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_button_share.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_trackpad.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_buttons_n_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_color_button_a_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\templates\controller_mobile_touch_relative_mouse.vdf_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_010_wpn_0414.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_045_move_0220.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\offline_indonesian.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_rt_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_click_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps_button_triangle_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_button_plus.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_dpad_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_lstick_down_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox_lt_soft_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_outlined_button_y_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\friend_join.wav_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_lstick_right_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_ltrackpad_click_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_l4_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_color_outlined_button_a_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_rstick_up.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_rtrackpad_down_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\submanagesecuritylock.res_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_r3.svg_	steam.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1142560196\manifest.fingerprint	steamwebhelper.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1142560196\LICENSE	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1142560196\manifest.json	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1142560196\_platform_specific\win_x64\widevinecdm.dll	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1142560196\_metadata\verified_contents.json	steamwebhelper.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4352_1142560196\_platform_specific\win_x64\widevinecdm.dll.sig	steamwebhelper.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SWA V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	SWA V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SWA V2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SWA V2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SWA V2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	SWA V2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133780908618457010"	chrome.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-2319007114-3335580451-2147236418-1000_Classes\steam\DefaultIcon	steamservice.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	steam.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1812	SWASetup.exe
2068	chrome.exe
2068	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
3340	chrome.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
32	SteamSetup.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe
2812	steam.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	steam.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1812	SWASetup.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe
Token: SeCreatePagefilePrivilege	2068	chrome.exe
Token: SeShutdownPrivilege	2068	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
2068	chrome.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
2068	chrome.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe
4352	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2812	steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 116	1812	SWASetup.exe	81
PID 1812 wrote to memory of 116	1812	SWASetup.exe	81
PID 2068 wrote to memory of 4696	2068	chrome.exe	86
PID 2068 wrote to memory of 4696	2068	chrome.exe	86
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 1104	2068	chrome.exe	87
PID 2068 wrote to memory of 404	2068	chrome.exe	88
PID 2068 wrote to memory of 404	2068	chrome.exe	88
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89
PID 2068 wrote to memory of 2560	2068	chrome.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SWASetup.exe
"C:\Users\Admin\AppData\Local\Temp\SWASetup.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\GFK\SWAv2\SWA V2.exe
  "C:\GFK\SWAv2\SWA V2.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Enumerates system info in registry
  PID:116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd4c0acc40,0x7ffd4c0acc4c,0x7ffd4c0acc58
  2⤵
  PID:4696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  PID:404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2264,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4544,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4752,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4736,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  - Drops file in Windows directory
  PID:2396
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff7f5124698,0x7ff7f51246a4,0x7ff7f51246b0
    3⤵
    - Drops file in Windows directory
    PID:416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4952,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4560,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5164,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3884,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5372,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5472 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4416,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3848,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5312,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5208,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3220,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5812,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5864,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5896,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6044,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3188 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3184,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5204,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5888,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:2304
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:32
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5648,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=5380,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1104 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6708,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6860,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6664,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6800,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=6832,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6788,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6632,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6608,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6488 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=6872,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=6584,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=5668,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6464,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=6280,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=6332,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=6728,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=7204,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=7224,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=7276,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=7292,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=7768,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=7820,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7936 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=7964,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8064 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=8428,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8440 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=8392,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=8568,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=7824,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8456 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=8748,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8712 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=8844,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8860 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=8732,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8584 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=9340,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9304 /prefetch:1
  2⤵
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=9316,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9200 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=9612,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9604 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=9620,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=9876,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9916 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=10064,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9900 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=9656,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9892 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=9872,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10372 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=10528,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10512 /prefetch:1
  2⤵
  PID:6428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=10056,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10520 /prefetch:1
  2⤵
  PID:6436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=10780,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10804 /prefetch:1
  2⤵
  PID:6544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=10848,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10820 /prefetch:1
  2⤵
  PID:6552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=11048,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11060 /prefetch:1
  2⤵
  PID:6560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=10104,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11216 /prefetch:1
  2⤵
  PID:6712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=10656,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11388 /prefetch:1
  2⤵
  PID:6720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=10768,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11396 /prefetch:1
  2⤵
  PID:6728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=10544,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11636 /prefetch:1
  2⤵
  PID:6888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=11692,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11796 /prefetch:1
  2⤵
  PID:6896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=10400,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11820 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=11368,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11940 /prefetch:1
  2⤵
  PID:7132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --field-trial-handle=12056,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=12184 /prefetch:1
  2⤵
  PID:7140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --field-trial-handle=12224,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=12172 /prefetch:1
  2⤵
  PID:7148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=12240,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=12364 /prefetch:1
  2⤵
  PID:7156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --field-trial-handle=12256,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=12492 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --field-trial-handle=12760,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=12752 /prefetch:1
  2⤵
  PID:7220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --field-trial-handle=12780,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=12792 /prefetch:1
  2⤵
  PID:7228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --field-trial-handle=12768,i,1791351482548428098,15501678592402672984,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=12756 /prefetch:1
  2⤵
  PID:7440

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1228

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:1760
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2812
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=2812" "-buildid=1733265492" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4352
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1733265492 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffd48bfaf00,0x7ffd48bfaf0c,0x7ffd48bfaf18
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7948
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1576,i,12476879154648143722,6345335315038354503,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1580 --mojo-platform-channel-handle=1568 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5996
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2384,i,12476879154648143722,6345335315038354503,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2388 --mojo-platform-channel-handle=2380 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:8032
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2696,i,12476879154648143722,6345335315038354503,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2700 --mojo-platform-channel-handle=2692 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1048
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,12476879154648143722,6345335315038354503,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3136 --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4192
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=3724,i,12476879154648143722,6345335315038354503,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3788 --mojo-platform-channel-handle=3740 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7192
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3836,i,12476879154648143722,6345335315038354503,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3912 --mojo-platform-channel-handle=3808 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:7884
- - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:2508
- - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6176
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:7868
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7624

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x504
1⤵
PID:7196

C:\GFK\SWAv2\SWA V2.exe
"C:\GFK\SWAv2\SWA V2.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
PID:5992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\GFK\SWAv2\Guna.UI2.dll

Filesize
2.1MB

MD5
b429ae86c5be521bc8ca3b164cec3acb

SHA1
387560073ff5a1f2191abc6f75fc34532bbb6dd2

SHA256
3ac70532408b89159bfe235d4ed228faa03ae3fbd63ec6a82d895f287a3b0579

SHA512
eae65de53da50708983ed8ebf9e1e3dd5f9aea95a354d272e199bb59517f62bfe35f0df7a37d81ab0423d0d6d29304fa70284c731bd54023e446b2c19bacafb1

Download Submit
C:\GFK\SWAv2\Newtonsoft.Json.dll

Filesize
695KB

MD5
adf3e3eecde20b7c9661e9c47106a14a

SHA1
f3130f7fd4b414b5aec04eb87ed800eb84dd2154

SHA256
22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07

SHA512
6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b

Download Submit
C:\GFK\SWAv2\SWA V2.dll

Filesize
703KB

MD5
1b28ea289d5cb7121ecad75adffecd78

SHA1
5efa3e1113d38a1c7e07ef98b8db23f2759770a5

SHA256
b06b86806b4bd0f2efbb0d6e660c52e09c80756a39e9a96e8c0f0f57e99f6b4d

SHA512
3bc258594acbacd509576ecb8c502e38da5a6984842e8e4543f23cb85dd691f865c0d61a1de345224351ac04d728a9c7e4e3651a9d7f8e8648be2f56c8dfe314

Download Submit
C:\GFK\SWAv2\SWA V2.exe

Filesize
396KB

MD5
8f59bec096bbf55c0934f97475394cca

SHA1
2f0a0fd2408c388ff740df2e6eb0a4ae3589ef33

SHA256
4c3e50b52c48e6e3a6caaf490c84e7e811ecea7b39e63834ea3906c89efebae4

SHA512
6364c0c820e7dd3782aa662b138093ab47c9525b19fe81527d12b2ed9f790ca4922610d22ea50a75022cfe2e07b4859576c5dad6205b8d27cec4118b2141607d

Download Submit
C:\GFK\SWAv2\SWA V2.runtimeconfig.json

Filesize
386B

MD5
186a65581e2f29258f54d396660409fa

SHA1
6f998d3be2e85cb5419205f867135874f27c0a3a

SHA256
e1e0974d0e8833375024eb7c78521b3b5cad4228aad22b23d506cbe702445844

SHA512
7dea87b523aab01ea3c794779b71bc0b52179e1d5e7b9a45539ddd39c775969ef22853c4c193699aec1e3fa3cbe26e90e3a4881226c52a3aacae1eac260ff896

Download Submit
C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.2MB

MD5
33bcb1c8975a4063a134a72803e0ca16

SHA1
ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

SHA256
12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

SHA512
13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.5MB

MD5
ba0ea9249da4ab8f62432617489ae5a6

SHA1
d8873c5dcb6e128c39cf0c423b502821343659a7

SHA256
ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

SHA512
52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
6e6a2b18264504cc084caa3ad0bfc6ae

SHA1
b177d719bd3c1bc547d5c97937a584b8b7d57196

SHA256
f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

SHA512
74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
19KB

MD5
76c537278c0b374e6cd27f60f9792fea

SHA1
6cb4688acc161ca60d63589e4ac09bb11364c804

SHA256
1abe5be3dee02a524388e924682004ed3295f705971e0af017411136cfb44967

SHA512
7b08694bf3145e8cae5146dadeaee5ed7292e529802f981daf1ddad5582f7eecea4c962426168a9b4e174703e8e69faad38608514e630ef0756ff73d87efcddf

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
17KB

MD5
10860500d3932530160332ef9c7c7512

SHA1
85271cd70ded97ec68c316009b9125cb6c25df0d

SHA256
0b65583b57b136062e46ccc100243f4be526f084915e2a8589c43b6208277cf7

SHA512
28b5368a5406f5a29909f6ca23f3668d6d90004cb2e582b598e1b6bb14fd02e6bba676f253e3ce6afaecaec71a22d97762607a4a80aaa9e24d7fdcaa8fdf5631

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
a2ec2e91c3ef8c42e22c4887d032b333

SHA1
e2c738a2e9400535b74e2263c7e7d1ecefe575f2

SHA256
8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

SHA512
b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
17KB

MD5
37039e32ba882fc601df772565a2af5f

SHA1
f26add62612baea2d96234e7ab21bea515df28f1

SHA256
3ab87dfe4f6c392c7c51f9e4a244ba8963864c409cfc393653f767f4bf643cb5

SHA512
1ee562a8d69738cb7f855d8a13dbe8062c8f03871c7a6c6cf2b22d719c68088e18a06425a331f51d89be231acd2ddc0b8403c3ffebb65fafc598a6a1e9dd531f

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf~RFe5b1e42.TMP

Filesize
184B

MD5
3cdebc58a05cdd75f14e64fb0d971370

SHA1
edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe

SHA256
661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7

SHA512
289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
0340d1a0bbdb8f3017d2326f4e351e0a

SHA1
90d078e9f732794db5b0ffeb781a1f2ed2966139

SHA256
0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

SHA512
9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
4c81277a127e3d65fb5065f518ffe9c2

SHA1
253264b9b56e5bac0714d5be6cade09ae74c2a3a

SHA256
76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

SHA512
be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
2158881817b9163bf0fd4724d549aed4

SHA1
c500f2e8f47a11129114ee4f19524aee8fecc502

SHA256
650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

SHA512
f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
9e62fc923c65bfc3f40aaf6ec4fd1010

SHA1
8f76faff18bd64696683c2a7a04d16aac1ef7e61

SHA256
8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

SHA512
c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
10c429eb58b4274af6b6ef08f376d46c

SHA1
af1e049ddb9f875c609b0f9a38651fc1867b50d3

SHA256
a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

SHA512
d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
5c026fd6072a7c5cf31c75818cddedec

SHA1
341aa1df1d034e6f0a7dff88d37c9f11a716cae6

SHA256
0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

SHA512
f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
189ba063d1481528cbd6e0c4afc3abaa

SHA1
40bdd169fcc59928c69eea74fd7e057096b33092

SHA256
c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

SHA512
ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

Filesize
4KB

MD5
1514d082b672b372cdfb8dd85c3437f1

SHA1
336a01192edb76ae6501d6974b3b6f0c05ea223a

SHA256
3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

SHA512
4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
202b825d0ef72096b82db255c4e747fa

SHA1
3a3265e5bbaa1d1b774195a3858f29cea75c9e75

SHA256
3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

SHA512
e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
58e0fcbee3cca4ef61b97928cfe89535

SHA1
1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

SHA256
c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

SHA512
99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
b8ac05af5ee5cd566a6240810709375e

SHA1
41c4b4c4b56137ed1b9f086b45f7e0e6f0ab5940

SHA256
b7e212004c17a1ec0c8fe5dd5d5268912f534897dafc3c477616aa55eb4b7cd2

SHA512
9d35fb150e3257615d29c5a1528367b42a34ac417e149199164e97ec01a10da3cc7001043d89169dcfd69ef4bcdd6bbfd4350e5cf6774c17230312a58977e2f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
41KB

MD5
e319c7af7370ac080fbc66374603ed3a

SHA1
4f0cd3c48c2e82a167384d967c210bdacc6904f9

SHA256
5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

SHA512
4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

Filesize
67KB

MD5
2bb65a336dae234072989a27ea92bbf0

SHA1
908a3d350236ba2ba4124889f3a5c8988c3bfc07

SHA256
583a62be35331d48627b7f0351898668be3e06f42a34821417172b0be9675b18

SHA512
8f0abeb9296a3c57ae0479c1abd17d0ee6dbb6bc0b03960ea441d9dae0fba0b81d5aebace7e99570be5b01277468af414efcd6ee60a537d46bd6b0abae29b789

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000025

Filesize
19KB

MD5
8f661b8c2dc08d06a2992b1006fbf95d

SHA1
51f7614ee218ca027670a3bb0d7cfe1f23869602

SHA256
8bb39a6f700638d352b26ee0cb86fe5fd1127397dbc18d50a5bf37eb9ef6519a

SHA512
80789cf71769f1c03910535c610c942aa4be684433bcdff360ba309a6c15b3878920a49d1d1303c322de64f200b8e5d316b428b66668d51f9ddffaac0aa5f80f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

Filesize
24KB

MD5
b201e8da90ef456598b8b3bb0e31bf53

SHA1
8bb524c8e9b17920c83d9a06c0b305e41cfca560

SHA256
2c8b630d1edafb8cc8c8cd73fff10c8ab6d06232929a4d458ec34628920f1665

SHA512
50126ac5b7800f5a848ef49ebc8e71d78cb5ee9c1602486b30e697ce57af32c868e46795ac2c157cdfd7fe65c03133c7a752813d520a9106adc3e50620b473f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e

Filesize
40KB

MD5
0c9f37673dd9c878a4b5bb419ee24b5d

SHA1
d973a8e073c1f76068f0947d495998f7f823d76e

SHA256
c1e12f630e7f356d154ffe4a7a3873e7e136e41c1c37e6c0fa4d2c52f1d269dd

SHA512
b361afedb4a910b12f7dd7b5b33d2914be39528bf4d1486661d0107c24135cff3a5393df1af85cd7d1551f0e601ea9d2ad4b147e56f469691e2b11906fd1514c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000033

Filesize
17KB

MD5
a421438ebae11fcb4808982f78536c8e

SHA1
cb3287d6dc2557343cc2e4723f6bb5e5534ab075

SHA256
8d40f05f3d7b0c08cc959534185a4ec52963c06322e7c31dbf90266d9a0c6bfc

SHA512
5f6e88895377f671f867464313290d9cea0ccf4377ed74153c3fa745456ac35f9686fcf0a2e9643316c60f5bb677dfabe1ff408a56318c48e0f7853954abfe1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000044

Filesize
215KB

MD5
9c013a15985f3e3583ea9625c41a7074

SHA1
0639eb7361d5aad3790fc7acf860064aa15152bf

SHA256
aedda2807450df273d852aeb97634ca6761a060c4460caa97599ef667d351aea

SHA512
c54cece8fa10b2fd2c7d0ed712c643a96071e26b8d5094e62c6d7a1af4a138d7aca2d075034e7c81e9eebf2064d6f19db844b5023d135229e55201e7f771a82c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000045

Filesize
22KB

MD5
9d53309ac2415ed6efe77b43a5a2b2b6

SHA1
31d26e32f551242c037116da7fe1f039bd1c4b41

SHA256
31e667f7d809056c4199b4204f46dbc6cd118a97530308229bbb9d450c42f89f

SHA512
25510c4cd3ac3388a1c91b5011e12a34c409f272d8f7fbec1a89cbff45f2553f7061c1f63d1a2c06f8773b885bcabd9c96501434b8905778132fffef80989476

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000046

Filesize
168KB

MD5
32866d8b12e3bd7be607d583ccbcc5a7

SHA1
bc7ac961dc543ffe29e4733121c6d9ea9c7fb8f0

SHA256
cab589f6d9d34bf761ccb1e8779fe322e70c175729644ff88c54dfd83d156b08

SHA512
b482c93268020077555e855a2a6ddec0c50b2e7be6634c8ae2310b51a4c4c4b554af92630b26f0168173162433abccdcc73d7cdc268164da83c5c3861265d232

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000048

Filesize
66KB

MD5
5db1f7558c84d8cd37c708e86df35278

SHA1
ac64e57543f813330fc663bd223011a40148dc92

SHA256
cf1cd9ae7878038a960ed128636abe14c74121893eb72a9c9fb92d95a6bf5f3d

SHA512
457b082b07e402122460b33d1186641c994c5259be8b66263253e1d26e8429d134d4202b5405ab5f42564cc66cd6e7a78595e34ec2a2580915b6ab999da64d68

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000079

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008a

Filesize
99KB

MD5
3a03e2f204ccd8f60f9b0935cdfeb0d4

SHA1
942080d2665eb0b904013fbc0ceebc53d0b5ea6b

SHA256
b92ace4e3e0d72ad36bf32c25bfb17c03a03a8b11ed206b006316d00a2e84072

SHA512
d357d9ab4593745df52db2738b4afb3479f7914e20db08f8a478900d79428fefd35dd159e98085bbf8047163e303d423a894fafe4265216790b85be4929d1dc9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00008b

Filesize
313KB

MD5
a091165a59ce1b4054f89c4214b2692e

SHA1
69ed9202e1dcb4d916880cfdf6c47c4a6da8c6d5

SHA256
44453b6f600cc8494892f5596918e6635a45da236d4023a42f9c0cb067de5441

SHA512
e199fcd64e073b35b1107491f677ac7d731c686c5e5f481436c6518a8bca3e92f16addfbfdc1ff7352e9cc0520449f032cef2ad32b38fc80594d9d4279b386f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000b1

Filesize
67KB

MD5
bcfda9afc202574572f0247968812014

SHA1
80f8af2d5d2f978a3969a56256aace20e893fb3f

SHA256
7c970cd163690addf4a69faf5aea65e7f083ca549f75a66d04a73cb793a00f91

SHA512
508ca6011abb2ec4345c3b80bd89979151fee0a0de851f69b7aa06e69c89f6d8c3b6144f2f4715112c896c5b8a3e3e9cd49b05c9b507602d7f0d6b10061b17bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000b8

Filesize
20KB

MD5
23b3f4d735220a79b8f2784dcf44b86c

SHA1
bdbe725f8612e24e3a374323d710ffaa29c1881a

SHA256
41adef63ce6e21a9eff352187a11bda18d989101e7e6a48a3a51998c3e2726f6

SHA512
4158f39e9a82acb582fb2d58e69d7625dcf051649890d0c9cfa135459916698980b28305b9232ac29a408943066eeceb25ecc6a221e7871e8c9ecc4ef9827768

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ba

Filesize
32KB

MD5
e7eb40a17f017e7b0651dec263c01ffc

SHA1
26fea5c5c688b2ecf33bb6892c9905159b6d48d9

SHA256
afb8e284cacb33c4d52af3a501a871cf560e4ec94358761743c02f3a21cb1810

SHA512
d7af8ff7adb71dd5ed1620efd913673e108846e02a7775d012825357fa81ab28dde7bce06592256e9f9c2e91ede6a249a7e6bce91a392f6f7ac0b53ac3ca0123

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0346e514baa3eb7f_0

Filesize
235B

MD5
cbbabbbf5ba50b33a9c088fc01ba0073

SHA1
71d5daa079f293306f1f815570c0fa82ad5f3571

SHA256
6d3f92daa65b529046c3cfb1d9f4ba162110f896a7e50f5c498ac474b5b0220a

SHA512
45577b8880c00b615d7569ef97c3de0cdec270e07f398db32b95f868a466bf9bd5d12e0684916d07d318d670e44d4e4f193c61dab2752e8b2deab8af41478453

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\135a9e73b7a29232_0

Filesize
252B

MD5
8f1b4deac1ba930e0c8c72d43a112c71

SHA1
eb420151a60a208f5ff41fb9e4aa2dfc9367df76

SHA256
b0c6e1f9a7eea4a25fc7242577efdaaa7b33c4d0a32163e6457d0b8b6fa275e2

SHA512
4a8ea8e09a3b57d4019a79ae67075f710386b1b1d1be694194a9c170020d3bce7140ad3099d818d1cc704e62d8f5020cd493407e4aaff3ded9545cb1f70824d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\46f5dceee7b10fb7_0

Filesize
247B

MD5
db40b57cd06806c8b96cca1edebfbb2f

SHA1
875a2113de2d46b649dcc507da5f1f243669b35a

SHA256
2c09f87b9596fd28a3dcb9672c8b38e8cfb82f3762c4a361c19b3105115ef024

SHA512
343219ea7ca6e09bdc0aa6fd5f5e6b02fa17e888678f162291c39537fe93c815361b8e8dc5e316e7f856ad44a63f6b0ff55b3970a5181660752caf6fd81093c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b4e0e22908495ef7_0

Filesize
280B

MD5
30104098f59aa88c48ce7375e2fa0b7d

SHA1
96099ade6ec6490cbbbd6b051cfe9b64ba81397b

SHA256
8fd100f9400c454919070130609eff0bb3e4dd99a4e61ab571f2e635eea1f16d

SHA512
e88c1324528dce38d4eb6c977786a7d8eb1f56ff1b87e19ceaaaae1e8f1ed977f66bc2be2ced44e1319cd2bfa0a3c2cc3fe48f404e4917ec117c9d66c8f11f16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
513d47981918e7ff1ce5ad139dc1cf5c

SHA1
a65e0466be19d1bd7ab87a2ad4e80f2677b46c99

SHA256
bca513d97c6df8c6bcc384f7b0a3ccb038fb375e9727d56470c4d75e572d953e

SHA512
b514dbb90921b702df18f06a34131f9000d61d3b1b3294858809826eac9d813747e4079da9d88b4f58518b623350d351eeee01989a7420d6e28cae7739f2fc80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a71d1743b64e2ce08f1390c460b0218d

SHA1
d4cd4e3dddb809421760cc8d7b696908ab3b4c5e

SHA256
cffded3e6e7e33d789fe3f4a1b198227c5ad6bf3fa2fed07367e682a8f03e6bd

SHA512
d4c713a0c42f7e64ed4f598c9a633ce72d5cd37b010a2bade6b19d0f11f10788721c9c7ac0c619a5e28039d6461243d5777d4ba441e16231001c7c8ce81166f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
82d983103bc91397cf94c54b7ebfdc15

SHA1
e5514fd6e7c4f163644f4a055dee921a5b76c91c

SHA256
53a395404be9d8c9e8550b7b5c1e15bc152ca9a89b692ca4e863df2c45de03af

SHA512
241026cf8a19a59551188456509fe81ffa0b493200053b4c9825216871d246dfb505d608cbb5eab7dacdb7177de5f559bc933653b35f534750b5e981945afaf1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
576dcd0fc84c3fa23a079bdc1d6591e5

SHA1
09c332829ca5aa0ddbb021e11fe05bbb7dc8135e

SHA256
18f0c5aad5805242e2e926227c705a30cb87b67506220ed6d8a3ee3d582f7c93

SHA512
941c73337a6976f2dc1d64cccdccf36f3d487b3ec479edbcaa334d32d9171ab05441e458a124ee945806d59c3f7c81f95a73d485f21efcdc3192e61c6fa42182

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
273335bd911ed36c097575f29bd22801

SHA1
cb50e3973c4d87012f2621870b96e708103f52a5

SHA256
6c3a3f6de1af7af87c0b41e53ec4fa4436b10704f3eab3108b74b63af3f811e6

SHA512
bb34d2242dd6375e6dd16ed524860080d8a883490777c700fb66567404340efa8d4e1eacf562f277081acb77484f95267c37b5ca6a3e594d793824947946f933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.84.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\96ea6877-0578-426e-a7c4-bc92f8ff98e2.tmp

Filesize
2KB

MD5
42262efab3b79edb00724db18a49815f

SHA1
5cca89309c42df6455b2a778c2d873a969585f44

SHA256
2217a144466928d5629c58974c12c218cc92c965709ec53cddf252224831964b

SHA512
2410eb75d9ef4db0669840029ae1975e97026c16a39da8aae92759f8e4753d6a933aba114c8968ad66879d30b40f3903ca0f71909d7308c8c5f90783e78bb472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
13KB

MD5
d9e49e58c4dd3ef934d8b00a8d891957

SHA1
d76129e7a94e59ea4e9ea02072bfab8b03a7d445

SHA256
0ab917d6f61a2c401d1a1c01ac68990981b3612be9f423b8d94ef554def9ce97

SHA512
a64a81b9bd48f4c17dd725f167d2ccb2b27a85276cee467d595a9a3d0b69c99994a76b5a5e4173dc7c2ec3bce84b481a753ae2b7486bb1092c6362b92204b2dd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
34KB

MD5
45447c0f3ef63790e471058f75bcc15b

SHA1
2845604720666c7c205bcaae773a24464c6cbff2

SHA256
5822f95312f0818187f00ff7e2cb04caa8b6a856f5d4adc600c959af5944b2fa

SHA512
6a3444b26dab3bd32a892c010854c59ab597d88b99e0eb3744f8224e9d569ea3a2dc53ae9b3a96a327ccf9f5033c1b26f160e72aea905eac2308d1ae39f32b2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
35KB

MD5
a88896b826564af170bbfdb41138800e

SHA1
80ef073e8445bd140a8cf4fbbf178a5bb9b02408

SHA256
61eea1f55990f3f241885ee01e8bdec2f0a92d9bc4693864aec362de7816337c

SHA512
03a224ccfc216fcca715388da206a2c0acc140c45250594368c7cf8cb7783794dd79ea84d3fc0480fbc645caef125717231a981c8224ab235557e0c08272d9eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
ca79c23afd2c82d7956da0483afb5322

SHA1
426e303d00818ea4841407049ab20f3a7ffa272b

SHA256
2130d7d9576fb16bcdb64d27e531c8bc17f038ccf27e77e5150f9642f5b0a209

SHA512
168a37a4516734fa3ac2c0c1699584098181436f019386103b10ebe360d54e0833dff605b9cbbbe4258fefaaf30010a87b73ea0630df62a1610eec22e06b63c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
8cef5ef5d48bc32454630f6b9418ba83

SHA1
8bc4180e4227ed7df169c4710a1429476e927d62

SHA256
116b2c73067f4e61fb5314fdf3a753a6ff9fd8e989bc533d6d18872dfb98298b

SHA512
ef457859641ba27fd8e66783830819ed05f4793b992ed829864ed5ac4f6521ae4beaac5d3f3954181a71f732495070f5b3b7776d282cfdeb96db14e82b3f4c4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
72545d515cb94effd0a5ecfb09c1bf0d

SHA1
52138162e041a671a5692e9a963690001d0e0951

SHA256
d708ff7762d5c344d56e2bdcdc77d7505daf2773a7374dbc2140056c7fbfa96e

SHA512
6009bcd6f51b21c62b4d210f2bd2b09bb4324d9258bff91a5c1304bb6e1479a0e75f3c349efe72f6e0f30d78afc081eafc3706bf7958fb32cd8086e792e8ea01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
24046d8f1b7a0c62bdfb34156517c98b

SHA1
788e29ee5f5a8942586bd8f232f659dbada485a4

SHA256
e09b31f817f8815d145411845b00c57c113b1cb6cac5e2c58bcac78f270a65cc

SHA512
efa60422bf36eff9b1baf85d8c4594653c1b4bf14a99a00755b188257bb8473920c90c01388f6a4fa1bd18cb7fa926c70364cb68ca004e83d5fe8a6b8285c3e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
b0d2c44fedbc7b7694201c073da5bccd

SHA1
cd906ab81e161d7e8fffca0dfe22d1a3ba9a3971

SHA256
de66a56e036a4f7f16f48b6382e3259f0f9fdbb1793d653f4d27817f385e01ae

SHA512
424841d7a77ed3c3699365cacb1607bcf1bcabcb61ba6fa4ca0151dbdd37522e84472583fb35d484708fabda133ef65bf54cd695e0f6ff5b85bd746c4e5544f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
309e4d475bb441e4e8b1d8d8b4687c82

SHA1
205c9b286ddbe3dbd44b504fcfa9a5c25bd39d80

SHA256
10a21a21ca50ddde5b9044046f9b0bd9106d7e1112a2e84801f2206833cb8e3b

SHA512
da73432b6840d769ad3db2a4b5dd28266ba1da0e668cf826276562ba311b2f4aedb3e2124670755a40692f9084e403e9f1fe6db369dce54913e86303c7d49a4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
1b0f42dc48664b757efb5a692763ea28

SHA1
5d9b698fdb16d399ff22a74dce925aa7232d117e

SHA256
44180d36249abed1316b9d53158cafd40077c93b021801364e2e87cded375c41

SHA512
ba98f9acaefefa114ff26425acb2d5bcef6d6aa50e66359c2276f5de7553220cfef9ce960c116cd2c2a090c2881984f983589f1fc2ec71ecb01f7305f6fccbac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
70774898a440cfba323ebfe4cbb7b526

SHA1
ca07417b5fdf38221167074a137f789a2d0b8e0e

SHA256
df90c07175012c809288bcf0e718727dec31afa961eb0ef3797858c6f5fb61c6

SHA512
fec08934d82fecab8e5a816b9ed5e03856fe9f3ef48e7a4fc5da0255b5d17ea5b9473258f45058ccea0a366b09ea48847dddbe6d574e173d6a577c10899ef694

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4fadbe6e240a9ed2e21b6e8c69849671

SHA1
13e6c9cd9d7d137effacad1e7c8c84302f7991c8

SHA256
f1ee5a4cfdf9b332fae7e3dc3db822d6519758951e8d9b403ef958558f5525ce

SHA512
ba2efda3e7f1b5344c4ad36fc49fc0dbb95738c97e1c394377c8d19f296f91b16ee55d0bb832dc821287310d9f52a15db81ef4f27848081ce5dec2476e9bd0c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
73c51bc7fb4b85dbfef2f79dc0675abc

SHA1
28ce979f165a80b45708ed7916f553b5048808bc

SHA256
4d19d0443a2e6a29e72ca6604ca955ff060b742b73809c1fb596ba0852c7f8bd

SHA512
5728eb9bc4daf721a6d00cc6a3fa7659903426880efe513adc4d1a71b2833f5a84997246902da915629a429ca89ffa908e4c5b7de10afea89dd0cb9da48d5e21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
2ddb9b6b1979c1f51936143524a6e0d6

SHA1
932c3379979681371e1dbd3049955f595a796791

SHA256
bb19fd2b0247373605f3ed1f0e76d7c284523b15351103571b99f181222ef89f

SHA512
01feb068c24c54edd7b20e4d144ac5876e0749f6a5ec2678b438cfe41807c8528e74ef2773c19ba940a5a4f14dd8a23dcedbb739ed1e32127ae3d51e3d5f0fe6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
d95cd37a2140a2e36eb6a7f8439bab94

SHA1
2ecd0eb2fbae218ab7557afed98099875a9eb43b

SHA256
cb5383f4336d6247f1ac9a6dcd6ee6c4bf43ce04a91d0927657dd39550092742

SHA512
b5320faee2a7e21dc60c8733221c6c2ffe0a28a2ec6c90fb2119ab5561fbd38098172286812364855c9bc41ecc35a4aec0b45321ee729631b781dd16e3b918fc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
cff3b40d401fb50f14ccb489d6775254

SHA1
66f9f188258c33a1966c21a21e594b31952ad62f

SHA256
f65c8e97db6dce4239a440e38b756e5b235bd056c4c0ed90948e98d48ea768df

SHA512
0054fb680889c4ebd567d3fc84c501bd51c5b281767de723285674a26a32def593e2238df5e190d6eb1d1fb61b48f3d0698194b7f87193f6d126a9aa9fa2aa3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b1f602488b999fdaccda410649c42340

SHA1
70d0318e9a91d0817d420c9bbfe65fd7333b353e

SHA256
dc0d59f33a9c222e8c2b91afa6d4d13acdb53a0b686e305d5a989cbb0665300d

SHA512
da731338cc78ff12b518b0410cb2dfc3fc837dd565ab1fdef248a506938c77d6c366edf1cf8b633f6ff9554a08475716d4fd73fa6b12239f06d8bc76aea19991

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
6KB

MD5
b25c3623ee7400abb425e0e8cbbcc01b

SHA1
4612486e70b90a690cf089af347af7246a5b7ec4

SHA256
90cbe2090387d03f2c24751c108793435a5cec6ccc70cb9da23f530dfff6764b

SHA512
3a6ccf287fbe286ff3777eb84b68fc84c3c5b2c88d2b2dc97b60a3fe900bc70eeaee6fe0a854a1c6d360d459e9fc4794beaa740031d16fcc8bae6826b0b98439

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3edc799dd4a2ee44955544b6a9550359

SHA1
8f249171f4561a6bd231bed4de7b3107adbe99e7

SHA256
d1911f72e51184702fcba187e20822a709fc3d98fe78854acd5a4cf3c03a0f6f

SHA512
e54c25c86c02e65e48c95583abefacface817906cc98de66576bf69478f83f999bd0e44b50895b2c90c515455934b8d86aea8dc0bb68320371760699cdc2e031

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
f763a6aeefb89f4b0ddb4f3c90441d45

SHA1
83402758cb6fb4c71562977f2dbf2a1c20ae0226

SHA256
db12c091dd2662f237c50251a0b48c6ed29779dfb3139730dcaaeda6734d3909

SHA512
a13fc4909ca19c2a05524bfdddb7c8cdfec2305040c02cef67f35fd8031ccf04d1999487ff3209740cf2c0605f72fb1256aef5315bedcc0a6d4cc0f103344e42

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
d989da16738cc50193ac52d720d7ab1a

SHA1
b741732f59dbbc71e639692430215cd548a47599

SHA256
ab61be3b1a94583752c0190c7ba203761fae2883597814f5afaebf588e1b64e1

SHA512
c7e1af30d841191a8ade4021ebf88f1897c15e42627b6a736a0b5e49b0578e3da993f0942e4f5c0f6585c2bf166e2a0e071fb87e58b920052e0931fca7bdb36a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ca764d2e052eef6a04d9857d49663c82

SHA1
c50f3734a5d50cf601fc8e5c7323e135511d9b82

SHA256
ad33e535ec4f18b81e3e5800d9e4ce3a7f2b9c2c7a079d1511ecbe5441f474fe

SHA512
88f50f330c3df02049e8606e427eb7b63f7f0452a400395e66c28f2d96277f064f7d16524d9db573c373d301120232040197f2bb4fe8339446897916d00eaeb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
bd6e957148460d24cddbb5d0bf3e71d5

SHA1
161e36fd4382ba8920e9114fc15c45f60d2e3fad

SHA256
008fc0c2c395e67be7a7482d6c0d848a498a7446290b1253a65b58cbcea0b787

SHA512
7a0432c198c0383262eb9bd4eaee94988780fd523a9bd570088ef7d5c8153cc81170c19f5458bb1b23e88f7543e964813ce4f0063d0d181ac940f97c329c5674

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fb16d6f4df9b40978456ed2479f5ff8d

SHA1
5f05f48082be72e4dd114e4015376ad5c5c0b165

SHA256
7b6d7f4b6ceeff41231e21a8bce6b712373a73b0504e414a044be10723057331

SHA512
6d1f7580d6aa5627923b6bbba559c62a07f15557505e9edf13d2f6643b7a7c721a5dc3620b698851e6343605d995a61155c712374b0394663410ebaf605b0d55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
02caa56c433cc0c42baa22622789f97e

SHA1
7003ccd8314aab602f64e78cb1650ddad31b9b65

SHA256
3fbeda6fb8b84e925a6bb627591b0ce1e48fa13983789dd932d6c016e5778785

SHA512
0197ebe5d040e2dd71a02922f5ece856a389184d163706e36e2a80427a412979825b8a7e4a75aa81345bf50b034a00f20921b611449ced98749b77aaae499768

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
13a06593e6373e20de4ad7545437cf90

SHA1
27d8ce839bb32931351480c371e05b71cc13fc72

SHA256
c1d014e76ada01c1a50f2c3f7809284d4653e8cd9304958112270a5551c6aab4

SHA512
671672b97203fd9d39ab42b38413b51adb122927e9dd0ad767c55504c28ba95e5b43002423db4dda142380c26e91a3ef4cb2a471898a903d31329a4dec52b124

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
49c3846bd26f9db2ef64ea9fb94f0fa2

SHA1
7ac9d655fd91e061bb6ea12978504414d121833a

SHA256
7f1b30a084ede656bb2b7b59d5fc35aff8a3d4f691c80e53454f490e09ed1348

SHA512
efdde1770b4c086289dbbd47a529e05ccf501210eed39b5860dfcc0ead8e368ebf2968b864fd957c4b9906f23f638666d771a3e3e43f0a108aa11c67cf678711

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4886e92410df608cca3aee68c3a7c294

SHA1
74ebcabf57efdbbfee8ecfe4b57781f6a5ca08c3

SHA256
789aaf8ccdd60b74f1bad28ad4cb8914dc52105b094e2315db9113d4583bebf4

SHA512
561cac62dc0528be46d26feb06c4ef864510b3a702c78d19c502597e0138ce51f7b4f54d4515830af1c47556f2279930931c6480187dd7c2a9554b3881992e1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
a27b62c347522a3b5df7be876dc40839

SHA1
ed51321d690dc8044519714fbf6c97e1fa16dec8

SHA256
aadeb54a6697c2cddaf4e7322e32ef949f8270a37e81c29fe158d77e84c170c2

SHA512
f80447e197eeba7badcc76939b6ccca18dbbcbf55f025948858c27fba6eed21a9208d717eec1a9730f9f860744e35ef4a2bde76dd040f6f6aa509ec6ced6ff3a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d98874a09e8fef1a9ebd8261b927183b

SHA1
9ebd03febd8741e5448486c8495596132c464948

SHA256
9a768673480870398a1bcc6a27d97ee284d6b674a72d5cd825040f8785ddaf60

SHA512
4062bd157e0d5207163810f3e0a07aeaedc4f3382c0daa6cfee1c9d3679018ed1e3801d3ba1b6d64bfc43b21f6afa0cfb9248d4ada029ac2ef488e8c8b108563

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7abe69170ec82bc259da856dcfeb7f38

SHA1
f59fb138033256dd5023befc141f21865d786b40

SHA256
22449c8331e1dd06a25306303dc5c4a8260ee98dce12633c865ede4a81cf311d

SHA512
43a1eac8a30368f0de15219bee43cf837bb5252ab52656a2db4066bb33b9ce4c34720f45f231975bffa0d8f83f95a68d91c59e9ad9b480276d2919e7ed09a286

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
afadafff37f6c7286aae2746a5219362

SHA1
e5bd371a5df35504d33b349a6f2f4629f1dd0612

SHA256
700bdfd3f0b81455dc162fdc1efb947fe1af42073cc501e3676653250f32bc2b

SHA512
1c45a245a50927f9abd315a6bcc712e8a7013d388b1a70e5097127e24d8781fdf1d0369bafca42e6c8fa21b195b606f973c18dad1d2ef2e7c5eda409db005d56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
dab2d272364e4adc713c57f5feb788bf

SHA1
63b99fcbc09dfe8f23c2a217ce49a611df416960

SHA256
033b561933ad1f961cb087ec9156023939566cf7e336cb61b158ce61f110ee28

SHA512
32a5bc818610dca1bb3cfd75234f5f85a8d4b907a27c9d80361d225fde54284782f3cb8f433b245602c864d80283797e05ef14545d1d3a9c1b4dededd30029c9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c5f6c4f5256ee47079bed25d1b8a7c7e

SHA1
9140a7d0240dc51b75b1e33aed711d7f480052f0

SHA256
ad9406a32bc1a9b5616f3792fb941982bee2f7a7e65f69d47afad0454809e880

SHA512
033bf961fca6a90f1b3c14080ac5967771f6525963746d8226dcca23e635785505c7badb5c3915c3bdaf328579819669203cfc3ce09d5365672964e9d4233483

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
1bc8c2fd24201f73a3b4e30d8843cad7

SHA1
b6805020aa6c759751b7dd225ba3792314e2948c

SHA256
2826cbbafe9c85ce87d0b9743dcb534323c07762cb3b92aa82fad9f16aa9b60b

SHA512
bd2ac178f4cba30025903500bfdee1716757eea0ceb1ccc91725856753a5d55202e6dba874918503918532a4538e0d731855c5bcd218590da05b665bcc2028d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
005ebab9a7b3b628564feeaf4f07acca

SHA1
e20696b63c4784225ac2c7249f43b067a6a62e90

SHA256
fd9831fd63676bc33f684286522c3c7430bcce10e7bc7f8dfa12d0fae4fc0696

SHA512
3586c88de9df5390263916d5c177c11319095981f461985bf163602d1011fe7e2836010616f10a932dd3030ad3f12243d4f0937d00178c229baeeb9cdd793832

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
5105b9b25d953cb5ca2b6837aa2d700a

SHA1
179c4ac81f7c40e6898dabe53cf38ede496e5021

SHA256
abd7984f406ff424c41a48fc7ca65a8fdb532ddc0a11bec5c614e8ba53d723f6

SHA512
cf6e738a647460ad874898d14c1bf12470c54c8ace45a5c80134a7b3f3ea0c2dc3632e81bbc67ce4071542cb92cea7fc7bd744163a0c1a5b3769a24994685868

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
c8da11bd42f9a3624ab54f2b4096ef44

SHA1
74c250a4b9052876d7fa3552da9a0bd85a45907d

SHA256
548d6f60a74c60a0916e233dd37a51ec14ab2a0ac87d63be35e1de6dd28ef1ba

SHA512
bdc4ac28dcf70c00fb4610044f925f79f8b73095c3e902b8ceb28661e682ed659b0ab5d5fcfe8129945f5c664c14154c0c37943415bae135be2e3f9aedcdba7c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Filesize
72B

MD5
181efe9b0a74124042f81fbda3a48a65

SHA1
10dc9ec15155859a05723db3059e934a9b33d1f0

SHA256
8516ecd6049b8a46bc17bfe25bbcf7fe0f448db06324824c56fd7040404329bd

SHA512
6a0764c765b1a3adb52eff730b834fb877874dd0fb372eef63ac7cd234bdb79226403f82dc5784c8ac111d8e0236acd70f9f65eb19ee2510d6023e4204b880a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
549ae32b53eb96ed13d88c3dd4e8b034

SHA1
e7f54debd8d35dc9eed48d288adec68d27812456

SHA256
c7009adfefa542d7266022f5fcec558711eb9d2bd7a5f8e3f512ce823a950da6

SHA512
eb019c020949a3f5d0634a2016dc0c9aea1caf6a3012c371deb5365894950fb128974bf9b1387687304dd8c68440d350677107e2380cc73c3a4540b691a52e84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
6f7370d31e396390b182b5f865753529

SHA1
4238ef02d0dc9182894b949b5b70029c15737131

SHA256
5d15c4ff65e21f2cbf62d9ef9dd73fb12bdcf801e6dfed2989622a628fbf8512

SHA512
0364a3ecf3674e60eaa70b06525022d6d5fff79dca0450fa70a3e549843a246362cf78b21ab7b17bf9e875488bffd9fc42c6a680c31af8beeaefe48edc03bccd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
1d4c3b3a2df0493d1f42eb288baea365

SHA1
d347ac5031f5441d3998e19920652d9fe684cef6

SHA256
053cc55f3ae2cf7b89a99ef405676ccf165be1a36321a18e49ab97a9e46da193

SHA512
65d46a8dff95922079ff8518fac090f3b6d606e8a30e207fd411474329975ba96fdef874fb590697673630ca0dbd2a0187cd2a03eaf9521cc87e7aca7a09aed9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
b9f3e84543b80e88f53c7d69a4306098

SHA1
db02a53a7a596a4f8067e16ca04af816724caeb9

SHA256
91e13702e2bba86da71a7fcbac3806b5ff91c8b510aa4e77c6e38c5ea861de85

SHA512
32a00df03139fb9c10d0422eaf3f95db83a7acc2b05a492f82ea92feb2d9c7bc8bf905aa06a9e7018b7e11e52c22d56c6fa8716bba7dfcf9fd61751ea17fde3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
84605d7b432c06cfdebbf0926e9fcf69

SHA1
801564aceca3ba562a4477239733b356abcaa6e6

SHA256
3dc23df3cca2d0dba0bd5cc1bd98cb1c828631aba1eb5b22de7d0127730e4ae9

SHA512
20091704cb5f177fca4c822fd3602621b4db7341727c5d9e83b64dd9e4f8fdbf8983cbfc8e94edb64520a1b55918bbca9b88fb295b78d57eccf385a2960b129e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
b2a8d59ed03854c061c098288d403712

SHA1
815b833f4ca5874bdd54c40dc749792e558bfcd2

SHA256
e16c6cca2ad45c6bcc8a9739c86b9d339f4437d1f94cd7233772ae72c8bbfcbb

SHA512
5ef2c9a593ea4c1238d16e802d502058ecf997d5bff49c88cc5b447381da1556198a1fd99e29a3e548744c6ac3e533d4415dd90aff0ff9c308fca947546e5aa9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
2ab32a53b58b74d585cdbf5b29697346

SHA1
808f3551d6c4a3ef5685445d6aa53e0398e4feb1

SHA256
115b2ed175ab2fec41b7bf4443e85d3fd64c751f0823598ddabab1101a4ab66e

SHA512
14bc203252423a23c4de364f444bb2da98aa146cda3c843e14810eb6fea8ebd6f77a5139b2e221050ecd45cab42dd00272e1461cb462589ac075a6bfe0e6eeb7

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ba518c4cb2e58d87faf9c067941b4ad1

SHA1
13505eb705804fab115e031e10b9220155cb0af9

SHA256
055d4bd351800e2e749baa672baf3f6f88815d06c559e6e6ca88dfd26505479e

SHA512
8186ff7246975cbeb1b2b43b027705173088b117eb95d72ce7580c1e6f78efb53afd7a7827337e54b3a65705c1da3ad0cd014afe58efca39ba4fa7f1b14efb41

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index~RFe5b7135.TMP

Filesize
48B

MD5
15a7ea11c8d31e70b1fa9b9a16c6d64a

SHA1
18ba9a6767c1fde6e8842141c1b975e9aea174f4

SHA256
cfb0ba3452c50d3decb6105842e6028fbcb85b2a934dacbcb10ed41f4e959d77

SHA512
6ba811e25d25a851002d3aa7161ee65954057e87749b84dc6a11160d34e4d741ba17dd0ce243fd9624b9222ac3277ed0a5e45b51504d60bffad746a6e9519780

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnGraphiteCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
720B

MD5
f7c6d13b10a6b37942113cedcdd9089d

SHA1
7f55af5ac44e7fba0a8c6232de7f6ceb81c23f3e

SHA256
88ef9b5c0ef7a74eedff8353921a416e56bc56aa7d475605fe3bcb5542726d42

SHA512
63692049a9876e288d324620be5267bb73f56d4de6452ba7e149dccfe5c78c1879d0b50db56cb705e8c31fbf6687d8b8ce6f038d314afcb1b7fdd7a70ec2d004

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
832B

MD5
0f11a643ab9bb360dfa5f80da84af8c7

SHA1
8c6c29f5bcdf0def728d11c08fc75d33b72d86af

SHA256
afb411656cdbd6268c62a6cb0f8ca035c4b4ff3527957701a57b214a77e1ea55

SHA512
d0fc032df6290ad82fde91b9b416b970e69e2d532ecab7a944bb35d172f761294700b527b6d4b2af862a994443008d6347e99c39025fd61bf4c5db8d959e3375

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe5c2c28.TMP

Filesize
529B

MD5
c39741c79108731f1e16685cd0e5f131

SHA1
eb1930dc6fe4aa9463b9da57f668ff802485af14

SHA256
f43e2d0fc154ad2c0358bf91219a991c5fb9cbccb83bfa1ac5aa9883e6637e7b

SHA512
35e98a2a447cab66d82c629982bedd004873ac340f449ba7a9443438d5e8a4ddc65258cb0d07ef4a91bf02c99b49370e0a5a546945992042466bcac81f796f9d

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
300B

MD5
db6d4d76c5f4564249b398ad1138b256

SHA1
9b8781d6fa1dd4525ce1cefe0e9523d248acb8cb

SHA256
d63e01afd5ce1d436ce2b0c0a35bf517a3de077aa5fbd5a79798191a05fc4944

SHA512
4f91b1a98e5fe172ce9dca4483c7f72c0686256a1c990c8b793b5311115180fd831667030f7f6cef9690fe10cc8e2fafb9c69895196e1e4811f25ec7ee6059f8

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe5c3e68.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx3BC9.tmp\System.dll

Filesize
22KB

MD5
a36fbe922ffac9cd85a845d7a813f391

SHA1
f656a613a723cc1b449034d73551b4fcdf0dcf1a

SHA256
fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

SHA512
1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx3BC9.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx3BC9.tmp\nsDialogs.dll

Filesize
20KB

MD5
4e5bc4458afa770636f2806ee0a1e999

SHA1
76dcc64af867526f776ab9225e7f4fe076487765

SHA256
91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

SHA512
b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx3BC9.tmp\nsExec.dll

Filesize
17KB

MD5
2095af18c696968208315d4328a2b7fe

SHA1
b1b0e70c03724b2941e92c5098cc1fc0f2b51568

SHA256
3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

SHA512
60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsx3BC9.tmp\nsProcess.dll

Filesize
15KB

MD5
08072dc900ca0626e8c079b2c5bcfcf3

SHA1
35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

SHA256
bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

SHA512
8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2068_1056974750\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 806082.crdownload

Filesize
2.3MB

MD5
1b54b70beef8eb240db31718e8f7eb5d

SHA1
da5995070737ec655824c92622333c489eb6bce4

SHA256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

SHA512
fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

Download Submit
memory/1048-14110-0x00007FFD6ACF0000-0x00007FFD6ACF1000-memory.dmp

Filesize
4KB

Download
memory/1048-14109-0x00007FFD6B040000-0x00007FFD6B041000-memory.dmp

Filesize
4KB

Download
memory/1048-14549-0x000002222AC80000-0x000002222AC88000-memory.dmp

Filesize
32KB

Download
memory/1760-14071-0x0000000000A30000-0x0000000000EE2000-memory.dmp

Filesize
4.7MB

Download
memory/1812-1-0x000001C2CAE30000-0x000001C2CAE3A000-memory.dmp

Filesize
40KB

Download
memory/1812-4-0x000001C2CB450000-0x000001C2CB45A000-memory.dmp

Filesize
40KB

Download
memory/1812-0-0x00007FFD5A6B3000-0x00007FFD5A6B5000-memory.dmp

Filesize
8KB

Download
memory/1812-2-0x00007FFD5A6B0000-0x00007FFD5B172000-memory.dmp

Filesize
10.8MB

Download
memory/1812-5-0x000001C2CCBC0000-0x000001C2CCBD2000-memory.dmp

Filesize
72KB

Download
memory/1812-20-0x000001C2E55A0000-0x000001C2E5616000-memory.dmp

Filesize
472KB

Download
memory/1812-21-0x000001C2CCD90000-0x000001C2CCDAE000-memory.dmp

Filesize
120KB

Download
memory/1812-40-0x00007FFD5A6B0000-0x00007FFD5B172000-memory.dmp

Filesize
10.8MB

Download
memory/2812-14562-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14657-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14565-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14557-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14554-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14590-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14551-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14623-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14698-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14695-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14546-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14669-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14672-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14569-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14737-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/2812-14701-0x000000006DF30000-0x000000006F271000-memory.dmp

Filesize
19.3MB

Download
memory/4192-14550-0x00000295F47C0000-0x00000295F47C8000-memory.dmp

Filesize
32KB

Download
memory/7192-14636-0x0000018950A20000-0x0000018950A28000-memory.dmp

Filesize
32KB

Download
memory/7884-14674-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14684-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14683-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14682-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14681-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14685-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14679-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14680-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14673-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download
memory/7884-14675-0x000001AF7F560000-0x000001AF7F561000-memory.dmp

Filesize
4KB

Download